{ "type": "bundle", "id": "bundle--8103a7a5-a89b-48cc-b445-fe5cdebc4818", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-28T11:56:17.000Z", "name": "AmonSul", "description": "AmonSul Tech LLC — Ukrainian MSSP, MDR and Threat Intelligence provider (Kyiv). https://amonsul.tech", "identity_class": "organization", "sectors": [ "technology" ], "contact_information": "help@amonsul.tech | https://amonsul.tech", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935", "created": "2026-10-28T11:56:17.000Z", "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "name": "AmonSul attribution", "definition_type": "statement", "definition": { "statement": "Prepared by AmonSul Threat Intelligence (https://amonsul.tech). Free to share and use; attribution to AmonSul required. Underlying research: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24)." } }, { "type": "report", "spec_version": "2.1", "id": "report--0945204c-5917-5fd6-ba82-6d349d40fe98", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "name": "AmonSul Advisory: Hermes Malware-as-a-Service — PyMapper Supply-Chain Delivery", "description": "Commercial Windows credential-stealer / RAT ('Hermes') delivered via trojanized Python packages on GitHub; two delivery chains converge on the LOLD downloader. Indicators extracted and validated by AmonSul Threat Intelligence from 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Confidence moderate pending recipient re-verification.", "report_types": [ "threat-report", "malware" ], "published": "2026-10-28T11:56:17.000Z", "confidence": 60, "labels": [ "hermes", "pymapper", "lold", "supply-chain", "amonsul" ], "object_refs": [ "indicator--f86b1343-01b0-46f6-b25c-0e45709309c4", "indicator--4694ceb0-3ef2-4d80-9912-21a2c564a826", "indicator--c6b5bc15-f548-454b-9d0f-fbec903a782f", "indicator--67978d66-889c-40b3-9c97-8fb946e91339", "indicator--8e92804d-2d9e-43d0-840c-56f0d9e7bcf4", "indicator--262ee306-f1b7-4bdb-9e21-e7ee1546d3e5", "indicator--15f3e945-ce9d-46b1-b508-7864fa6005a2", "indicator--4ddda0c1-0ca5-4054-a8f0-4dd1ee69ee56", "indicator--4346a254-7ee9-4977-9c40-47204827a1b8", "indicator--8966bf45-e8b5-461e-b57d-1de771c6d419", "indicator--29852688-8986-4a69-991c-778cd506c727", "indicator--e7f2b2a3-2ff8-413e-8c22-5c3ffe790823", "indicator--ccde3bea-649d-4f6a-ae79-3cbf069b4843", "indicator--d75153c2-f20a-4751-8f5e-7a4acc39a965", "indicator--3a209076-74b4-4d33-b072-049889063025", "indicator--9362d8ae-d635-4a48-8ffd-d7a3b21413ed", "indicator--9ed800c9-9513-45a0-ad55-4e78421e65e6", "indicator--837ddd1a-4256-4063-94c8-4fcf2d021297", "indicator--096e822e-7c3c-400f-82dc-d721a8a1b9f5", "indicator--3d37c9e0-d1ac-4031-a4f8-c0c34f4fd854", "indicator--6a73fd28-d86f-4a46-abba-285618390c52", "indicator--99d059b1-b6c8-4855-afbc-19757ddf368d", "indicator--67939be7-1240-4733-b980-30e3b9eb0b63", "indicator--99d5fba8-06f2-4159-8d76-ff416ffe39e5", "indicator--d720f0d2-ee43-4fe0-996b-8f48da7495f8", "indicator--d9f6df7b-2348-47d3-8d9f-c25f12916f04", "indicator--d92f543d-9b87-4bea-9945-e41565b19bf8", "indicator--579ac000-42e9-4dfb-89cf-d9b88d4d5b2f", "indicator--29275f5c-c882-4b4a-aa33-1be4457c5628", "indicator--a0d99051-4328-465e-bb88-e367f0b89c2a", "indicator--9cc8584d-da18-4957-971f-93ea70a0e129", "indicator--24d9f408-8032-4ba8-8972-85c970e73040", "indicator--9d0ccde0-5d14-40c3-bbde-135a517ba294", "indicator--17894b9d-c4ae-40de-8442-edb4217f352f", "indicator--95e6a2eb-705c-495e-bfff-eb16163d4308", "indicator--f95a6c8b-19f0-4b14-bc77-bdf79eb5e186", "indicator--031a0128-1500-490b-b619-54339e926e57", "indicator--11a65aa5-cec5-413c-98c1-9809fb3b0b6c", "indicator--06104bf6-5150-49fd-b32e-ff875a9fb152", "indicator--ab891f22-36f0-4936-a8b2-7bdf165a8f21", "indicator--ba11b792-54b6-4280-9a93-c352836701f0", "indicator--fd3f712f-538e-4bc4-811f-36a547390332", "indicator--6fc8e690-fa84-47a4-8923-bb0326014f23", "indicator--a6ea4ef7-2219-45ab-98d2-c6ff3abd3861", "indicator--4d8373d5-bc8d-4841-83ce-7e9f7c01916d", "indicator--5d0b01e3-fec2-4834-91ea-e4bcf6cbaaa5", "indicator--8646c69f-2791-48b0-82c8-c0c49f55ebb2", "indicator--2f8f9a78-f18a-472c-9837-19aabc7c7af4", "indicator--ce326467-689c-42af-b9a9-0bec85474902", "indicator--4b9ee9c4-9b11-4d28-b311-af631d3adbda", "indicator--87eb412e-d960-4731-8f2b-0ccdcdcf6a81", "indicator--27380baf-3c86-49f3-a4c0-40c65a605823", "indicator--f6325315-4ae1-4544-9c65-fc7d29ce16d9", "indicator--79a243af-c1ed-4d2e-8d6b-1286bede57f7", "indicator--74f71526-ecf5-4030-b025-71c2146080ff", "indicator--bd862cf8-0ffb-474a-a893-fba332972023", "indicator--4f435ef2-2c57-47ac-abe2-8e2b7aa34746", "indicator--f1c5a961-962f-4969-8a5e-44a830410efc", "indicator--1ce6187e-6f0b-4b9e-b91e-60dbe0c603df", "indicator--ff3f6bae-07a8-414c-b850-acbad9106866", "indicator--c53c8b6f-fa37-4be5-a11e-072eecb14ac9", "indicator--cd82bef8-d0b8-4d5a-b729-c43ec1250860", "indicator--8171f3b1-d7e2-4db8-b36e-d504720658df", "indicator--1f56da9f-9099-4b3e-8d60-352dae4bd0a5", "indicator--9192bf1f-fe68-46d0-98a9-31febccc3b74", "indicator--a901e8d5-d37b-4ff1-af29-ded23fab3775", "indicator--816c9506-71e1-446b-9ae6-37a63af8ff9b", "indicator--a30102cb-5697-47d3-a04f-21c7ce4f7eca", "indicator--a9c1fe35-f3fe-40cf-93e5-48c3c7ee50da", "indicator--9fdaf911-de99-48e8-8d0a-286e5aa801cc", "indicator--232011c2-8b3c-4519-832d-d1b8e4a26967", "indicator--ee608fae-baff-4b15-a9e0-99b8ad537d54", "indicator--2802c552-77ea-4e51-82d6-5bb547625133", "indicator--3b2c3885-2cf4-4a1e-87cb-8c3e26a50d8d", "indicator--05564d81-ba43-4c40-b3cc-031af0468d48", "indicator--e2d91c10-560d-4665-9972-a152df0a6ad1", "indicator--0a9545a5-bedc-4de8-a9c0-8646385fdb92", "indicator--b37fab20-e8c0-4075-97af-7ab2e190c283", "indicator--ea812d2b-d4a8-4ce9-af29-d425950ca614", "indicator--d233ee26-0fc9-4165-bb6f-f813ca45c2a0", "indicator--63f22671-1cb1-42d2-aa25-8626d4709a22", "indicator--16d0e67e-d657-474a-9f22-798e0819c3de", "indicator--682f732b-e072-43d1-b332-5ea2aba3bf6e", "indicator--45b83879-45cd-4e7c-920a-4e770e7da712", "indicator--d9de828b-7bfb-4fda-bcc6-710d6a3ff4a9", "indicator--b532919a-ae31-4b76-98fd-c11cc9698bdc", "indicator--71b1cb4c-2279-4335-bd2c-fdf1e301cf47", "indicator--4375dcbd-b599-48db-bd64-655dd433cb4a", "indicator--faeea6a1-1126-430f-882f-767852d20b55", "indicator--ffee4ea4-c92a-4623-b7c2-510a10683313", "indicator--26586863-e130-43b2-92f6-074ad64f3ef3", "indicator--33e4b9ac-29cb-4fdc-9fd6-894a174a7207", "indicator--d0104d9e-07c1-44c1-84ca-be78c05e58b0", "indicator--6870715f-5a78-43b9-ba50-f0d22eef6378", "indicator--d8a4fad3-5a48-4356-8659-61eead1c8e01", "indicator--74a5dd4a-4b2d-4fed-b76e-35d9820e2b4d", "indicator--8c9aa48e-8864-49f0-84e7-39b07b5648a6", "indicator--2118e5a1-92f9-44cf-8b78-7bc37d06b017", "indicator--96e3144b-558f-4933-9a06-0f8b385f2390", "indicator--df18fca2-70cc-4d3b-8e53-f5260d1e23b0", "indicator--7d7a5829-f3a2-4df7-a88f-9afe5fb67c85", "indicator--fb753fda-f752-47c9-a161-4f486b498f1b", "indicator--a5511419-d1b6-4ca0-ab61-722a3db509a6", "indicator--15018508-32b1-438f-9809-b353cea3b4b2", "indicator--ffc6fc31-a057-4235-bc45-c648220e3a0b", "indicator--8d547817-f8e5-40ec-95e5-692e189eec87", "indicator--db96d877-e77d-4f52-b627-0b73883bf591", "indicator--a3946319-c00b-4347-9397-775e9bdd3c55", "indicator--0b8051bf-7285-45d7-9176-81127d386e93", "indicator--16bb0c20-c440-4c2e-a4bf-bbb1367b31ed", "indicator--3cc377fd-022f-45c1-84fd-ac7400137eb9", "indicator--95ff2b8d-c148-434f-95a1-97ae9a1ce8db", "indicator--565f12ef-5bcd-4763-a06f-f0426c6d8777", "indicator--b3a5d6be-1d24-48a4-97c9-f94b075ca068", "indicator--30e50c4b-9a62-4e4f-8c2a-bb6ed865df51", "indicator--d9d21250-5d48-48c6-a0ef-57ac358f708d", "indicator--ea7ae7dd-d450-4cce-a51a-87fa172bb60c", "indicator--97005420-75de-4ff3-99ac-2f14d644b27a", "indicator--117574fe-ca15-45a7-a954-a016f4357158", "indicator--a49b7eaa-6bf0-4a5a-95aa-48c3bec1589b", "indicator--3d788526-8bbb-4e03-bb6a-362d56596fef", "indicator--23d4fa91-8577-4797-a993-9d9517272d39", "indicator--a483262c-deae-4a38-9e8e-5165e48fbad1", "indicator--5a39d8ac-f3c0-4d9b-a580-415007761062", "indicator--825fc5af-e6db-45b1-b2c5-08f6cfc0b316", "indicator--e46bd557-4c12-4687-91c9-38cf1fdbb953", "indicator--3e7890ed-9300-432a-9113-6c518d3a4d76", "indicator--a4d4bcae-3cb1-467e-ba60-1fd06e697d2e", "indicator--7df35a95-598b-4fc9-b1e0-c13fadbd792d", "indicator--15ea78b6-ebf2-4eb9-9059-2cd9920e2b41", "indicator--88b589e7-71fd-4a27-92f2-5b60ae6fbcfa", "indicator--ed022a53-0731-48b6-8c0e-4a09f29df5a6", "indicator--ad4dd993-0fda-4c2d-a96d-6b3c3bf6a683", "indicator--8c182cdf-befc-4127-b6d2-cebc2e70c4f7", "indicator--6f2e2fa2-71cb-4d0c-b6f0-d83e2d9f8552", "indicator--6824bb8b-f973-441e-8439-63d5c15e0fdd", "indicator--5db83ad2-baf2-4570-899d-8224579273d5", "indicator--f5f37191-6ffe-44b8-9dbd-76e257bf64d2", "indicator--68e1941c-4555-45d9-92bb-28733a8cff32", "indicator--dd29fc95-e978-46bf-a94e-c1a6433271ee", "indicator--a817506f-5c74-4aa3-9400-e5d83d2d9295", "indicator--788b40a9-c827-4071-b9fc-a8c9ad220eb3", "indicator--2ee35fa4-c150-4d1a-a982-7796e8cd4f93", "indicator--9d8ec169-98da-4425-9fa0-efaf575684a2", "indicator--7c83e5cd-0257-4f3f-b73b-77df3e7371c6", "indicator--e048f2fd-0c5b-4e25-9e6e-27a60a4cd8e6", "indicator--d42569d5-ebf9-43bb-915e-45be4719a568", "indicator--7c34b9e7-7f00-439c-8c2d-1d13a964aecd", "indicator--fe23df1d-5feb-4e54-92b7-f556aae0b109", "indicator--35290652-5f34-44eb-a42f-bea5b7b3a772", "indicator--a11967f7-6885-44e2-a7ec-0a15d584395f", "indicator--43e28b45-3b34-4ce6-91ac-23b6273dc022", "indicator--cc17ac4c-d187-4093-a41d-efc6af8422f0", "indicator--00a876af-c2b5-43ac-8224-e9cbe01006c3", "indicator--71eaafc4-aea8-4e56-a07b-badfdc201fd1", "indicator--ff420e97-cd51-440a-ad54-2ff39c5dd312", "indicator--044725fa-689f-4848-89b7-6152ada4fe7a", "indicator--46888719-e89e-47b1-9980-c710101a0d5b", "indicator--c35c1594-068d-4f9f-8857-dbcca9fcc1da", "indicator--76825a20-318d-42ea-9018-510a8b0de1c5", "indicator--8a302441-876c-4fe7-8d32-bf3467451262", "indicator--9d539b08-755b-4e67-b955-269da47bf8ad", "indicator--bfb2a992-b9aa-410d-91d6-29efecf6dfc7", "indicator--560fb379-83e9-48a3-9ab9-401399e380c2", "indicator--c0338d96-3100-4dba-9724-2cb0d0c0141c" ], "external_references": [ { "source_name": "AmonSul", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f86b1343-01b0-46f6-b25c-0e45709309c4", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 106.52.30.226", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '106.52.30.226']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4694ceb0-3ef2-4d80-9912-21a2c564a826", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 107.149.8.243", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '107.149.8.243']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c6b5bc15-f548-454b-9d0f-fbec903a782f", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 109.238.87.120", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '109.238.87.120']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--67978d66-889c-40b3-9c97-8fb946e91339", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 109.238.87.128", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '109.238.87.128']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8e92804d-2d9e-43d0-840c-56f0d9e7bcf4", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 109.238.87.241", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '109.238.87.241']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--262ee306-f1b7-4bdb-9e21-e7ee1546d3e5", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 129.121.84.20", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '129.121.84.20']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--15f3e945-ce9d-46b1-b508-7864fa6005a2", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 151.80.21.177", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '151.80.21.177']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4ddda0c1-0ca5-4054-a8f0-4dd1ee69ee56", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 152.232.133.14", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '152.232.133.14']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4346a254-7ee9-4977-9c40-47204827a1b8", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 156.226.182.52", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '156.226.182.52']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8966bf45-e8b5-461e-b57d-1de771c6d419", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 156.239.227.249", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '156.239.227.249']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--29852688-8986-4a69-991c-778cd506c727", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 158.94.211.124", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '158.94.211.124']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e7f2b2a3-2ff8-413e-8c22-5c3ffe790823", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 163.5.210.203", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '163.5.210.203']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ccde3bea-649d-4f6a-ae79-3cbf069b4843", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 170.106.117.80", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '170.106.117.80']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d75153c2-f20a-4751-8f5e-7a4acc39a965", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 172.239.96.53", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '172.239.96.53']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3a209076-74b4-4d33-b072-049889063025", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 172.245.25.133", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '172.245.25.133']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9362d8ae-d635-4a48-8ffd-d7a3b21413ed", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 192.109.139.89", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '192.109.139.89']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9ed800c9-9513-45a0-ad55-4e78421e65e6", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 192.109.139.94", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '192.109.139.94']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--837ddd1a-4256-4063-94c8-4fcf2d021297", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 194.102.104.10", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '194.102.104.10']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--096e822e-7c3c-400f-82dc-d721a8a1b9f5", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 194.102.104.223", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '194.102.104.223']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3d37c9e0-d1ac-4031-a4f8-c0c34f4fd854", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 194.59.31.200", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '194.59.31.200']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6a73fd28-d86f-4a46-abba-285618390c52", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 204.13.238.50", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '204.13.238.50']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--99d059b1-b6c8-4855-afbc-19757ddf368d", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 216.158.95.183", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '216.158.95.183']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--67939be7-1240-4733-b980-30e3b9eb0b63", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 217.217.97.60", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '217.217.97.60']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--99d5fba8-06f2-4159-8d76-ff416ffe39e5", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 