{
	"id": "0839b9b6-81d3-479e-96c1-b42d9f691ac8",
	"created_at": "2026-04-06T00:14:25.301935Z",
	"updated_at": "2026-04-10T03:34:24.395567Z",
	"deleted_at": null,
	"sha1_hash": "fcd8ae15988df71cbde25d4d2979cdfb3caf0c97",
	"title": "Top DDoS Tools For Hacktivists In 2023",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 3634133,
	"plain_text": "Top DDoS Tools For Hacktivists In 2023\r\nPublished: 2023-05-24 · Archived: 2026-04-05 14:09:42 UTC\r\nCyble Research \u0026 Intelligence Labs analyzes the growing use of DDoS attacks by Hacktivist groups across the\r\nworld.\r\nIncreased Adoption of Affordable DDoS Services\r\nExecutive Summary\r\nHacktivism, a combination of hacking and uncontrolled activism supported by political or social goals, has been\r\nspreading societal concerns and aiming its attention at both public and private institutions. In 2022, Cyble\r\nResearch and Intelligence Labs (CRIL) observed that pro-Russian hacktivist groups such as Killnet, UserSec,\r\nGhostSec, Noname057, and various pro-Ukrainian anonymous collectives were highly concentrated in launching\r\ncoordinated DDoS, breaches, and other cyber-attacks impacting state and private entities around the globe.\r\nWorld's Best AI-Native Threat Intelligence\r\nThe beginning of 2023 highlighted another stream of groups, such as Anonymous Sudan, Team Mysterious\r\nBangladesh, Team Insane Pk, Hacktivist Indonesia, Ganosec team, Anonymous India, Indian Cyber Force, Kerala\r\nCyber Xtractors that were observed aggravating DDoS attacks and defacements, for their religious beliefs and\r\npolitical agendas driven by either state or non-state actors.\r\nEvidently, DDoS attacks have become a prime tactic for hacktivist groups, among all the other attack methods, for\r\ncausing disruptions of any internet-facing digital infrastructure or services. Subsequently, various groups continue\r\nto emerge catering to the requirement for convenient and cost-friendly tools and resources for launching DDoS\r\nattacks. This report provides an overview of the most active and newly introduced DDoS tools and services used\r\nby threat actors and hacktivist groups during 2023 for their malicious campaigns against states and private entities.\r\nhttps://blog.cyble.com/2023/05/24/notable-ddos-attack-tools-and-services-supporting-hacktivist-operations-in-2023/\r\nPage 1 of 13\n\nFigure 1: Recent hacktivist campaigns\r\nRedStress.io DDoS Panel\r\nRedStress, a web-based IP stresser service, offers a convenient panel to launch anonymous DDoS attacks on a\r\ntarget server/website/IP, starting from USD 35 per month.\r\nThe service is accessible via the website and is operated by the threat actor behind the pseudonym Mercado. The\r\nthreat actors also operate a Telegram channel and Discord server to promote their DDoS service. The Telegram\r\nchannel had 10,753 subscribers at the time of conducting this analysis.\r\nThere are three pricing packages in their plans – Normal network (300K Packet Per Second Per concurrent) \u0026 VIP\r\nnetwork (600K Packet Per Second Per concurrent) \u0026 Private network (1 million Packet Per Second Per\r\nconcurrent).\r\nTheir service plans start from an affordable pricing of USD 35 per month with the capability to launch an attack\r\nfor a maximum of 1,200 seconds and go up to USD 9,800 per month with the capability to launch an attack for\r\n86,400 seconds (24Hrs.) via 150 nodes concurrently. The service claims to have 40 dedicated servers to support\r\ntheir methods.\r\nApart from paid subscriptions, the service also offers a free method dubbed ‘HTTP-Killer’ for threat actors to\r\ntarget small home networks or unsecured websites.\r\nhttps://blog.cyble.com/2023/05/24/notable-ddos-attack-tools-and-services-supporting-hacktivist-operations-in-2023/\r\nPage 2 of 13\n\nThe dashboard of the service suggests that 21,043 users have registered on the website, and the DDoS panel has\r\nlaunched 1,261,855 attacks to date.