{
  "metadata": {
    "generator": "Bulwark Black IOC Extractor",
    "source": "https://bulwarkblack.com/the-updated-apt-playbook-tales-from-the-kimsuky-threat-actor-group/",
    "fang": "live",
    "exported_at": "2026-07-15T22:57:56Z",
    "total": 19,
    "categories": 7
  },
  "iocs": {
    "Domains": [
      "00701111.000webhostapp.com",
      "gosiweb.gosiclass.com",
      "niscarea.com"
    ],
    "URLs": [
      "gosiclass.com/m/gnu/convert/html/com/list.php?query=6",
      "http://gosiweb.gosiclass.com/m/gnu/convert/html/com/list.php?query=6",
      "https://niscarea.com/in.php?cn=[base64]&fn=[DateTime",
      "niscarea.com/in.php?cn=[base64"
    ],
    "md5": [
      "364d4fdf430477222fe854b3cd5b6d40",
      "71db2ae9c36403cec1fd38864d64f239",
      "f35b05779e9538cec363ca37ab38e287"
    ],
    "sha1": [
      "5c7b2705155023e6e438399d895d30bf924e0547",
      "b5224224fdbabdea53a91a96e9f816c6f9a8708c",
      "d4fa57f9c9e35222a8cacddc79055c1d76907fb9"
    ],
    "sha256": [
      "c62677543eeb50e0def44fc75009a7748cdbedd0a3ccf62f50d7f219f6a5aa05",
      "da79eea1198a1a10e2ffd50fd949521632d8f252fb1aadb57a45218482b9fd89",
      "e8000ddfddbe120b5f2fb3677abbad901615d1abd01a0de204fade5d2dd5ad0d"
    ],
    "CVEs": [
      "CVE-2026-0826",
      "CVE-2026-52806"
    ],
    "Bitcoin Addresses": [
      "364d4fdf430477222fe854b3cd5b6d40"
    ]
  }
}