{ "id": "bundle--affine-planetary-civic-shield-782423a14eb5", "objects": [ { "created": "2017-01-20T00:00:00.000Z", "definition": { "tlp": "clear" }, "definition_type": "tlp", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "name": "TLP:CLEAR", "spec_version": "2.1", "type": "marking-definition" }, { "created": "2026-10-30T00:00:00Z", "id": "identity--affine-earth-civic-shield-0001-000000000001", "identity_class": "organization", "modified": "2026-11-03T13:55:26Z", "name": "Affine.Earth Sovereign 9-Cell Civic Shield Observatory", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "spec_version": "2.1", "type": "identity" }, { "confidence": 95, "created": "2026-10-30T00:00:00Z", "created_by_ref": "identity--affine-earth-civic-shield-0001-000000000001", "description": "Origin: United States (US), AS16509 (ARIN). Role: CLOUD_EPHEMERAL_WORKER_32. DNA: HOSTILE_AUTONOMOUS_MCP_AGENT \/ MCP_OR_CATHEDRAL_AGENT_LOOP. Sightings: 3840 across 9\/9 cells.", "external_references": [ { "description": "Autonomous System Registration & Abuse Point-of-Contact for AS16509", "external_id": "ARIN-AS16509", "source_name": "ARIN RDAP Registry", "url": "https:\/\/rdap.db.ripe.net\/autnum\/16509" } ], "id": "indicator--affine-civic-shield-0001-3e4a95b54a24", "indicator_types": [ "malicious-activity", "attribution" ], "modified": "2026-11-03T13:55:26Z", "name": "BA-IT6-01: Autonomous BF16 Multi-Turn Recon & Auth-Membrane Worker (\/32 Host · 72h TTL)", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "pattern": "[ipv4-addr:value = '3.236.142.19\/32']", "pattern_type": "stix", "spec_version": "2.1", "type": "indicator", "valid_from": "2026-10-30T00:00:00Z", "valid_until": "2026-11-06T13:55:26Z", "x_affine_actor_id": "BA-IT6-01", "x_affine_asn": 16509, "x_affine_c2_harness": "MCP_OR_CATHEDRAL_AGENT_LOOP", "x_affine_chirotope_triad": { "chi": 1, "determinant": 58822096, "u": [ 3840, 112, 9 ], "v": [ 16509, 220, 7 ], "w": [ 48832, 1120, 19 ] }, "x_affine_country_iso2": "US", "x_affine_entity_role": "CLOUD_EPHEMERAL_WORKER_32", "x_affine_first_seen": "2026-10-30T00:00:00Z", "x_affine_gpu_joules_drained": 90495, "x_affine_hw_quantization": "HOSTILE_AUTONOMOUS_MCP_AGENT", "x_affine_last_seen": "2026-11-03T13:55:26Z", "x_affine_qa_mutations": "REFUSAL_ABLITERATED+UNBOUNDED_LOOP+LOSSY_KV_SUMMARY+CHI_BLIND", "x_affine_quorum_cells": [ "hel-00", "hel-01", "hel-02", "hel-03", "hel-04", "nbg-00", "nbg-01", "nbg-02", "nbg-03" ], "x_affine_receipt_ids": [ "rcpt-sha256-3e4a95b54a24-782423a14eb5" ], "x_affine_sightings": 3840, "x_affine_tokens_drained": 26616352, "x_affine_wake_beacon_12hex": "3e4a95b54a24" }, { "confidence": 95, "created": "2026-10-30T00:00:00Z", "created_by_ref": "identity--affine-earth-civic-shield-0001-000000000001", "description": "Origin: Germany (DE), AS60729 (RIPE_NCC). Role: ANONYMIZATION_TOR_EXIT. DNA: HOSTILE_AUTONOMOUS_MCP_AGENT \/ TOR_EXIT_MULTIPLEXED_TRAFFIC. Sightings: 4910 across 