\r\nFigure 2: Redstress attack Interface\r\nThe DDoS attack methods offered by Redstress are as follows:\r\nAmplification Attacks:\r\nCLDAP\r\nNTP\r\nARD\r\nDVR\r\nSNMP\r\nDNS\r\nLayer 4 Attacks:\r\nUDP-ROCKET\r\nUDP-BYPASS\r\nUDP-GAME\r\nSYN\r\nTCP-PRO (SYN+ACK)\r\nACK\r\nTCP-GAME (For TCP protocol game servers)\r\nLayer 7 Attacks:\r\nGAME-REKT (Targets CS: GO, ARMA 3, PUBG, ARK)\r\nHTTP-KILLER (Method for free users)\r\nhttps://blog.cyble.com/2023/05/24/notable-ddos-attack-tools-and-services-supporting-hacktivist-operations-in-2023/\r\nPage 3 of 13\n\nHTTP-BYPASS (Hits with over 20,000 different IPs located worldwide)\r\nHTTP-RAW\r\nBypass Methods:\r\nOVH-UDP\r\nOVH-TCP\r\nOVH-PACKET\r\nTCP-BYPASS (Firewall Bypass)\r\nCLOUDFLARE-BYPASS (Sends requests using Chrome browser and acts like a real visitor, can bypass\r\nCloudflare UAM and other JS challenges and protections)\r\nCAPTCHA-BYPASS (Can go through Cloudflare Under Attack Mode (5 second challenge), Cloudflare\r\nHCAPTCHA and RECAPTCHA, DDoS-Guard, and most other JavaScript-based protections, it only works\r\non HTTPS websites)\r\nPrivate Methods:\r\nTCP-RED (Sends custom TCP botnet requests)\r\nTCP-REDV2\r\nTCP-REDV3\r\nTCP-THOR\r\nFIVEM-BYPASS\r\nRUST-BYPASS (UDP based)\r\nMinecraft\r\nWSD\r\nThe operators of RedStress have previously targeted game streaming services and cryptocurrency websites to\r\ndemonstrate their capabilities.\r\nDDosia Project\r\nDDosia is a project started by a pro-Russian threat group dubbed ‘NoName057(16)’ to launch DDoS attacks\r\nagainst those who obliquely or overtly support Ukraine in the war.\r\nA volunteer can download a ZIP archive containing a Windows bot binary and a unique identifier file dubbed\r\n‘client_id.txt.’ via Telegram. Users are also expected to register at a cryptocurrency wallet to receive monetary\r\nbenefits at a later stage of the project.\r\nOpen-source research suggests that following the agent’s execution on the volunteer’s computer, the bot registers\r\nwith the authors’ command-and-control (C2) infrastructure. After the C2 servers feed the bot a list of targets, the\r\nmalicious software starts launching TLS-encrypted Layer 7 and TCP-SYN Denial-of-Service attacks on the\r\nspecified targets.\r\nThe group also releases guides to help the volunteers contribute to the project by targeting adversaries using\r\nAndroid devices.\r\nhttps://blog.cyble.com/2023/05/24/notable-ddos-attack-tools-and-services-supporting-hacktivist-operations-in-2023/\r\nPage 4 of 13\n\nNoName057(16) operates two Telegram channels, one for Russian and the other for the English-speaking\r\ncommunity, to radicalize their subscribers to use their tool in support of Russia.\r\nThe Russian language channel has 43,489 subscribers, while the DDosia project group has 9,505 members at the\r\ntime of conducting our analysis.\r\nFigure 3: NoName057(16)’s advertisement thread on their Telegram channel\r\nTesla Botnet\r\nTesla is a newly-launched DDoS botnet active since April 28, 2023, and offers services starting from USD 50 per\r\nmonth.\r\nThe pro-Russian threat actor Radis operates the Telegram channel to publicize their tool and two other channels\r\nfor their buyers to post reviews on their DDoS tool. The TA’s channel had 765 subscribers at the time. On May 19,\r\n2023, Radis also launched an official website to promote their tool.\r\nOn May 23, the TA announced the commencement of development of version three of their  botnet service, which\r\ncomes with improved bypass methods and a newly-introduced mode dubbed ‘DOOMINATE’.\r\nThe service claims to specialize in launching DDoS attacks targeting onion websites with their private method\r\ndubbed the ‘TOR-KILLER’ method.