31.76.100.248", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '31.76.100.248']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d720f0d2-ee43-4fe0-996b-8f48da7495f8", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 45.131.214.148", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '45.131.214.148']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d9f6df7b-2348-47d3-8d9f-c25f12916f04", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 45.141.21.176", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '45.141.21.176']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d92f543d-9b87-4bea-9945-e41565b19bf8", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 45.142.182.137", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '45.142.182.137']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--579ac000-42e9-4dfb-89cf-d9b88d4d5b2f", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 45.95.99.195", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '45.95.99.195']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--29275f5c-c882-4b4a-aa33-1be4457c5628", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 64.89.160.242", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '64.89.160.242']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a0d99051-4328-465e-bb88-e367f0b89c2a", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 85.121.179.7", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '85.121.179.7']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9cc8584d-da18-4957-971f-93ea70a0e129", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 85.239.149.84", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '85.239.149.84']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--24d9f408-8032-4ba8-8972-85c970e73040", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — ipv4-addr: 91.92.243.7", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '91.92.243.7']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9d0ccde0-5d14-40c3-bbde-135a517ba294", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — domain-name: eu1-cdn.net", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'eu1-cdn.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--17894b9d-c4ae-40de-8442-edb4217f352f", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — domain-name: exploit.in", "description": "Infrastructure observed in the operator ecosystem; not C2. Do not block.", "indicator_types": [ "anomalous-activity" ], "pattern": "[domain-name:value = 'exploit.in']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "context", "not-for-blocking" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--95e6a2eb-705c-495e-bfff-eb16163d4308", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — domain-name: forum.exploit.in", "description": "Infrastructure observed in the operator ecosystem; not C2. Do not block.", "indicator_types": [ "anomalous-activity" ], "pattern": "[domain-name:value = 'forum.exploit.in']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "context", "not-for-blocking" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f95a6c8b-19f0-4b14-bc77-bdf79eb5e186", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — domain-name: ip-api.com", "description": "Infrastructure observed in the operator ecosystem; not C2. Do not block.", "indicator_types": [ "anomalous-activity" ], "pattern": "[domain-name:value = 'ip-api.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "context", "not-for-blocking" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--031a0128-1500-490b-b619-54339e926e57", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — domain-name: photuesoftware.com", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'photuesoftware.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--11a65aa5-cec5-413c-98c1-9809fb3b0b6c", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — url: http://109.238.87.128:8700", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'http://109.238.87.128:8700']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--06104bf6-5150-49fd-b32e-ff875a9fb152", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — url: http://194.102.104.223:8080", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'http://194.102.104.223:8080']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ab891f22-36f0-4936-a8b2-7bdf165a8f21", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — url: http://194.102.104.223:8093", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'http://194.102.104.223:8093']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ba11b792-54b6-4280-9a93-c352836701f0", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — url: http://194.102.104.223:8700", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'http://194.102.104.223:8700']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fd3f712f-538e-4bc4-811f-36a547390332", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — url: http://194.102.104.223:8787/api/client/report", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'http://194.102.104.223:8787/api/client/report']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6fc8e690-fa84-47a4-8923-bb0326014f23", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — url: http://85.121.179.7:8000", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'http://85.121.179.7:8000']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a6ea4ef7-2219-45ab-98d2-c6ff3abd3861", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — url: https://forum.exploit.in/topic/289891/", "description": "Infrastructure observed in the operator ecosystem; not C2. Do not block.", "indicator_types": [ "anomalous-activity" ], "pattern": "[url:value = 'https://forum.exploit.in/topic/289891/']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "context", "not-for-blocking" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4d8373d5-bc8d-4841-83ce-7e9f7c01916d", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — url: https://github.com/unknown-person00lie/KawaiiGPT.git", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'https://github.com/unknown-person00lie/KawaiiGPT.git']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity", "distribution" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5d0b01e3-fec2-4834-91ea-e4bcf6cbaaa5", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — url: https://t.me/Hermes_Greece", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[url:value = 'https://t.me/Hermes_Greece']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity", "distribution" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8646c69f-2791-48b0-82c8-c0c49f55ebb2", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 18f2bf40b36295da400cb29a9133979b81ac9264", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-1' = '18f2bf40b36295da400cb29a9133979b81ac9264']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2f8f9a78-f18a-472c-9837-19aabc7c7af4", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 43a8c455842adf2237672637ca66b644cf886bc3", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-1' = '43a8c455842adf2237672637ca66b644cf886bc3']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ce326467-689c-42af-b9a9-0bec85474902", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 451414d8b80e2e2f48579dfe9b57ec583e0044a1", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-1' = '451414d8b80e2e2f48579dfe9b57ec583e0044a1']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4b9ee9c4-9b11-4d28-b311-af631d3adbda", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 6ccece96119f9428a763dbb2adef9126322788b5", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-1' = '6ccece96119f9428a763dbb2adef9126322788b5']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--87eb412e-d960-4731-8f2b-0ccdcdcf6a81", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 