text: X64 Brute Ratel C4 Samples:  3ED21A4BFCF9838E06AD3058D13D5C28026C17DC996953A22A00F0609B0DF3B9 3AD53495851BAFC48CAF6D2227A434CA2E0BEF9AB3BD40ABFE4EA8F318D37BBE 973F573CAB683636D9A70B8891263F59E2F02201FFB4DD2E9D7ECBB1521DA03E DD8652E2DCFE3F1A72631B3A9585736FBE77FFABEE4098F6B3C48E1469BF27AA E1A9B35CF1378FDA12310F0920C5C53AD461858B3CB575697EA125DFEE829611 EF9B60AA0E4179C16A9AC441E0A21DC3A1C3DC04B100EE487EABF5C5B1F571A6 D71DC7BA8523947E08C6EEC43A726FE75AED248DFD3A7C4F6537224E9ED05F6F 5887C4646E032E015AA186C5970E8F07D3ED1DE8DBFA298BA4522C89E547419B  Malicious DLLs:  EA2876E9175410B6F6719F80EE44B9553960758C7D0F7BED73C0FE9A78D8E669  Malicious Encrypted Payloads:  B5D1D3C1AEC2F2EF06E7D0B7996BC45DF4744934BD66266A6EBB02D70E35236E  X.509 Cert SHA1s:  55684a30a47476fce5b42cbd59add4b0fbc776a3 66aab897e33b3e4d940c51eba8d07f5605d5b275  Infrastructure linked to X.509 Certs or Samples:  104.6.92[.]229 137.184.199[.]17 138.68.50[.]218 138.68.58[.]43 139.162.195[.]169 139.180.187[.]179 147.182.247[.]103 149.154.100[.]151 15.206.84[.]52 159.223.49[.]16 159.65.186[.]50 162.216.240[.]61 172.105.102[.]247 172.81.62[.]82 174.129.157[.]251 178.79.143[.]149 178.79.168[.]110 178.79.172[.]35 18.133.26[.]247 18.130.233[.]249 18.217.179[.]8 18.236.92[.]31 185.138.164[.]112 194.29.186[.]67 194.87.70[.]14 213.168.249[.]232 3.110.56[.]219 3.133.7[.]69 31.184.198[.]83 34.195.122[.]225 34.243.172[.]90 35.170.243[.]216 45.144.225[.]3 45.76.155[.]71 45.79.36[.]192 52.48.51[.]67 52.90.228[.]203 54.229.102[.]30 54.90.137[.]213 89.100.107[.]65 92.255.85[.]173 92.255.85[.]44 94.130.130[.]43 ds.windowsupdate.eu[.]org  Hunting for APT29 Spear Phishing Using XDR - Palo Alto Networks Blog Cozy Smuggled Into The Box: APT29 Abusing Legitimate Software For Targeted Operations In Europe Trello From the Other Side: Tracking APT29 Phishing Campaigns New sophisticated email-based attack from NOBELIUM  Updated July 6, 2022, at 9:30 a.m. PT.