\r\nhttps://blog.cyble.com/2023/05/24/notable-ddos-attack-tools-and-services-supporting-hacktivist-operations-in-2023/\r\nPage 5 of 13\n\nFigure 4: Tesla Bot Advertisements\r\nThe other DDoS attack methods offered by Tesla Bot are as follows:\r\nPrivate Methods:\r\nMACAN-TLS\r\nHTTP-FLOOD\r\nTOR-KILLER\r\nSMYKL-FLOOD\r\nThe operators of Tesla Bot recently launched a browser plugin feature to enable DDoS attacks on any target from\r\nthe browser. The TA has targeted websites of the United States Department of Defense (defense.gov), a Russia-based payment and financial services provider (qiwi.com), and the Central Intelligence Agency (cia.gov) to\r\npromote and demonstrate the capabilities of their tools.\r\nThe number of views at the bottom of the advertisement suggests that the group is gaining decent popularity in a\r\nshort span of time, as shown below.\r\nhttps://blog.cyble.com/2023/05/24/notable-ddos-attack-tools-and-services-supporting-hacktivist-operations-in-2023/\r\nPage 6 of 13\n\nFigure 5: TA’s claim of launching a DDoS attack on the  US Government\r\nThe TA Radis also administrates the Telegram channel dubbed Infinity Hackers, which was originally\r\nestablished on January 16, 2023, by members of the infinity.ink – a cybercrime forum reportedly launched by\r\nRussia-aligned hacktivist group KillMilkand Deanon Club, suggesting an association with Radis.\r\nStressbot.io DDoS Panel\r\nStressbot, under the pretense of a legitimate web-based IP stresser service, offers malicious actors and groups a\r\nconvenient way to launch DDoS attacks on a target server/website/IP, starting from USD 30 per month.\r\nFigure 6: Stressbot tool \u0026 TA’s advertisement thread on their Telegram channel\r\nThe service is accessible via the website and is operated by the threat actor behind the pseudonym Aleksey\r\nChekaldin. The TA also operates a Telegram channel to promote their DDoS service to anonymously target\r\ngovernment and private entities. The Telegram channel had 1,284 subscribers at the time.\r\nThe DDoS attack methods offered by Stressbot are as follows:\r\nLayer 4 Attacks:\r\nNTP\r\nARD\r\nDVR\r\nLDAP\r\nTCP-BYPASS\r\nUDP-BYPASS\r\nLayer 7 Attacks:\r\nHTTP-GET\r\nHTTP POST\r\nHTTPS Ky\r\nhttps://blog.cyble.com/2023/05/24/notable-ddos-attack-tools-and-services-supporting-hacktivist-operations-in-2023/\r\nPage 7 of 13\n\nxEmulator (bypass)\r\nOur research also found artifacts suggesting that the pro-Pakistani hacktivist group Team_insane_pk has been\r\nusing DDoS services offered by stressbot.io to launch attacks targeting India and Israel. The TA also promotes\r\nStressbot on their Telegram channel and has been observed recommending others to use it.\r\nTeam_insane_pk is a hacktivist group allegedly operated by a team of Threat Actors (TAs) and led by ‘Mr\r\nInsane’ aka ‘xxINSANExx’. The group usually claims to launch DDoS attacks on Government and private entities\r\nwhile sharing a link to a status-check website as Proof of Compromise (POC).\r\nZiyaettin DDoS Botnet\r\nZiyaettin is a Telegram-based DDoS bot service available from June 2022 within a price range of USD 30 to USD\r\n150 per month.\r\nFigure 7: Ziyaettin DDoS Advertisement (L) and Ziyaettin Bot in Operation (R)\r\nThe owner of the botnet, the TA ziyaettin, operates a public Telegram channel, “Ziyaettin – Power Proofs”, to\r\nshare updates and promote their tool. The Telegram channel has 1,573 subscribers at the time of our analysis.