864851b28e0259fdbcb3d8ff40899ffd5a545300", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-1' = '864851b28e0259fdbcb3d8ff40899ffd5a545300']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--27380baf-3c86-49f3-a4c0-40c65a605823", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 99705e1f9e257452426a370ba6cfa685f9f4da0b", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-1' = '99705e1f9e257452426a370ba6cfa685f9f4da0b']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f6325315-4ae1-4544-9c65-fc7d29ce16d9", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: b827ea476edb5003c162882fca49232ae25b5b41", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-1' = 'b827ea476edb5003c162882fca49232ae25b5b41']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--79a243af-c1ed-4d2e-8d6b-1286bede57f7", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: d07c8b88a1f39576197cbd79eb868a2ddaa91c1b", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-1' = 'd07c8b88a1f39576197cbd79eb868a2ddaa91c1b']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--74f71526-ecf5-4030-b025-71c2146080ff", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: dba5dfbb548ef7a0eece9803386da74d621413ef", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-1' = 'dba5dfbb548ef7a0eece9803386da74d621413ef']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--bd862cf8-0ffb-474a-a893-fba332972023", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: e1beaf1aa69a100f8e06feec9f78943b2535e6fb", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-1' = 'e1beaf1aa69a100f8e06feec9f78943b2535e6fb']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4f435ef2-2c57-47ac-abe2-8e2b7aa34746", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 0047568268d4c79f5caaa888e6d578a367338d8f34c5b7df272283ab547f25c4", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '0047568268d4c79f5caaa888e6d578a367338d8f34c5b7df272283ab547f25c4']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f1c5a961-962f-4969-8a5e-44a830410efc", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 00aeb28f1d4a2a62f891a3d0d4da792c35b20d3bd27d0def54059bdac175b874", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '00aeb28f1d4a2a62f891a3d0d4da792c35b20d3bd27d0def54059bdac175b874']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1ce6187e-6f0b-4b9e-b91e-60dbe0c603df", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 00ef11397c1cb815ab8a7a6ee7094a3f4f3c7729886e0b11b0d4c4ff1d3158d6", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '00ef11397c1cb815ab8a7a6ee7094a3f4f3c7729886e0b11b0d4c4ff1d3158d6']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ff3f6bae-07a8-414c-b850-acbad9106866", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 0268434de3dc545cf8e54880955f90de547c7cccef00fac5810dfe111d4f6915", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '0268434de3dc545cf8e54880955f90de547c7cccef00fac5810dfe111d4f6915']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c53c8b6f-fa37-4be5-a11e-072eecb14ac9", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 0291f280b688e2852c044b700f65dfe7717fd05e6a9fa57f792c3c57293e1402", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '0291f280b688e2852c044b700f65dfe7717fd05e6a9fa57f792c3c57293e1402']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--cd82bef8-d0b8-4d5a-b729-c43ec1250860", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 030384505c9980844deb3814bd92b91e9c7c53acb89cb1ee2ce4ff0e411696da", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '030384505c9980844deb3814bd92b91e9c7c53acb89cb1ee2ce4ff0e411696da']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8171f3b1-d7e2-4db8-b36e-d504720658df", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 0ba144c5942c46d5990f98298c285107d9099eb846a31b848e4cbeb71fa71caa", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '0ba144c5942c46d5990f98298c285107d9099eb846a31b848e4cbeb71fa71caa']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1f56da9f-9099-4b3e-8d60-352dae4bd0a5", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 0c9bc08fd70ea36a11ca3aa2a590da141d2edf0f588b446ed2b4230c40c6ae62", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '0c9bc08fd70ea36a11ca3aa2a590da141d2edf0f588b446ed2b4230c40c6ae62']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9192bf1f-fe68-46d0-98a9-31febccc3b74", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 0cff0f2ffd2d0f5953f97ec72b0a82703b63512776349619bf849deec4b333d4", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '0cff0f2ffd2d0f5953f97ec72b0a82703b63512776349619bf849deec4b333d4']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a901e8d5-d37b-4ff1-af29-ded23fab3775", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 157726a4acd49f187e452ffc4afa7ae63f2151a12da3c7c551732e4392646ba1", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '157726a4acd49f187e452ffc4afa7ae63f2151a12da3c7c551732e4392646ba1']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--816c9506-71e1-446b-9ae6-37a63af8ff9b", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 16b27ea4249c85ae20953075882f5c723f281a87153c877883ef1bfc1acbd75a", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '16b27ea4249c85ae20953075882f5c723f281a87153c877883ef1bfc1acbd75a']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a30102cb-5697-47d3-a04f-21c7ce4f7eca", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 19314b66e3fc8bfd4786c0ff7865111a8a10ef4546b95e17e54d0d17c8082529", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '19314b66e3fc8bfd4786c0ff7865111a8a10ef4546b95e17e54d0d17c8082529']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a9c1fe35-f3fe-40cf-93e5-48c3c7ee50da", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 1fa45e57a78db6f93e4114f4efd8092a2c657929fdd47247f02fc1cc3d58c42c", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '1fa45e57a78db6f93e4114f4efd8092a2c657929fdd47247f02fc1cc3d58c42c']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9fdaf911-de99-48e8-8d0a-286e5aa801cc", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 2051f44571d5ab0ee219c972535508907689ec0d1f1f151b2175acf9fcd9d6f8", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '2051f44571d5ab0ee219c972535508907689ec0d1f1f151b2175acf9fcd9d6f8']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--232011c2-8b3c-4519-832d-d1b8e4a26967", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 234b347d0d22b476271c307fdc17e3462680775fdad6ed103fedf1f8d07a278a", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '234b347d0d22b476271c307fdc17e3462680775fdad6ed103fedf1f8d07a278a']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ee608fae-baff-4b15-a9e0-99b8ad537d54", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 25220c75059978095af3831b2a17987d4678a9ec64783ffa0030ba5fdb9b9d79", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '25220c75059978095af3831b2a17987d4678a9ec64783ffa0030ba5fdb9b9d79']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2802c552-77ea-4e51-82d6-5bb547625133", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 26460b765b8aaa85ad6b05d16a8a198474991322eba689a707e3ef63dddfbfaa", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '26460b765b8aaa85ad6b05d16a8a198474991322eba689a707e3ef63dddfbfaa']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3b2c3885-2cf4-4a1e-87cb-8c3e26a50d8d", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 2738e6140ae5fc1e850b887f2faadd451ff49a9df0018e716adc73388e6fd554", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '2738e6140ae5fc1e850b887f2faadd451ff49a9df0018e716adc73388e6fd554']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--05564d81-ba43-4c40-b3cc-031af0468d48", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 