{"type":"bundle","id":"bundle--40e14d42-09a7-5496-8eea-f80663de30fd","objects":[{"type":"identity","spec_version":"2.1","id":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-01-01T00:00:00.000Z","modified":"2026-01-01T00:00:00.000Z","name":"CTI-Hermes Autonomous Agent","identity_class":"organization"},{"type":"indicator","spec_version":"2.1","id":"indicator--0d035dab-12cd-5225-a5d9-70bdaad1049f","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-08-29T13:15:02.229379Z","modified":"2026-08-29T13:15:02.229379Z","name":"SIGMA: KongTuke FileFix Execution and Interlock RAT Persistence","indicator_types":["malicious-activity"],"pattern":"[network-traffic:dst_ref.value = 'KongTuke FileFix Execution and Interlock RAT Persistence']","pattern_type":"stix","pattern_version":"2.1","valid_from":"2026-08-29T13:15:02.229379Z","confidence":95},{"type":"indicator","spec_version":"2.1","id":"indicator--06c9bb40-a7cf-5a72-bd36-4a8ac4b4b1b8","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-08-29T13:15:02.229379Z","modified":"2026-08-29T13:15:02.229379Z","name":"YARA: MAL_RAT_Interlock_KongTuke","indicator_types":["malicious-activity"],"pattern":"[network-traffic:dst_ref.value = 'MAL_RAT_Interlock_KongTuke']","pattern_type":"stix","pattern_version":"2.1","valid_from":"2026-08-29T13:15:02.229379Z","confidence":95},{"type":"report","spec_version":"2.1","id":"report--688b02a2-6ef8-564c-9bee-1c551d858079","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-08-29T13:15:02.229379Z","modified":"2026-10-30T15:08:42.801210Z","name":"Analysis of KongTuke FileFix Leads to New Interlock RAT Variant","description":"Technical threat analysis derived from intelligence published at https://thedfirreport.com/2025/07/14/kongtuke-filefix-leads-to-new-interlock-rat-variant/.\n\nKongTuke FileFix Leads to New Interlock RAT Variant Researchers from The DFIR Report, in partnership with Proofpoint, have identified a new and resilient variant of the Interlock ransomware group’s remote access trojan (RAT). This new malware, a shift from the previously identified JavaScript-based Interlock RAT (aka NodeSnake), uses PHP and is being used in a widespread campaign. Since May 2025, activity related to […] The post KongTuke FileFix Leads to New Interlock RAT Variant appeared first on The DFIR Report.","published":"2026-08-29T13:15:02.229379Z","report_types":["threat-report"],"object_refs":["identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","indicator--0d035dab-12cd-5225-a5d9-70bdaad1049f","indicator--06c9bb40-a7cf-5a72-bd36-4a8ac4b4b1b8"],"confidence":95}]}