\r\nZiyaettin’s DDoS service offers the following methods:\r\nAmplification Attacks:\r\nLDAP\r\nNTP (12 GB concurrent)\r\nDVR\r\nDNS (10+ GB concurrent)\r\nLayer 4 Attacks:\r\nSYNAMP\r\nSYNACK (SYN-TCP+ACK)\r\nSYN (SYN WITH HIGH PPS)\r\nTCPMIX (TCP Mix Flood)\r\nTCPWRA (TCP Bypass)\r\nhttps://blog.cyble.com/2023/05/24/notable-ddos-attack-tools-and-services-supporting-hacktivist-operations-in-2023/\r\nPage 8 of 13\n\nLayer 7 Attacks:\r\nHTTPGET\r\nTLS-DETECT\r\nTLS-BYPASS (150K RPS)\r\nZIYBYPASS\r\nZIYSHAKE\r\nZIYBYPASS2\r\nTLS-DETECT (AUTO TLS DETECT)\r\nTLS-BYPASS (AUTO BYPASS)\r\nBypass Methods:\r\nOVH-TCP (OVH Bypass)\r\nUDPBYPASS (UDP flood)\r\nVALVE (UDP with fragmented source query packets)\r\nGAME-UDP (UDP Bypass with crafted payloads)\r\nGAME-NUKE (Steam UDP Bypass with crafted payloads v2)\r\nTCPBYPASS (HIGH PPS)\r\nFIVEM (Bypass for FiveM Servers)\r\nDISCORD (Bypass Discord Call)\r\nPrivate Methods:\r\nZIYBYPASS\r\nZIYBYPASS2\r\nZIYSHAKE (300K RPS)\r\nRecently, the TA launched a new functionality dubbed ‘ZIYBROWSER’, a browser-enabled plugin for the\r\nconvenient launch of DDoS attacks on a target with a capability of 20-30K Requests Per Second (RPS).\r\nThe DDoS services by Ziyaettin have been endorsed in various Telegram channels and groups where notable\r\nhacktivist groups such as GhostSec collaborate.\r\nNeferian Empire DDoS Botnet\r\nNeferian Empire offers a command line-based DDoS tool purportedly capable of bypassing DDoS attack\r\nprotection services offered by Akamai, Cloudflare UAM, BFM, DDoS-Guard, Google Shield, OVH, FiveM, and\r\nAmazon DDoS Protection.\r\nAccording to their posts, their tool was capable of launching 50 Million requests per second for a Layer 7 attack\r\nand 1 – 1.2 Terabytes per second (TB/s) for a Layer 4 attack method.\r\nOn May 8th, the group posted a visual statistic claiming to have hit 583 Million requests per second against the\r\nCloudflare DDoS protection.\r\nhttps://blog.cyble.com/2023/05/24/notable-ddos-attack-tools-and-services-supporting-hacktivist-operations-in-2023/\r\nPage 9 of 13\n\nFigure 8: Neferian’s Cloudflare Managed Challenge Stats\r\nThe DDoS services are operated by the TA NEFERiAN and have been marketed on their Telegram channel,\r\nestablished in May 2022, also offering malicious tools, web shells, and stealer logs. The channel had 32,860\r\nsubscribers at the time of writing this advisory.\r\nIt was observed that the Neferian Empire has a tendency similar to the Tesla Bot, to market its DDoS tool by\r\ndemonstrating live attacks on high-value organizations or targets. In a recent instance, the TA launched DDoS\r\nattacks on the websites of Interpol (interpol.int) and the United States Department of Defense (defense.gov) to\r\npromote the capabilities of their DDoS tool.\r\nFigure 9: Neferian DDoS tool \u0026 the TA’s recent advertisement on their Telegram channel\r\nArtemis C2 DDoS Botnet\r\nArtemis C2 is a newly established DDoS botnet operating since May 1, 2023, and offers services starting from\r\nUSD 15 per month. The service claims to specialize in launching DDoS attacks targeting Rainbow Six Siege and\r\nMinecraft servers.\r\nArtemis C2 is maintained and operated by the threat actors cryptopsychoand ritz. They maintain a Telegram\r\nchannelto promote their tool and a private group for discussion with other threat actors and potential buyers.\r\nhttps://blog.cyble.com/2023/05/24/notable-ddos-attack-tools-and-services-supporting-hacktivist-operations-in-2023/\r\nPage 10 of 13\n\nThe Telegram channel, at the time of writing this advisory, has 141 subscribers. They also plan to launch their own\r\nDiscord server, an Onion website, and a store on Sellix.\r\nThe DDoS attack methods offered by Artemis are as follows:\r\nAmplification Attacks:\r\nDNS\r\nLayer 4 Attacks:\r\nTCP\r\nUDP\r\nLayer 7 Attacks:\r\nHttps\r\nHttpv2\r\nTLS\r\nPrivate Methods:\r\nOVH Bypass\r\nFiveM Bypass\r\nSocket\r\nOur research revealed that pro-Pakistani hacktivist group Team_insane_pk has been promoting on their Telegram\r\nchannel to leverage Artemis C2 for their DDoS campaigns targeting India. This indicates a potential association\r\nwith the owner of the tools. However, our sources suggest that the hacktivist group does not have any links with\r\nthe developer of Artemis C2.