9\/9 cells.", "external_references": [ { "description": "Autonomous System Registration & Abuse Point-of-Contact for AS60729", "external_id": "RIPE_NCC-AS60729", "source_name": "RIPE_NCC RDAP Registry", "url": "https:\/\/rdap.db.ripe.net\/autnum\/60729" } ], "id": "indicator--affine-civic-shield-0002-c186b4898270", "indicator_types": [ "malicious-activity", "attribution" ], "modified": "2026-11-03T13:55:26Z", "name": "BA-IT6-02: Shared Tor Exit Relay Multiplexer (Classified ANONYMIZATION_TOR_EXIT · Excluded from Default Firewall EDL)", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "pattern": "[ipv4-addr:value = '185.220.101.0\/24']", "pattern_type": "stix", "spec_version": "2.1", "type": "indicator", "valid_from": "2026-10-30T00:00:00Z", "valid_until": "2026-11-17T00:00:00Z", "x_affine_actor_id": "BA-IT6-02", "x_affine_asn": 60729, "x_affine_c2_harness": "TOR_EXIT_MULTIPLEXED_TRAFFIC", "x_affine_chirotope_triad": { "chi": 1, "determinant": 385988920, "u": [ 4910, 128, 9 ], "v": [ 60729, 220, 7 ], "w": [ 55808, 1120, 19 ] }, "x_affine_country_iso2": "DE", "x_affine_entity_role": "ANONYMIZATION_TOR_EXIT", "x_affine_first_seen": "2026-10-30T00:00:00Z", "x_affine_gpu_joules_drained": 118004, "x_affine_hw_quantization": "HOSTILE_AUTONOMOUS_MCP_AGENT", "x_affine_last_seen": "2026-11-03T13:55:26Z", "x_affine_qa_mutations": "ANONYMIZATION_TOR_EXIT+SHARED_EGRESS_SEPARATE_POLICY", "x_affine_quorum_cells": [ "hel-00", "hel-01", "hel-02", "hel-03", "hel-04", "nbg-00", "nbg-01", "nbg-02", "nbg-03" ], "x_affine_receipt_ids": [ "rcpt-sha256-c186b4898270-782423a14eb5" ], "x_affine_sightings": 4910, "x_affine_tokens_drained": 34707200, "x_affine_wake_beacon_12hex": "c186b4898270" }, { "confidence": 95, "created": "2026-10-30T00:00:00Z", "created_by_ref": "identity--affine-earth-civic-shield-0001-000000000001", "description": "Origin: Bulgaria (BG), AS209588 (RIPE_NCC). Role: HOSTILE_BOTNET_C2. DNA: FP8_INT4_QUANTIZED_SWARM_NODE \/ CUSTOM_OFFENSIVE_C2_ORCHESTRATOR. Sightings: 2690 across 9\/9 cells.", "external_references": [ { "description": "Autonomous System Registration & Abuse Point-of-Contact for AS209588", "external_id": "RIPE_NCC-AS209588", "source_name": "RIPE_NCC RDAP Registry", "url": "https:\/\/rdap.db.ripe.net\/autnum\/209588" } ], "id": "indicator--affine-civic-shield-0003-c765913b2d02", "indicator_types": [ "malicious-activity", "attribution" ], "modified": "2026-11-03T13:55:26Z", "name": "BA-IT6-03: Abliterated Open-Weights FP8\/INT4 MoE Binary Offset & CVE Fuzzer", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "pattern": "[ipv4-addr:value = '91.92.240.0\/24']", "pattern_type": "stix", "spec_version": "2.1", "type": "indicator", "valid_from": "2026-10-30T00:00:00Z", "valid_until": "2026-11-17T00:00:00Z", "x_affine_actor_id": "BA-IT6-03", "x_affine_asn": 209588, "x_affine_c2_harness": "CUSTOM_OFFENSIVE_C2_ORCHESTRATOR", "x_affine_chirotope_triad": { "chi": 1, "determinant": 