CY-GAP-0801OPENHIGH
ACTOR_ALIAS_CROSSWALK
جارٍ تحميل البيانات التشغيلية
TAI
Threat actors, infrastructure provenance, C2/controllers/proxies, vendor aliases, campaign-cluster identity, temporal correlation and cross-campaign linkages
3
36
190
86
11
٠٣/١١/٢٠٢٦، ١:١٣ م
Cross-domain run adds Black October credential-validator/resale infrastructure graph (momo/Xingjiabi/key-checker nodes) with strong identity guard. TAI active topics remain ARTEX, TraderTraitor/Binance and PHP2Shell; static IOC overlap is not actor identity.
مرجع SSOT مسجل، لكن الرابط الداخلي مخفي حتى تفعيل حماية Admin.
الإجمالي: 21 Evidence
Independent cross-vendor identity resolution is incomplete across GTIG UNC7228, Microsoft Storm-0940, Wiz overlap labels, CrowdStrike VAPOR PANDA and unattributed ARTEX clusters.
Independent shared victim/event artifacts, infrastructure-control evidence, malware/tooling lineage and provider telemetry with time correlation.
Public evidence does not fully resolve ownership/control, compromise state and first/last-seen continuity for ARTEX controllers, proxies and campaign C2 across clusters.
Passive DNS, RDAP/WHOIS history, CT, provider logs and time-bounded controller artifacts.
No reliable denominator establishes total distinct ARTEX operators, forks/controllers, successful victims or currently active infrastructure after rapid proliferation.
Multi-provider telemetry, fork lineage, controller fingerprints, independent victim counts and longitudinal infrastructure observations.
ARMORY CASTLE/UNC5221/WARP PANDA attribution is source-qualified but independent public forensic attribution beyond coordinated incident evidence is limited.
Separate authoritative/provider attribution with actor-linked infrastructure/malware/operational artifacts.
معروض 4 من أصل 5 سجل.
Public evidence supports DPRK-nexus activity but does not independently resolve a specific Lazarus subcluster or equivalence with TraderTraitor/Onyx Sleet/Pearl Sleet.
Independent actor-linked infrastructure/tooling, malware lineage or authoritative government/provider attribution.
No reliable campaign-specific denominator exists for successful compromise among the 216 reported filtered hosts; scanning/attempts are not compromise.
Victim IR, provider telemetry, verified shell/payload execution or incident disclosures linked to this campaign.
Complete initial-access and privilege/authorization chain remains unresolved; compromised-laptop hypothesis is preliminary and additional breach points exist.
Final Binance postmortem; endpoint/identity/service-container authorization logs and timeline.
Actor-controlled vs intermediary status, derived-address lineage, freeze/recovery state and service attribution are changing in real time.
Fresh blockchain analytics; provider attribution; sanctions/freeze actions; time-bounded transaction graph.
Ownership/control and current continuity of the 21 scan nodes and earlier staging infrastructure remain incomplete; compromised relays may rotate or be abandoned.
Passive DNS/provider logs, first/last-seen, replacement-node graph and campaign-linked traffic.
Historical FBI alias mappings exist, but public evidence does not justify merging the Binance operation with every generic Lazarus/DPRK cluster or unrelated DPRK label.
Case-specific government/provider alias mapping and shared operational artifacts.