{
  "metadata": {
    "generator": "Bulwark Black IOC Extractor",
    "source": "https://bulwarkblack.com/unit-42-exposes-active-exploitation-of-beyondtrust-cve-2026-1731-with-vshell-and-sparkrat-backdoors/",
    "fang": "live",
    "exported_at": "2026-07-15T22:58:09Z",
    "total": 64,
    "categories": 6
  },
  "iocs": {
    "IPv4": [
      "134.122.13.34",
      "138.197.14.95",
      "142.111.152.50",
      "144.172.103.200",
      "155.2.215.64",
      "178.128.212.209",
      "179.43.146.42",
      "23.162.40.187",
      "37.19.221.180",
      "45.61.150.96",
      "64.31.28.221",
      "64.95.10.115",
      "70.23.0.66",
      "82.29.53.187",
      "82.29.72.16",
      "83.138.53.139",
      "85.155.186.121",
      "92.223.44.134",
      "98.10.233.76"
    ],
    "Domains": [
      "39uchxifap4cvgzsuirom0szrrg.d65lre9sfqnlcv49317gcis6pyjsatzho.oast.pro",
      "aliyundunupdate.xyz",
      "d65sb7ngveucv5k2nm508abdsjmbn7qmn.oast.pro",
      "judiemkqjajsfzpidfjlowgl8nyrtd49x.oast.fun",
      "oastify.com",
      "q0r2e5q2dzbykcox9qmkptm12s8mwb.oastify.com",
      "transfer.weepee.io"
    ],
    "URLs": [
      "aliyundunupdate.xyz",
      "http://134.122.13.34:8979/c",
      "http://39uchxifap4cvgzsuirom0szrrg.d65lre9sfqnlcv49317gcis6pyjsatzho.oast.pro",
      "http://64.31.28.221/support",
      "http://82.29.53.187:8778/app_cli",
      "http://85.155.186.121/access",
      "https://64.95.10.115:23011/update.sh",
      "https://85.155.186.121/access/Remote%20Access-linux64-offline.tar?language=en&app=76049110434275449312180081368257747094",
      "https://judiemkqjajsfzpidfjlowgl8nyrtd49x.oast.fun",
      "https://transfer.weepee.io/7nZw7/blue.drx",
      "oast.fun",
      "oast.pro",
      "oastify.com",
      "weepee.io/7nZw7/blue.drx"
    ],
    "sha256": [
      "0ecc867ce916d01640d76ec03de24d1d23585eb582e9c48a0364c62a590548ac",
      "4762e944a0ce1f9aef243e11538f84f16b6f36560ed6e32dfd9a5f99e17e8e50",
      "66cceb2c2f1d9988b501832fd3b559775982e2fce4ab38fc4ffe71b74eafc726",
      "679ee05d92a858b6fe70aeb6072eb804548f1732e18b6c181af122b833386afb",
      "98442387d466f27357d727b3706037a4df12a78602b93df973b063462a677761",
      "98a7b0900a9072bb40af579ec372da7b27af12b15868394df51fefe290ab176b",
      "9f431d5549a03aee92cfd2bdbbe90f1c91e965c99e90a0c9ad5a001f4e80c350",
      "cc2bc3750cc5125a50466f66ae4f2bedf1cac0e43477a78ed2fd88f3e987a292",
      "cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce"
    ],
    "CVEs": [
      "CVE-2023-33538",
      "CVE-2024-12356",
      "CVE-2025-0921",
      "CVE-2025-14847",
      "CVE-2025-23304",
      "CVE-2025-55182",
      "CVE-2025-66478",
      "CVE-2026-0257",
      "CVE-2026-0300",
      "CVE-2026-1281",
      "CVE-2026-1340",
      "CVE-2026-1731",
      "CVE-2026-22584",
      "CVE-2026-31431"
    ],
    "Bitcoin Addresses": [
      "39uchxifap4cvgzsuirom0szrrg"
    ]
  }
}