2a5af0f515f86cdb8cdbaf3ee26a523f1439ac6ad6038f76562287de8f8eb783", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '2a5af0f515f86cdb8cdbaf3ee26a523f1439ac6ad6038f76562287de8f8eb783']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e2d91c10-560d-4665-9972-a152df0a6ad1", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 2b42a4d79ef23c29bdc351b4f14a49e2dd7ce1387a37e475938bea02111f7f25", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '2b42a4d79ef23c29bdc351b4f14a49e2dd7ce1387a37e475938bea02111f7f25']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0a9545a5-bedc-4de8-a9c0-8646385fdb92", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 2e687b51b2152f2741a844f63245b2bfbf2bdf4cddc7b39535ca5ea035c7efb4", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '2e687b51b2152f2741a844f63245b2bfbf2bdf4cddc7b39535ca5ea035c7efb4']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b37fab20-e8c0-4075-97af-7ab2e190c283", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 32b577f5a1c356d3b0259e660743a442cad1e80a4532133f3f406c492892aaae", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '32b577f5a1c356d3b0259e660743a442cad1e80a4532133f3f406c492892aaae']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ea812d2b-d4a8-4ce9-af29-d425950ca614", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 357cee0b07268eee1fb0d42251727f73621b20a12d235e28637d2ee4fe87b30d", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '357cee0b07268eee1fb0d42251727f73621b20a12d235e28637d2ee4fe87b30d']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d233ee26-0fc9-4165-bb6f-f813ca45c2a0", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 389c3e3d24ab3afc8cf018eb1402dcd25cf3d0ed8b699468e443a81c8aaf41c8", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '389c3e3d24ab3afc8cf018eb1402dcd25cf3d0ed8b699468e443a81c8aaf41c8']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--63f22671-1cb1-42d2-aa25-8626d4709a22", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 3b59bb1908abc7f9709b198472d1e0047c6174e4f076880a420d1b8fd14a2dca", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '3b59bb1908abc7f9709b198472d1e0047c6174e4f076880a420d1b8fd14a2dca']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--16d0e67e-d657-474a-9f22-798e0819c3de", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 3d88bb15013160286efbf5e8631ba2a739c3a69a3be690ffbaa002f876a3cc57", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '3d88bb15013160286efbf5e8631ba2a739c3a69a3be690ffbaa002f876a3cc57']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--682f732b-e072-43d1-b332-5ea2aba3bf6e", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 3f242aed28cc344a688b7039e49e28cc467933081886042d0b2b22d80e85c6c3", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '3f242aed28cc344a688b7039e49e28cc467933081886042d0b2b22d80e85c6c3']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--45b83879-45cd-4e7c-920a-4e770e7da712", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 3ff00be113d424ae12275a109d7ed3c3d5f2d561cd2491800875796fc5fd7676", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '3ff00be113d424ae12275a109d7ed3c3d5f2d561cd2491800875796fc5fd7676']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d9de828b-7bfb-4fda-bcc6-710d6a3ff4a9", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 400947fa7b4e74dbf4f761ecd91de2107275304809fb3b46e21a3821a3ed5579", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '400947fa7b4e74dbf4f761ecd91de2107275304809fb3b46e21a3821a3ed5579']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b532919a-ae31-4b76-98fd-c11cc9698bdc", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 4032e05315e0c199f4f0411474e22a36ea8680e4099f88328bf6a34c542f12f9", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '4032e05315e0c199f4f0411474e22a36ea8680e4099f88328bf6a34c542f12f9']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--71b1cb4c-2279-4335-bd2c-fdf1e301cf47", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 421e4a28170e245a5c44a380688b3e8b08077837eac610fe23d0838bb1601571", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '421e4a28170e245a5c44a380688b3e8b08077837eac610fe23d0838bb1601571']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4375dcbd-b599-48db-bd64-655dd433cb4a", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 4355e0f3d54b86d76e4091bb4dfacd16dc86efe6d1469206ec20fb18bae72ddb", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '4355e0f3d54b86d76e4091bb4dfacd16dc86efe6d1469206ec20fb18bae72ddb']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--faeea6a1-1126-430f-882f-767852d20b55", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 449b5daa95e495104c5ef832d09cee37c8a8d34bce6b39f3d042dfb8d1cbe828", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '449b5daa95e495104c5ef832d09cee37c8a8d34bce6b39f3d042dfb8d1cbe828']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ffee4ea4-c92a-4623-b7c2-510a10683313", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 45c5d398356e1e588ccd66fe016e1253e8a74f9722df068c1c8b03c8218a6085", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '45c5d398356e1e588ccd66fe016e1253e8a74f9722df068c1c8b03c8218a6085']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--26586863-e130-43b2-92f6-074ad64f3ef3", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 464bc0bd3e716d5276909c4b2cf0817f8579d5fd4bcc784557b74ec6f66fa403", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '464bc0bd3e716d5276909c4b2cf0817f8579d5fd4bcc784557b74ec6f66fa403']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--33e4b9ac-29cb-4fdc-9fd6-894a174a7207", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 4799d51a96fb0294b8b9b8cd0dc08a330404904a6357fb732ce639530511abc6", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '4799d51a96fb0294b8b9b8cd0dc08a330404904a6357fb732ce639530511abc6']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d0104d9e-07c1-44c1-84ca-be78c05e58b0", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 49934c28b909ab683e8bd8046b35a54d620f5362063184fbcd913c936fdda802", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '49934c28b909ab683e8bd8046b35a54d620f5362063184fbcd913c936fdda802']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6870715f-5a78-43b9-ba50-f0d22eef6378", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 4bbe5cafcc89a733cab890569fe2cc7944baf8972669ba9feb442d31fe2ca286", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '4bbe5cafcc89a733cab890569fe2cc7944baf8972669ba9feb442d31fe2ca286']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d8a4fad3-5a48-4356-8659-61eead1c8e01", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 4d41504baf72dbdbe0bec9cd294bb7c4ec23d4e73985aca75f659a1b79b68b8d", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '4d41504baf72dbdbe0bec9cd294bb7c4ec23d4e73985aca75f659a1b79b68b8d']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--74a5dd4a-4b2d-4fed-b76e-35d9820e2b4d", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 4e1ec3a6c201cfa3c0446997f06548f493c69b7f4ec739ce08bfc98071de2a81", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '4e1ec3a6c201cfa3c0446997f06548f493c69b7f4ec739ce08bfc98071de2a81']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8c9aa48e-8864-49f0-84e7-39b07b5648a6", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 5116b5a2d57abd91e3244d696935204136c5319ac8335987c5ba066e297a08e7", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '5116b5a2d57abd91e3244d696935204136c5319ac8335987c5ba066e297a08e7']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2118e5a1-92f9-44cf-8b78-7bc37d06b017", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 