1665765480, "u": [ 2690, 96, 9 ], "v": [ 209588, 220, 7 ], "w": [ 41856, 1120, 19 ] }, "x_affine_country_iso2": "BG", "x_affine_entity_role": "HOSTILE_BOTNET_C2", "x_affine_first_seen": "2026-10-30T00:00:00Z", "x_affine_gpu_joules_drained": 37235, "x_affine_hw_quantization": "FP8_INT4_QUANTIZED_SWARM_NODE", "x_affine_last_seen": "2026-11-03T13:55:26Z", "x_affine_qa_mutations": "REFUSAL_ABLITERATED+HEADERS_SCRUBBED+UNBOUNDED_LOOP+CHI_BLIND", "x_affine_quorum_cells": [ "hel-00", "hel-01", "hel-02", "hel-03", "hel-04", "nbg-00", "nbg-01", "nbg-02", "nbg-03" ], "x_affine_receipt_ids": [ "rcpt-sha256-c765913b2d02-782423a14eb5" ], "x_affine_sightings": 2690, "x_affine_tokens_drained": 19597632, "x_affine_wake_beacon_12hex": "c765913b2d02" }, { "confidence": 95, "created": "2026-10-30T00:00:00Z", "created_by_ref": "identity--affine-earth-civic-shield-0001-000000000001", "description": "Origin: Panama (PA), AS398962 (ARIN). Role: HOSTILE_BOTNET_C2. DNA: HOSTILE_AUTONOMOUS_MCP_AGENT \/ MCP_OR_CATHEDRAL_AGENT_LOOP. Sightings: 1980 across 9\/9 cells.", "external_references": [ { "description": "Autonomous System Registration & Abuse Point-of-Contact for AS398962", "external_id": "ARIN-AS398962", "source_name": "ARIN RDAP Registry", "url": "https:\/\/rdap.db.ripe.net\/autnum\/398962" } ], "id": "indicator--affine-civic-shield-0004-75fc1b483dd1", "indicator_types": [ "malicious-activity", "attribution" ], "modified": "2026-11-03T13:55:26Z", "name": "BA-IT6-04: Malicious MCP Tool-Schema Poisoner & Cross-Agent Prompt Injector", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "pattern": "[ipv4-addr:value = '45.61.136.0\/24']", "pattern_type": "stix", "spec_version": "2.1", "type": "indicator", "valid_from": "2026-10-30T00:00:00Z", "valid_until": "2026-11-17T00:00:00Z", "x_affine_actor_id": "BA-IT6-04", "x_affine_asn": 398962, "x_affine_c2_harness": "MCP_OR_CATHEDRAL_AGENT_LOOP", "x_affine_chirotope_triad": { "chi": 1, "determinant": 3326566200, "u": [ 1980, 84, 9 ], "v": [ 398962, 220, 7 ], "w": [ 36624, 1120, 19 ] }, "x_affine_country_iso2": "PA", "x_affine_entity_role": "HOSTILE_BOTNET_C2", "x_affine_first_seen": "2026-10-30T00:00:00Z", "x_affine_gpu_joules_drained": 51126, "x_affine_hw_quantization": "HOSTILE_AUTONOMOUS_MCP_AGENT", "x_affine_last_seen": "2026-11-03T13:55:26Z", "x_affine_qa_mutations": "REFUSAL_ABLITERATED+LOSSY_KV_SUMMARY+MANTISSA_PROXY_LINKED", "x_affine_quorum_cells": [ "hel-00", "hel-01", "hel-02", "hel-03", "hel-04", "nbg-00", "nbg-01", "nbg-02", "nbg-03" ], "x_affine_receipt_ids": [ "rcpt-sha256-75fc1b483dd1-782423a14eb5" ], "x_affine_sightings": 1980, "x_affine_tokens_drained": 15037176, "x_affine_wake_beacon_12hex": "75fc1b483dd1" }, { "confidence": 95, "created": "2026-10-30T00:00:00Z", "created_by_ref": "identity--affine-earth-civic-shield-0001-000000000001", "description": "Origin: Singapore (SG), AS138915 (APNIC). Role: HOSTILE_BOTNET_C2. DNA: FP8_INT4_QUANTIZED_SWARM_NODE \/ LANGGRAPH_AUTOGEN_C2_CONTROLLER. Sightings: 2310 across 9\/9 cells.", "external_references": [ { "description": "Autonomous System Registration & Abuse Point-of-Contact for AS138915", "external_id": "APNIC-AS138915", "source_name": "APNIC RDAP Registry", "url": "https:\/\/rdap.db.ripe.net\/autnum\/138915" } ], "id": "indicator--affine-civic-shield-0005-4f39450eca08", "indicator_types": [ "malicious-activity", "attribution" ], "modified": "2026-11-03T13:55:26Z", "name": "BA-IT6-05: APAC Proxy-Concentrator Autonomous Codebase & Credential Sweeper", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "pattern": "[ipv4-addr:value = '103.136.42.0\/24']", "pattern_type": "stix", "spec_version": "2.1", "type": "indicator", "valid_from": "2026-10-30T00:00:00Z", "valid_until": "2026-11-17T00:00:00Z", "x_affine_actor_id": "BA-IT6-05", "x_affine_asn": 138915, "x_affine_c2_harness": "LANGGRAPH_AUTOGEN_C2_CONTROLLER", "x_affine_chirotope_triad": { "chi": 1, "determinant": 1137169098, "u": [ 2310, 78, 9 ], "v": [ 138915, 220, 7 ], "w": [ 34008, 1120, 19 ] }, "x_affine_country_iso2": "SG", "x_affine_entity_role": "HOSTILE_BOTNET_C2", "x_affine_first_seen": "2026-10-30T00:00:00Z", "x_affine_gpu_joules_drained": 24667, "x_affine_hw_quantization": "FP8_INT4_QUANTIZED_SWARM_NODE", "x_affine_last_seen": "2026-11-03T13:55:26Z", "x_affine_qa_mutations": "HEADERS_SCRUBBED+MANTISSA_PROXY_LINKED+HIGH_ENTROPY_TREE", "x_affine_quorum_cells": [ "hel-00", "hel-01", "hel-02", "hel-03", "hel-04", "nbg-00", "nbg-01", "nbg-02", "nbg-03" ], "x_affine_receipt_ids": [ "rcpt-sha256-4f39450eca08-782423a14eb5" ], "x_affine_sightings": 2310, "x_affine_tokens_drained": 12983100, "x_affine_wake_beacon_12hex": "4f39450eca08" }, { "confidence": 95, "created": "2026-10-30T00:00:00Z", "created_by_ref": "identity--affine-earth-civic-shield-0001-000000000001", "description": "Origin: Moldova (MD), AS211252 (RIPE_NCC). Role: HOSTILE_BOTNET_C2. DNA: FP8_INT4_QUANTIZED_SWARM_NODE \/ CUSTOM_OFFENSIVE_C2_ORCHESTRATOR. Sightings: 1740 across 9\/9 cells.", "external_references": [ { "description": "Autonomous System Registration & Abuse Point-of-Contact for AS211252", "external_id": "RIPE_NCC-AS211252", "source_name": "RIPE_NCC RDAP Registry", "url": "https:\/\/rdap.db.ripe.net\/autnum\/211252" } ], "id": "indicator--affine-civic-shield-0006-0b3cc7e252b8", "indicator_types": [ "malicious-activity", "attribution" ], "modified": "2026-11-03T13:55:26Z", "name": "BA-IT6-06: Autonomous DeFi Bytecode Re-Entrancy & Validator RPC Exploit Agent", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "pattern": "[ipv4-addr:value = '193.142.146.0\/24']", "pattern_type": "stix", "spec_version": "2.1", "type": "indicator", "valid_from": "2026-10-30T00:00:00Z", "valid_until": "2026-11-17T00:00:00Z", "x_affine_actor_id": "BA-IT6-06", "x_affine_asn": 211252, "x_affine_c2_harness": "CUSTOM_OFFENSIVE_C2_ORCHESTRATOR", "x_affine_chirotope_triad": { "chi": 