{
    "1b6e2111-1513-4865-833b-2feecc03df2b": {
        "event_id": 19741,
        "created_at": "2025-08-21T07:38:56.047165+00:00",
        "updated_at": "2025-08-21T09:46:59.365615+00:00",
        "name": "Campagna malware Action1 italiana Patch_Aruba",
        "description": "",
        "subject": "Azione richiesta \u2013 Aggiornamento urgente Aruba Sign (patch di sicurezza critica)",
        "tlp": "0",
        "campaign_type": "malware",
        "method": "linked",
        "country": "italy",
        "file_type": [
            "zip"
        ],
        "theme": "Aggiornamenti",
        "malware": "Action1",
        "phishing": null,
        "via": "email",
        "tag": [],
        "ioc_list": {
            "md5": [
                "dbaf469684023c0d0e1218fe2152ed19",
                "d26fe01c1661e7c678a8ddafd5584b46",
                "298e2c506a2986d8c4fac16fa48c58b2"
            ],
            "sha1": [
                "740a725f04a5603d2b325610a7cc3678c024903c",
                "cfe31dea94f0f58dfd145296339d734f22d23eb7",
                "88b17217d7a61e993f54df2be5c36b0f73e77b6d"
            ],
            "sha256": [
                "eda13877d525b8092335096bad7c06994312d5374b813b940627d1734f72be79",
                "d66294d8ecb6997da6aaefae800bcc1e2c45d19ec8934246f1efc98ea63795f5",
                "26e5a286fd018b1537393dae1fa986b259037affe4fdc523bc9bfb2dfa7be240"
            ],
            "imphash": [],
            "domain": [],
            "url": [
                "https://tsmtpdiamond.com/tracking/qaR9ZwN2BGD3Zmt1BQV5Zwt5BGt0ZPM5qzS4qaR9ZQbjIt",
                "https://www.carrozzeriatrieste.net/Patch_Aruba.txt",
                "https://www.carrozzeriatrieste.net/Patch_Aruba.zip"
            ],
            "ipv4": [],
            "email": []
        },
        "email_victim": [],
        "ioca_version": "1.0",
        "organization": "cert-agid"
    }
}