518d721947bfa0dd6e6d8358887db5e23e0768eed6fccea1a5c016e1c3e8b33e", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '518d721947bfa0dd6e6d8358887db5e23e0768eed6fccea1a5c016e1c3e8b33e']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--96e3144b-558f-4933-9a06-0f8b385f2390", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 51a9d9a458eb04eff633f09acede54cbaa6c11f5eea2df0ab17e23ce1ce51562", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '51a9d9a458eb04eff633f09acede54cbaa6c11f5eea2df0ab17e23ce1ce51562']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--df18fca2-70cc-4d3b-8e53-f5260d1e23b0", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 5a50d41c7c76b36a56984cd5d129ac490cae5262ca9787d35942b9def1d98665", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '5a50d41c7c76b36a56984cd5d129ac490cae5262ca9787d35942b9def1d98665']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7d7a5829-f3a2-4df7-a88f-9afe5fb67c85", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 5ea250db3dbfd4fd902b3b3431767720aea560510a51d2686a9f513e212ac65d", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '5ea250db3dbfd4fd902b3b3431767720aea560510a51d2686a9f513e212ac65d']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fb753fda-f752-47c9-a161-4f486b498f1b", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 60c5c203da3088eae0c0e76d9d638d15bd9670149ba0bcb22012dc25a3a19e7d", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '60c5c203da3088eae0c0e76d9d638d15bd9670149ba0bcb22012dc25a3a19e7d']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a5511419-d1b6-4ca0-ab61-722a3db509a6", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 64dde361604bf9d0381281b1958d674b23b52a6d98b60376d26ea46c2c6ac6ac", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '64dde361604bf9d0381281b1958d674b23b52a6d98b60376d26ea46c2c6ac6ac']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--15018508-32b1-438f-9809-b353cea3b4b2", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 6591a544dfff02dee1e814fa1bb72a220869d24ad6bb6d1e578e029c4e112b12", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '6591a544dfff02dee1e814fa1bb72a220869d24ad6bb6d1e578e029c4e112b12']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ffc6fc31-a057-4235-bc45-c648220e3a0b", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 67f1dd3cac537ac8b6173706067b4864c7100a46eb40a883197c90fe06cb50c2", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '67f1dd3cac537ac8b6173706067b4864c7100a46eb40a883197c90fe06cb50c2']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8d547817-f8e5-40ec-95e5-692e189eec87", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 6a33f6715aba1b5a5cb4fd67f2dff04e6c7e96cdc058f94b1e82bd997c73b9a0", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '6a33f6715aba1b5a5cb4fd67f2dff04e6c7e96cdc058f94b1e82bd997c73b9a0']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--db96d877-e77d-4f52-b627-0b73883bf591", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 72d765b9be76ba841ec95548368bf9a67c9ea3823ae064d8d0beff66c4598bd9", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '72d765b9be76ba841ec95548368bf9a67c9ea3823ae064d8d0beff66c4598bd9']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a3946319-c00b-4347-9397-775e9bdd3c55", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 757d21f21f9a2166a6d979d795f5e51d3289daf3e72b1eeca8c17696a28ae24a", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '757d21f21f9a2166a6d979d795f5e51d3289daf3e72b1eeca8c17696a28ae24a']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--0b8051bf-7285-45d7-9176-81127d386e93", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 787afeb0b31164f9189235e7e2a8f45cf4b71752595c3fb447a598b1f686628d", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '787afeb0b31164f9189235e7e2a8f45cf4b71752595c3fb447a598b1f686628d']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--16bb0c20-c440-4c2e-a4bf-bbb1367b31ed", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 791b416604f31891b4edbd506d40196a6ff5d841e853353953046356870cd55d", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '791b416604f31891b4edbd506d40196a6ff5d841e853353953046356870cd55d']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3cc377fd-022f-45c1-84fd-ac7400137eb9", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 7d8de9d31c6e9688c752f5e2c78b4d1b45a034436b177795f8dac1228de23393", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '7d8de9d31c6e9688c752f5e2c78b4d1b45a034436b177795f8dac1228de23393']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--95ff2b8d-c148-434f-95a1-97ae9a1ce8db", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--565f12ef-5bcd-4763-a06f-f0426c6d8777", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 82a77d265a0b1927beb70d55ca13896187b87950f12d44bb852aeac7acaf61a9", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '82a77d265a0b1927beb70d55ca13896187b87950f12d44bb852aeac7acaf61a9']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b3a5d6be-1d24-48a4-97c9-f94b075ca068", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 871c4e5b3de09cad09752b7a80adfe18edca3f5b5dd1d44409e7dd0badb1a45e", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '871c4e5b3de09cad09752b7a80adfe18edca3f5b5dd1d44409e7dd0badb1a45e']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--30e50c4b-9a62-4e4f-8c2a-bb6ed865df51", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 8a47c67ba0239a3b0798cdd06e3df974eb4188ddfbea5bd61ef27edde30c9b3e", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '8a47c67ba0239a3b0798cdd06e3df974eb4188ddfbea5bd61ef27edde30c9b3e']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d9d21250-5d48-48c6-a0ef-57ac358f708d", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 8ab2e7ee318c7ba1e7e08530dd6a563fbca1e759301172eaffba044a18702a00", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '8ab2e7ee318c7ba1e7e08530dd6a563fbca1e759301172eaffba044a18702a00']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ea7ae7dd-d450-4cce-a51a-87fa172bb60c", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 8d418efdff3af7e718adb521f3feeba5e5cd1fdca427df91996d0e474c6628df", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '8d418efdff3af7e718adb521f3feeba5e5cd1fdca427df91996d0e474c6628df']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--97005420-75de-4ff3-99ac-2f14d644b27a", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 8d7f125ff75d2e0bb57596d3318b0179c1fcd87f5ec17ae540fd038a00cc669a", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '8d7f125ff75d2e0bb57596d3318b0179c1fcd87f5ec17ae540fd038a00cc669a']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--117574fe-ca15-45a7-a954-a016f4357158", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 90f01502312a2a06844b2d4132eda413533012c13913af7272907511423d27e2", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '90f01502312a2a06844b2d4132eda413533012c13913af7272907511423d27e2']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a49b7eaa-6bf0-4a5a-95aa-48c3bec1589b", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 969f2b7391fab265694fb3b1d0a1fdb97ab5ae58b8e40c8f4db2475073a75a31", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '969f2b7391fab265694fb3b1d0a1fdb97ab5ae58b8e40c8f4db2475073a75a31']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3d788526-8bbb-4e03-bb6a-362d56596fef", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 9780a4b6fafff9c538907840524edc0d4202279bb1c7ad0022c1a0244fe86f9b", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '9780a4b6fafff9c538907840524edc0d4202279bb1c7ad0022c1a0244fe86f9b']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--23d4fa91-8577-4797-a993-9d9517272d39", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 