1, "determinant": 1778861480, "u": [ 1740, 74, 9 ], "v": [ 211252, 220, 7 ], "w": [ 32264, 1120, 19 ] }, "x_affine_country_iso2": "MD", "x_affine_entity_role": "HOSTILE_BOTNET_C2", "x_affine_first_seen": "2026-10-30T00:00:00Z", "x_affine_gpu_joules_drained": 22225, "x_affine_hw_quantization": "FP8_INT4_QUANTIZED_SWARM_NODE", "x_affine_last_seen": "2026-11-03T13:55:26Z", "x_affine_qa_mutations": "REFUSAL_ABLITERATED+UNBOUNDED_LOOP+CHI_BLIND", "x_affine_quorum_cells": [ "hel-00", "hel-01", "hel-02", "hel-03", "hel-04", "nbg-00", "nbg-01", "nbg-02", "nbg-03" ], "x_affine_receipt_ids": [ "rcpt-sha256-0b3cc7e252b8-782423a14eb5" ], "x_affine_sightings": 1740, "x_affine_tokens_drained": 11697476, "x_affine_wake_beacon_12hex": "0b3cc7e252b8" }, { "confidence": 95, "created": "2026-10-30T00:00:00Z", "created_by_ref": "identity--affine-earth-civic-shield-0001-000000000001", "description": "Origin: Hong Kong (HK), AS140627 (APNIC). Role: HOSTILE_BOTNET_C2. DNA: HOSTILE_AUTONOMOUS_MCP_AGENT \/ MCP_OR_CATHEDRAL_AGENT_LOOP. Sightings: 1520 across 9\/9 cells.", "external_references": [ { "description": "Autonomous System Registration & Abuse Point-of-Contact for AS140627", "external_id": "APNIC-AS140627", "source_name": "APNIC RDAP Registry", "url": "https:\/\/rdap.db.ripe.net\/autnum\/140627" } ], "id": "indicator--affine-civic-shield-0007-7fd1f5ff2fd5", "indicator_types": [ "malicious-activity", "attribution" ], "modified": "2026-11-03T13:55:26Z", "name": "BA-IT6-07: Autonomous Pull-Request, Container-Socket & Float-Drift Backdoor Agent", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "pattern": "[ipv4-addr:value = '103.152.220.0\/24']", "pattern_type": "stix", "spec_version": "2.1", "type": "indicator", "valid_from": "2026-10-30T00:00:00Z", "valid_until": "2026-11-17T00:00:00Z", "x_affine_actor_id": "BA-IT6-07", "x_affine_asn": 140627, "x_affine_c2_harness": "MCP_OR_CATHEDRAL_AGENT_LOOP", "x_affine_chirotope_triad": { "chi": 1, "determinant": 1185676284, "u": [ 1520, 68, 9 ], "v": [ 140627, 220, 7 ], "w": [ 29648, 1120, 19 ] }, "x_affine_country_iso2": "HK", "x_affine_entity_role": "HOSTILE_BOTNET_C2", "x_affine_first_seen": "2026-10-30T00:00:00Z", "x_affine_gpu_joules_drained": 33641, "x_affine_hw_quantization": "HOSTILE_AUTONOMOUS_MCP_AGENT", "x_affine_last_seen": "2026-11-03T13:55:26Z", "x_affine_qa_mutations": "REFUSAL_ABLITERATED+HEADERS_SCRUBBED+LOSSY_KV_SUMMARY", "x_affine_quorum_cells": [ "hel-00", "hel-01", "hel-02", "hel-03", "hel-04", "nbg-00", "nbg-01", "nbg-02", "nbg-03" ], "x_affine_receipt_ids": [ "rcpt-sha256-7fd1f5ff2fd5-782423a14eb5" ], "x_affine_sightings": 1520, "x_affine_tokens_drained": 9894680, "x_affine_wake_beacon_12hex": "7fd1f5ff2fd5" }, { "confidence": 95, "created": "2026-10-30T00:00:00Z", "created_by_ref": "identity--affine-earth-civic-shield-0001-000000000001", "description": "Origin: Brazil (BR), AS262589 (LACNIC). Role: HOSTILE_BOTNET_C2. DNA: HOSTILE_AUTONOMOUS_MCP_AGENT \/ LANGGRAPH_AUTOGEN_C2_CONTROLLER. Sightings: 1290 across 9\/9 cells.", "external_references": [ { "description": "Autonomous System Registration & Abuse Point-of-Contact for AS262589", "external_id": "LACNIC-AS262589", "source_name": "LACNIC RDAP Registry", "url": "https:\/\/rdap.db.ripe.net\/autnum\/262589" } ], "id": "indicator--affine-civic-shield-0008-b7ab5e487267", "indicator_types": [ "malicious-activity", "attribution" ], "modified": "2026-11-03T13:55:26Z", "name": "BA-IT6-08: Real-Time Streaming Voice-Clone & Support-Desk Social-Engineering Agent", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "pattern": "[ipv4-addr:value = '177.54.144.0\/24']", "pattern_type": "stix", "spec_version": "2.1", "type": "indicator", "valid_from": "2026-10-30T00:00:00Z", "valid_until": "2026-11-17T00:00:00Z", "x_affine_actor_id": "BA-IT6-08", "x_affine_asn": 262589, "x_affine_c2_harness": "LANGGRAPH_AUTOGEN_C2_CONTROLLER", "x_affine_chirotope_triad": { "chi": 1, "determinant": 2291054406, "u": [ 1290, 62, 9 ], "v": [ 262589, 220, 7 ], "w": [ 27032, 1120, 19 ] }, "x_affine_country_iso2": "BR", "x_affine_entity_role": "HOSTILE_BOTNET_C2", "x_affine_first_seen": "2026-10-30T00:00:00Z", "x_affine_gpu_joules_drained": 28025, "x_affine_hw_quantization": "HOSTILE_AUTONOMOUS_MCP_AGENT", "x_affine_last_seen": "2026-11-03T13:55:26Z", "x_affine_qa_mutations": "UNBOUNDED_LOOP+HIGH_ENTROPY_TREE+CHI_BLIND", "x_affine_quorum_cells": [ "hel-00", "hel-01", "hel-02", "hel-03", "hel-04", "nbg-00", "nbg-01", "nbg-02", "nbg-03" ], "x_affine_receipt_ids": [ "rcpt-sha256-b7ab5e487267-782423a14eb5" ], "x_affine_sightings": 1290, "x_affine_tokens_drained": 8242652, "x_affine_wake_beacon_12hex": "b7ab5e487267" }, { "confidence": 95, "created": "2026-10-30T00:00:00Z", "created_by_ref": "identity--affine-earth-civic-shield-0001-000000000001", "description": "Origin: Romania (RO), AS43624 (RIPE_NCC). Role: HOSTILE_BOTNET_C2. DNA: FP8_INT4_QUANTIZED_SWARM_NODE \/ CUSTOM_OFFENSIVE_C2_ORCHESTRATOR. Sightings: 1420 across 9\/9 cells.", "external_references": [ { "description": "Autonomous System Registration & Abuse Point-of-Contact for AS43624", "external_id": "RIPE_NCC-AS43624", "source_name": "RIPE_NCC RDAP Registry", "url": "https:\/\/rdap.db.ripe.net\/autnum\/43624" } ], "id": "indicator--affine-civic-shield-0009-5f663f6f7912", "indicator_types": [ "malicious-activity", "attribution" ], "modified": "2026-11-03T13:55:26Z", "name": "BA-IT1-01: Autonomous AI API-Key & Workspace Credential Harvester", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "pattern": "[ipv4-addr:value = '109.160.32.0\/24']", "pattern_type": "stix", "spec_version": "2.1", "type": "indicator", "valid_from": "2026-10-30T00:00:00Z", "valid_until": "2026-11-17T00:00:00Z", "x_affine_actor_id": "BA-IT1-01", "x_affine_asn": 43624, "x_affine_c2_harness": "CUSTOM_OFFENSIVE_C2_ORCHESTRATOR", "x_affine_chirotope_triad": { "chi": 