\r\nFigure 10: Artemis tool \u0026 Team_insane_pk promoting their tool on their Telegram channel\r\nSkyElite-Net DDoS\r\nhttps://blog.cyble.com/2023/05/24/notable-ddos-attack-tools-and-services-supporting-hacktivist-operations-in-2023/\r\nPage 11 of 13\n\nSkyElite-Net is a newly launched DDoS bot started on May 8, 2023, by the TA skyzz.\r\nThe TA skyzz operates two Telegram channels; the first one has 57 subscribers and offers private DDoS methods\r\nalong with offering DDoS service to its users, and the second one is used to post reviews received from buyers.\r\nOn May 22, 2023, the TA launched a new method dubbed ‘Sky-Bypass’ while claiming that it is a Layer 7 attack\r\nthat can bypass OVH and Cloudflare DDoS protection.\r\nPrivate Methods:\r\nSkyElite-TLS\r\nSkyElye-Flood\r\nFigure 11: SkyElite-Net’s Telegram channel\r\nOpen-source research revealed that the TA skyzz746 is also a member of the private group operated by the\r\nKhalifah cyber community, a group of Malaysian and Indonesian hacktivists.\r\nRecommendations \r\nDDoS has been a mainstay of hacktivists, along with defacements, and are difficult to predict by nature. However,\r\na proactive threat intelligence capability for understanding the adversary and an efficient Denial-of-Service\r\nresponse plan can counter and minimize the impact of an attack.\r\nCERT-IN released the following recommendations to prevent and disrupt web attacks:\r\nMeasures for prevention of Denial of Service (DoS/DDoS) attacks:\r\n1. Identify critical services and their priorities. Have a Business Continuity Plan and Disaster Recovery Plan\r\nready for activation in case of emergency.\r\n2. Understand your current environment, and have a baseline of the daily volume, type, and performance of\r\nnetwork traffic.\r\n3. Employ defense-in-depth strategies: emphasize multiple, overlapping and mutually supportive defensive\r\nsystems to guard against single point failures in any specific technology and protection method.\r\nhttps://blog.cyble.com/2023/05/24/notable-ddos-attack-tools-and-services-supporting-hacktivist-operations-in-2023/\r\nPage 12 of 13\n\n4. Enable adequate logging mechanisms at perimeter level, server and system level and review the logs at\r\nfrequent intervals. Deploy appropriate Intrusion/DDoS Prevention System capable of detecting and\r\nmitigating DDoS attacks.\r\n5. Thoroughly scan the network and online applications and plug any existing vulnerability in the network\r\ndevices, Operating Systems, Server software and application software and apply latest patches/updates as\r\napplicable.\r\n6. Deploy appropriate Intrusion/DDoS Prevention System capable of detecting and mitigating DDoS attacks.\r\nEnsure that Intrusion/DDoS Prevention System contain signatures to detect the attacks launched from\r\ncommon attack tools.\r\n7. Continuously monitor the network activities; server logs to detect and mitigate suspicious and malicious\r\nactivities in your network. Review the traffic patterns [RESTRICTED – Not for Hosting in Public Domain]\r\nand logs of perimeter devices to detect anomalies in traffic, network level floods (TCP, UDP, SYN, etc.)\r\nand application floods (HTTP GET) etc.\r\n8. Maintain and regularly examine logs of webservers to detect malformed requests/traffic.\r\n9. Preserve all logs indicating type of attack and attack sources.\r\n10. Ensure that Intrusion/DDoS Prevention System contains signatures to detect the attacks launched from\r\ncommon DDoS tools.\r\n11. Maintain list of contacts of ISPs, vendors of network and security devices and contact them as appropriate.\r\n12. Sudden surge in inbound traffic to any critical server or services, such as ICMP floods, UDP/TCP flood etc.\r\ncould be due to Distributed Denial of Service (DDoS) attacks. If such attacks are observed, implement\r\nappropriate response measures in coordination with Internet Service Provider (ISP). In case of high volume\r\nof DDoS, consult your ISP to block attack sources and apply appropriate rate limiting strategies.