{"type":"bundle","id":"bundle--681b60fe-6362-5b9e-b3e7-1e93566062f3","objects":[{"type":"identity","spec_version":"2.1","id":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-01-01T00:00:00.000Z","modified":"2026-01-01T00:00:00.000Z","name":"CTI-Hermes Autonomous Agent","identity_class":"organization"},{"type":"indicator","spec_version":"2.1","id":"indicator--6d1734b5-4042-58fa-9ed0-0c5e0a6f5c18","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-08-29T13:15:01.725799Z","modified":"2026-08-29T13:15:01.725799Z","name":"DOMAIN: teams.onweblive.org","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'teams.onweblive.org']","pattern_type":"stix","pattern_version":"2.1","valid_from":"2026-08-29T13:15:01.725799Z","confidence":90},{"type":"indicator","spec_version":"2.1","id":"indicator--f0e751d4-db27-5796-a8b1-fdeca157c479","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-08-29T13:15:01.725799Z","modified":"2026-08-29T13:15:01.725799Z","name":"DOMAIN: maskasd.com","indicator_types":["malicious-activity"],"pattern":"[domain-name:value = 'maskasd.com']","pattern_type":"stix","pattern_version":"2.1","valid_from":"2026-08-29T13:15:01.725799Z","confidence":90},{"type":"indicator","spec_version":"2.1","id":"indicator--8d2a47da-7ce0-509c-ba2c-ef2468aad851","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-08-29T13:15:01.725799Z","modified":"2026-08-29T13:15:01.725799Z","name":"IPV4: 23.254.164.92","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '23.254.164.92']","pattern_type":"stix","pattern_version":"2.1","valid_from":"2026-08-29T13:15:01.725799Z","confidence":90},{"type":"indicator","spec_version":"2.1","id":"indicator--0870a3db-8775-598f-91b2-629d7284a03a","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-08-29T13:15:01.725799Z","modified":"2026-08-29T13:15:01.725799Z","name":"IPV4: 23.254.164.123","indicator_types":["malicious-activity"],"pattern":"[ipv4-addr:value = '23.254.164.123']","pattern_type":"stix","pattern_version":"2.1","valid_from":"2026-08-29T13:15:01.725799Z","confidence":90},{"type":"indicator","spec_version":"2.1","id":"indicator--29b8a08a-55e5-544e-89e2-9bf8e836a529","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-08-29T13:15:01.725799Z","modified":"2026-08-29T13:15:01.725799Z","name":"SHA256: b122a9873bedf145ae2a7fd024b5f309007dbb025149f4dc4ac3f7e4f32a36a4","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'b122a9873bedf145ae2a7fd024b5f309007dbb025149f4dc4ac3f7e4f32a36a4']","pattern_type":"stix","pattern_version":"2.1","valid_from":"2026-08-29T13:15:01.725799Z","confidence":90},{"type":"indicator","spec_version":"2.1","id":"indicator--a3b55a37-7397-5dc2-85aa-d21a6f692878","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-08-29T13:15:01.725799Z","modified":"2026-08-29T13:15:01.725799Z","name":"SHA256: ae70dd4f6bc0d1c8c2848e4e6b51934626c4818dcb5af99d080ddbd7dc337185","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = 'ae70dd4f6bc0d1c8c2848e4e6b51934626c4818dcb5af99d080ddbd7dc337185']","pattern_type":"stix","pattern_version":"2.1","valid_from":"2026-08-29T13:15:01.725799Z","confidence":90},{"type":"indicator","spec_version":"2.1","id":"indicator--7b30b8e6-69f7-53b0-ad35-539781e814bc","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-08-29T13:15:01.725799Z","modified":"2026-08-29T13:15:01.725799Z","name":"SHA256: 50eae63d3e24be9ca8803f4b5a0408aef97ee3fab7af018d8c2dde7c359edd65","indicator_types":["malicious-activity"],"pattern":"[file:hashes.'SHA-256' = '50eae63d3e24be9ca8803f4b5a0408aef97ee3fab7af018d8c2dde7c359edd65']","pattern_type":"stix","pattern_version":"2.1","valid_from":"2026-08-29T13:15:01.725799Z","confidence":90},{"type":"report","spec_version":"2.1","id":"report--37b256f3-2b72-5e53-bd22-bd0c59432c14","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-08-29T13:15:01.725799Z","modified":"2026-10-30T16:13:47.603826Z","name":"Public Mastra npm supply chain compromise by Sapphire Sleet","description":"The observed chain began with npm maintainer-account takeover and dependency injection. easy-day-js 1.11.22 executed setup.cjs during npm installation, disabled TLS verification, contacted 23.254.164.92 and 23.254.164.123, fetched second-stage JavaScript, and established cross-platform persistence. Microsoft attributed the activity to Sapphire Sleet with high confidence.","published":"2026-08-29T13:15:01.725799Z","report_types":["threat-report"],"object_refs":["identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","indicator--6d1734b5-4042-58fa-9ed0-0c5e0a6f5c18","indicator--f0e751d4-db27-5796-a8b1-fdeca157c479","indicator--8d2a47da-7ce0-509c-ba2c-ef2468aad851","indicator--0870a3db-8775-598f-91b2-629d7284a03a","indicator--29b8a08a-55e5-544e-89e2-9bf8e836a529","indicator--a3b55a37-7397-5dc2-85aa-d21a6f692878","indicator--7b30b8e6-69f7-53b0-ad35-539781e814bc"],"confidence":90}]}