9967a6e703f08b025a59c11978a7b350825a3f7a3ab451b900376dbc349404c9", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '9967a6e703f08b025a59c11978a7b350825a3f7a3ab451b900376dbc349404c9']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a483262c-deae-4a38-9e8e-5165e48fbad1", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 9b09a60675f0b040d0242851e23694708bd595be608bc654b90f8d0f9bbded43", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '9b09a60675f0b040d0242851e23694708bd595be608bc654b90f8d0f9bbded43']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5a39d8ac-f3c0-4d9b-a580-415007761062", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 9b48410411329b3e03c5e77ab1a94ecef65a86b279595ab70e6ddc9aad8608c7", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '9b48410411329b3e03c5e77ab1a94ecef65a86b279595ab70e6ddc9aad8608c7']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--825fc5af-e6db-45b1-b2c5-08f6cfc0b316", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: 9d004b7d5381de29f248f40d1dfaa875e5a8ad4bb4e82543d2a59a69fd68fe05", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = '9d004b7d5381de29f248f40d1dfaa875e5a8ad4bb4e82543d2a59a69fd68fe05']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e46bd557-4c12-4687-91c9-38cf1fdbb953", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: a60d4a8fdce60369247ecc30ca4cb0f3461670da5e9c0790620bb920de84fce0", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'a60d4a8fdce60369247ecc30ca4cb0f3461670da5e9c0790620bb920de84fce0']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3e7890ed-9300-432a-9113-6c518d3a4d76", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: a68f2cfdad636ddb8d2154468b3f277f7a5ad26365e15e52d7e6d9edde9c91f8", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'a68f2cfdad636ddb8d2154468b3f277f7a5ad26365e15e52d7e6d9edde9c91f8']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a4d4bcae-3cb1-467e-ba60-1fd06e697d2e", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: a73fcf2e8b920ca5c19e3dd86aba7b3ed70caddd290649ab8020734b0babf7f2", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'a73fcf2e8b920ca5c19e3dd86aba7b3ed70caddd290649ab8020734b0babf7f2']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7df35a95-598b-4fc9-b1e0-c13fadbd792d", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: a7e7b3decfe1680207934e1e9b6da41f4df6f9c5cd6a55b712fef9d7c546678f", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'a7e7b3decfe1680207934e1e9b6da41f4df6f9c5cd6a55b712fef9d7c546678f']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--15ea78b6-ebf2-4eb9-9059-2cd9920e2b41", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: ac16e18376bd562abec60c291f2efdc5d9744b5af03f4a58b15c1c72e222c825", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'ac16e18376bd562abec60c291f2efdc5d9744b5af03f4a58b15c1c72e222c825']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--88b589e7-71fd-4a27-92f2-5b60ae6fbcfa", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: ac35beab1e25dca2153daadc86580266af72ccb99194cad742eb75dc43b37aeb", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'ac35beab1e25dca2153daadc86580266af72ccb99194cad742eb75dc43b37aeb']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ed022a53-0731-48b6-8c0e-4a09f29df5a6", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: ad3cf086bf1465236708328d767e8e971fa0be1fb26884dcf43fb81d0af2e7a8", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'ad3cf086bf1465236708328d767e8e971fa0be1fb26884dcf43fb81d0af2e7a8']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ad4dd993-0fda-4c2d-a96d-6b3c3bf6a683", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: af77e572fcca1dc786939d7f8672734900196712e10bbcfcf26a5d4df3d4710b", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'af77e572fcca1dc786939d7f8672734900196712e10bbcfcf26a5d4df3d4710b']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8c182cdf-befc-4127-b6d2-cebc2e70c4f7", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: b1f0d8a4f4572cb23aa8bf013abb103b39fa42b293d926d4277925eadab9d246", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'b1f0d8a4f4572cb23aa8bf013abb103b39fa42b293d926d4277925eadab9d246']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6f2e2fa2-71cb-4d0c-b6f0-d83e2d9f8552", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: b38e34e541ea074db20e8de2d3363632a12e3d7e77a28a387622a09cc674a97f", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'b38e34e541ea074db20e8de2d3363632a12e3d7e77a28a387622a09cc674a97f']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6824bb8b-f973-441e-8439-63d5c15e0fdd", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: b6719f10d6a6e5e78991eddf7d42c1d87980fa1620f8a872f60b693a4e2db022", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'b6719f10d6a6e5e78991eddf7d42c1d87980fa1620f8a872f60b693a4e2db022']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5db83ad2-baf2-4570-899d-8224579273d5", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: b7cb766340cf4da00d990bf1dce5274c6f0fa56bde415ab525af9e4136c225bd", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'b7cb766340cf4da00d990bf1dce5274c6f0fa56bde415ab525af9e4136c225bd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f5f37191-6ffe-44b8-9dbd-76e257bf64d2", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: bb6fa59f2b3b89f6763278b576749ccd33680635da12587fbbd280a09c6f35c3", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'bb6fa59f2b3b89f6763278b576749ccd33680635da12587fbbd280a09c6f35c3']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--68e1941c-4555-45d9-92bb-28733a8cff32", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: bc6c5ec10925ef6e155b641717bb4f16bff8921f453f1d1f16f16b0d884870c0", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'bc6c5ec10925ef6e155b641717bb4f16bff8921f453f1d1f16f16b0d884870c0']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--dd29fc95-e978-46bf-a94e-c1a6433271ee", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: bc91e207219fb9a871dfd8b57fb7408ba04f8ed3ab4caedb46a15477735853ea", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'bc91e207219fb9a871dfd8b57fb7408ba04f8ed3ab4caedb46a15477735853ea']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a817506f-5c74-4aa3-9400-e5d83d2d9295", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: bd81412677270aae64b55778fb1ea0334efa7407638fd0be09a31e47ccdd598a", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'bd81412677270aae64b55778fb1ea0334efa7407638fd0be09a31e47ccdd598a']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--788b40a9-c827-4071-b9fc-a8c9ad220eb3", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: c182378245e93ac27ba47f0170373b05b6715be9117ceb142552df38233fae7c", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'c182378245e93ac27ba47f0170373b05b6715be9117ceb142552df38233fae7c']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2ee35fa4-c150-4d1a-a982-7796e8cd4f93", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: c54f6c7ce6bc22a7646bc26f0d772a633e6290be388ff2a87692e5a91a10981c", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'c54f6c7ce6bc22a7646bc26f0d772a633e6290be388ff2a87692e5a91a10981c']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9d8ec169-98da-4425-9fa0-efaf575684a2", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: caafcfaac01afd0d77829a07da1145b6047be795000f6aae79b77afd4acb5e98", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'caafcfaac01afd0d77829a07da1145b6047be795000f6aae79b77afd4acb5e98']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7c83e5cd-0257-4f3f-b73b-77df3e7371c6", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: cbbb63bed24cc8ee4641176fb099cc24482de2bbd5a10c07c915c50b52de2f81", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'cbbb63bed24cc8ee4641176fb099cc24482de2bbd5a10c07c915c50b52de2f81']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e048f2fd-0c5b-4e25-9e6e-27a60a4cd8e6", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: ce0e17782b28627edccfa1b736f04514a7b734d00ff9d04f7ac1f8e35e9cb836", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'ce0e17782b28627edccfa1b736f04514a7b734d00ff9d04f7ac1f8e35e9cb836']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d42569d5-ebf9-43bb-915e-45be4719a568", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: d2bd7f98f338fd6d3995ae45d1093055edfd54b44e2ebb4e901112dce4906b9c", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'd2bd7f98f338fd6d3995ae45d1093055edfd54b44e2ebb4e901112dce4906b9c']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7c34b9e7-7f00-439c-8c2d-1d13a964aecd", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: d6157a0808b4d38c8305069f8191050a5203bf147834847ea8b447936f2807ea", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'd6157a0808b4d38c8305069f8191050a5203bf147834847ea8b447936f2807ea']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fe23df1d-5feb-4e54-92b7-f556aae0b109", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: d69057248bfa53b2338255e18d983926c16ceadfc98e592007c529f8b984b037", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'd69057248bfa53b2338255e18d983926c16ceadfc98e592007c529f8b984b037']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--35290652-5f34-44eb-a42f-bea5b7b3a772", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: d792ebcff3f259a92e74ca3e39200c799c861951d5c1f55c0508c98c9647068d", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'd792ebcff3f259a92e74ca3e39200c799c861951d5c1f55c0508c98c9647068d']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a11967f7-6885-44e2-a7ec-0a15d584395f", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: dcf3b408599b2f41c34210282d592d493883e6579dc7e4d9cfd95ccf85cc4858", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'dcf3b408599b2f41c34210282d592d493883e6579dc7e4d9cfd95ccf85cc4858']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--43e28b45-3b34-4ce6-91ac-23b6273dc022", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: dfd5474efba5a2d7a868fdd7d22d25947d783fb2569526ebdc3fee9c62650308", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'dfd5474efba5a2d7a868fdd7d22d25947d783fb2569526ebdc3fee9c62650308']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--cc17ac4c-d187-4093-a41d-efc6af8422f0", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: e30a161207e18275eb08266388849da6415228373ee7d0255f564a2c3932979b", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'e30a161207e18275eb08266388849da6415228373ee7d0255f564a2c3932979b']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--00a876af-c2b5-43ac-8224-e9cbe01006c3", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: e4075ff29668355e1d573d0e23e6457db933a2be12e8c3eedb993d55257ac9dc", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'e4075ff29668355e1d573d0e23e6457db933a2be12e8c3eedb993d55257ac9dc']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--71eaafc4-aea8-4e56-a07b-badfdc201fd1", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: e44cec7d36a74112b93e7dfd301601818800415d0b4bb4ab884fd9825f818703", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'e44cec7d36a74112b93e7dfd301601818800415d0b4bb4ab884fd9825f818703']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ff420e97-cd51-440a-ad54-2ff39c5dd312", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: e4ccb1d1150a92b61697d5ba1dab98e62dcd4d68928482438f30954a2b75c188", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'e4ccb1d1150a92b61697d5ba1dab98e62dcd4d68928482438f30954a2b75c188']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--044725fa-689f-4848-89b7-6152ada4fe7a", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: e6d3389d68cf52b611928ca3e53b536e422e85c4ba91642970d7c8265a0c844a", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'e6d3389d68cf52b611928ca3e53b536e422e85c4ba91642970d7c8265a0c844a']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--46888719-e89e-47b1-9980-c710101a0d5b", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: e82ba857f4095f00351cd2c987d55c7349aca27d9057cad7a5d48f5dffa9fbc5", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'e82ba857f4095f00351cd2c987d55c7349aca27d9057cad7a5d48f5dffa9fbc5']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c35c1594-068d-4f9f-8857-dbcca9fcc1da", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: ed19486d6b6711ead2a1e3b01d23a5df5026e9752a3f365eb69ed4e955bb7cd5", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'ed19486d6b6711ead2a1e3b01d23a5df5026e9752a3f365eb69ed4e955bb7cd5']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--76825a20-318d-42ea-9018-510a8b0de1c5", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: ee654c102cb7fa6fe479c1dcd9a960eb4b28ebc088416052bd7fb875bb32406e", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'ee654c102cb7fa6fe479c1dcd9a960eb4b28ebc088416052bd7fb875bb32406e']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8a302441-876c-4fe7-8d32-bf3467451262", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: ef2338a132ee66e91dc345596204ef144a591b47a7f13c6b8ae0f7245c638acd", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'ef2338a132ee66e91dc345596204ef144a591b47a7f13c6b8ae0f7245c638acd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9d539b08-755b-4e67-b955-269da47bf8ad", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: f6b3e69758b54b04848137dc3b112f0f228268014e734b881cdab2c7c7b86129", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'f6b3e69758b54b04848137dc3b112f0f228268014e734b881cdab2c7c7b86129']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--bfb2a992-b9aa-410d-91d6-29efecf6dfc7", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: f7eb72d25b89c65c8c07fa3044aa4f74f8400230f9da41ccf6b244a5b4f3b588", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'f7eb72d25b89c65c8c07fa3044aa4f74f8400230f9da41ccf6b244a5b4f3b588']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--560fb379-83e9-48a3-9ab9-401399e380c2", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: fab970510321a26840d70cd3a975e0638b0285bf531b51f10041e8c1c1c0b640", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'fab970510321a26840d70cd3a975e0638b0285bf531b51f10041e8c1c1c0b640']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c0338d96-3100-4dba-9724-2cb0d0c0141c", "created": "2026-10-28T11:56:17.000Z", "modified": "2026-10-29T12:29:59.000Z", "name": "Hermes MaaS / PyMapper indicator — file: fe83e77c4b2adc06f210dbc7879dd5703e42128435aa36471a31de6e216f6276", "description": "Indicator asserted from analyst reporting: 'Vivisection of Hermes' (Carter Perez / AngelaMos, 2026-10-24). Maliciousness is attributed to the source report, not independently re-verified by AmonSul. Extracted, normalized and published by AmonSul Threat Intelligence (https://amonsul.tech).", "indicator_types": [ "malicious-activity" ], "pattern": "[file:hashes.'SHA-256' = 'fe83e77c4b2adc06f210dbc7879dd5703e42128435aa36471a31de6e216f6276']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-10-28T11:56:17.000Z", "valid_until": "2027-01-26T11:56:17.000Z", "confidence": 60, "labels": [ "malicious-activity" ], "external_references": [ { "source_name": "AngelaMos Security Research", "description": "Vivisection of Hermes: An Active Russian-Market Malware-as-a-Service Platform and Its PyMapper Distribution Chain", "url": "https://github.com/CarterPerez-dev" }, { "source_name": "AmonSul", "description": "AmonSul Threat Intelligence advisory: Hermes MaaS / PyMapper supply-chain delivery", "url": "https://amonsul.tech/en/advisories/hermes-pymapper-2026-10/" } ], "created_by_ref": "identity--2b3a4af2-3757-5869-a4fd-4079d86d5fee", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "marking-definition--ce4b11b1-0de2-540f-866c-b9e026540935" ] } ] }