\r\n13. Implement Egress and Ingress filtering at router level.\r\n14. Implement a bogon block list at the network boundary.\r\n15. In case your SLA with ISP includes DDoS mitigation services instruct your staff about the requirements to\r\nbe sent to ISP.\r\n16. Identify the attack sources. Block the attack sources at Router/Packet filtering device/DDoS prevention\r\nsolutions. Disable non-essential ports/services.\r\n17. To counter attacks on applications, check the integrity of critical application files periodically and in case\r\nof suspicion of attack restore applications and content from trusted backups.\r\n18. Allocate traffic to unaffected available network paths, if possible, to continue the service\r\nReferences\r\nhttps://phoenixnap.com/blog/prevent-ddos-attacks\r\nhttps://www.radware.com/security/threat-advisories-and-attack-reports/project-ddosia-russias-answer-to-disbalancer/\r\nhttps://flashpoint.io/blog/killnets-infinity-forum-cybercriminals/\r\nSource: https://blog.cyble.com/2023/05/24/notable-ddos-attack-tools-and-services-supporting-hacktivist-operations-in-2023/\r\nhttps://blog.cyble.com/2023/05/24/notable-ddos-attack-tools-and-services-supporting-hacktivist-operations-in-2023/\r\nPage 13 of 13",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MISPGALAXY",
		"Malpedia"
	],
	"references": [
		"https://blog.cyble.com/2023/05/24/notable-ddos-attack-tools-and-services-supporting-hacktivist-operations-in-2023/"
	],
	"report_names": [
		"notable-ddos-attack-tools-and-services-supporting-hacktivist-operations-in-2023"
	],
	"threat_actors": [
		{
			"id": "c91e335e-42be-48d9-96b5-ba56749a723b",
			"created_at": "2022-10-25T16:07:23.458346Z",
			"updated_at": "2026-04-10T02:00:04.616481Z",
			"deleted_at": null,
			"main_name": "CIA",
			"aliases": [
				"Central Intelligence Agency"
			],
			"source_name": "ETDA:CIA",
			"tools": [],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "e53fc09e-24cc-40d4-b38d-7e2d6dbe81d8",
			"created_at": "2023-03-17T02:01:50.851615Z",
			"updated_at": "2026-04-10T02:00:03.362605Z",
			"deleted_at": null,
			"main_name": "Anonymous Sudan",
			"aliases": [],
			"source_name": "MISPGALAXY:Anonymous Sudan",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "93b7776d-9b37-496d-94a5-30bc36fd8800",
			"created_at": "2023-11-07T02:00:07.10019Z",
			"updated_at": "2026-04-10T02:00:03.407781Z",
			"deleted_at": null,
			"main_name": "GhostSec",
			"aliases": [
				"Ghost Security"
			],
			"source_name": "MISPGALAXY:GhostSec",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "a3917c91-ec7d-485f-8784-bfb1b1a78359",
			"created_at": "2023-11-08T02:00:07.13872Z",
			"updated_at": "2026-04-10T02:00:03.424164Z",
			"deleted_at": null,
			"main_name": "UserSec",
			"aliases": [],
			"source_name": "MISPGALAXY:UserSec",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "b4a6d558-3cba-499c-b58a-f15d65b7a604",
			"created_at": "2023-01-06T13:46:39.346924Z",
			"updated_at": "2026-04-10T02:00:03.295317Z",
			"deleted_at": null,
			"main_name": "Killnet",
			"aliases": [],
			"source_name": "MISPGALAXY:Killnet",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "b05a0147-3a98-44d3-9b42-90d43f626a8b",
			"created_at": "2023-01-06T13:46:39.467088Z",
			"updated_at": "2026-04-10T02:00:03.33882Z",
			"deleted_at": null,
			"main_name": "NoName057(16)",
			"aliases": [
				"NoName057",
				"NoName05716",
				"05716nnm",
				"Nnm05716"
			],
			"source_name": "MISPGALAXY:NoName057(16)",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434465,
	"ts_updated_at": 1775792064,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/fcd8ae15988df71cbde25d4d2979cdfb3caf0c97.pdf",
		"text": "https://archive.orkl.eu/fcd8ae15988df71cbde25d4d2979cdfb3caf0c97.txt",
		"img": "https://archive.orkl.eu/fcd8ae15988df71cbde25d4d2979cdfb3caf0c97.jpg"
	}
}