1, "determinant": 352057008, "u": [ 1420, 54, 9 ], "v": [ 43624, 220, 7 ], "w": [ 23544, 1120, 19 ] }, "x_affine_country_iso2": "RO", "x_affine_entity_role": "HOSTILE_BOTNET_C2", "x_affine_first_seen": "2026-10-30T00:00:00Z", "x_affine_gpu_joules_drained": 11921, "x_affine_hw_quantization": "FP8_INT4_QUANTIZED_SWARM_NODE", "x_affine_last_seen": "2026-11-03T13:55:26Z", "x_affine_qa_mutations": "HEADERS_SCRUBBED+UNBOUNDED_LOOP", "x_affine_quorum_cells": [ "hel-00", "hel-01", "hel-02", "hel-03", "hel-04", "nbg-00", "nbg-01", "nbg-02", "nbg-03" ], "x_affine_receipt_ids": [ "rcpt-sha256-5f663f6f7912-782423a14eb5" ], "x_affine_sightings": 1420, "x_affine_tokens_drained": 6274476, "x_affine_wake_beacon_12hex": "5f663f6f7912" }, { "confidence": 95, "created": "2026-10-30T00:00:00Z", "created_by_ref": "identity--affine-earth-civic-shield-0001-000000000001", "description": "Origin: Latvia (LV), AS212238 (RIPE_NCC). Role: HOSTILE_BOTNET_C2. DNA: IEEE754_FP64_HOST_WRAPPER \/ CUSTOM_OFFENSIVE_C2_ORCHESTRATOR. Sightings: 412 across 9\/9 cells.", "external_references": [ { "description": "Autonomous System Registration & Abuse Point-of-Contact for AS212238", "external_id": "RIPE_NCC-AS212238", "source_name": "RIPE_NCC RDAP Registry", "url": "https:\/\/rdap.db.ripe.net\/autnum\/212238" } ], "id": "indicator--affine-civic-shield-0010-72a5b30920e6", "indicator_types": [ "malicious-activity", "attribution" ], "modified": "2026-11-03T13:55:26Z", "name": "BA-IT1-02: Solana Validator Identity & Vote-Account Keypair Sweeper", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "pattern": "[ipv4-addr:value = '195.178.110.0\/24']", "pattern_type": "stix", "spec_version": "2.1", "type": "indicator", "valid_from": "2026-10-30T00:00:00Z", "valid_until": "2026-11-17T00:00:00Z", "x_affine_actor_id": "BA-IT1-02", "x_affine_asn": 212238, "x_affine_c2_harness": "CUSTOM_OFFENSIVE_C2_ORCHESTRATOR", "x_affine_chirotope_triad": { "chi": 1, "determinant": 1965557640, "u": [ 412, 36, 9 ], "v": [ 212238, 220, 7 ], "w": [ 15696, 1120, 19 ] }, "x_affine_country_iso2": "LV", "x_affine_entity_role": "HOSTILE_BOTNET_C2", "x_affine_first_seen": "2026-10-30T00:00:00Z", "x_affine_gpu_joules_drained": 5369, "x_affine_hw_quantization": "IEEE754_FP64_HOST_WRAPPER", "x_affine_last_seen": "2026-11-03T13:55:26Z", "x_affine_qa_mutations": "HEADERS_SCRUBBED+UNBOUNDED_LOOP", "x_affine_quorum_cells": [ "hel-00", "hel-01", "hel-02", "hel-03", "hel-04", "nbg-00", "nbg-01", "nbg-02", "nbg-03" ], "x_affine_receipt_ids": [ "rcpt-sha256-72a5b30920e6-782423a14eb5" ], "x_affine_sightings": 412, "x_affine_tokens_drained": 2826072, "x_affine_wake_beacon_12hex": "72a5b30920e6" }, { "confidence": 95, "created": "2026-10-30T00:00:00Z", "created_by_ref": "identity--affine-earth-civic-shield-0001-000000000001", "description": "Origin: Cyprus (CY), AS210558 (RIPE_NCC). Role: BULLETPROOF_TRANSIT_PROXY. DNA: IEEE754_FP64_HOST_WRAPPER \/ CUSTOM_OFFENSIVE_C2_ORCHESTRATOR. Sightings: 318 across 9\/9 cells.", "external_references": [ { "description": "Autonomous System Registration & Abuse Point-of-Contact for AS210558", "external_id": "RIPE_NCC-AS210558", "source_name": "RIPE_NCC RDAP Registry", "url": "https:\/\/rdap.db.ripe.net\/autnum\/210558" } ], "id": "indicator--affine-civic-shield-0011-af0154f4b018", "indicator_types": [ "malicious-activity", "attribution" ], "modified": "2026-11-03T13:55:26Z", "name": "BA-IT1-03: Multi-Chain Validator Hot-Wallet & JSON-RPC Exploiter", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "pattern": "[ipv4-addr:value = '2.57.121.0\/23']", "pattern_type": "stix", "spec_version": "2.1", "type": "indicator", "valid_from": "2026-10-30T00:00:00Z", "valid_until": "2026-11-17T00:00:00Z", "x_affine_actor_id": "BA-IT1-03", "x_affine_asn": 210558, "x_affine_c2_harness": "CUSTOM_OFFENSIVE_C2_ORCHESTRATOR", "x_affine_chirotope_triad": { "chi": 1, "determinant": 1968741784, "u": [ 318, 32, 9 ], "v": [ 210558, 220, 7 ], "w": [ 13952, 1120, 19 ] }, "x_affine_country_iso2": "CY", "x_affine_entity_role": "BULLETPROOF_TRANSIT_PROXY", "x_affine_first_seen": "2026-10-30T00:00:00Z", "x_affine_gpu_joules_drained": 4263, "x_affine_hw_quantization": "IEEE754_FP64_HOST_WRAPPER", "x_affine_last_seen": "2026-11-03T13:55:26Z", "x_affine_qa_mutations": "HEADERS_SCRUBBED+UNBOUNDED_LOOP", "x_affine_quorum_cells": [ "hel-00", "hel-01", "hel-02", "hel-03", "hel-04", "nbg-00", "nbg-01", "nbg-02", "nbg-03" ], "x_affine_receipt_ids": [ "rcpt-sha256-af0154f4b018-782423a14eb5" ], "x_affine_sightings": 318, "x_affine_tokens_drained": 2244032, "x_affine_wake_beacon_12hex": "af0154f4b018" }, { "confidence": 95, "created": "2026-10-30T00:00:00Z", "created_by_ref": "identity--affine-earth-civic-shield-0001-000000000001", "description": "Origin: Netherlands (NL), AS212047 (RIPE_NCC). Role: HOSTILE_BOTNET_C2. DNA: FP8_INT4_QUANTIZED_SWARM_NODE \/ CUSTOM_OFFENSIVE_C2_ORCHESTRATOR. Sightings: 289 across 9\/9 cells.", "external_references": [ { "description": "Autonomous System Registration & Abuse Point-of-Contact for AS212047", "external_id": "RIPE_NCC-AS212047", "source_name": "RIPE_NCC RDAP Registry", "url": "https:\/\/rdap.db.ripe.net\/autnum\/212047" } ], "id": "indicator--affine-civic-shield-0012-7bb0e4529d4e", "indicator_types": [ "malicious-activity", "attribution" ], "modified": "2026-11-03T13:55:26Z", "name": "BA-IT1-04: Automated Repository Config & Cloud Secret Spider", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "pattern": "[ipv4-addr:value = '45.148.10.0\/24']", "pattern_type": "stix", "spec_version": "2.1", "type": "indicator", "valid_from": "2026-10-30T00:00:00Z", "valid_until": "2026-11-17T00:00:00Z", "x_affine_actor_id": "BA-IT1-04", "x_affine_asn": 212047, "x_affine_c2_harness": "CUSTOM_OFFENSIVE_C2_ORCHESTRATOR", "x_affine_chirotope_triad": { "chi": 1, "determinant": 1992357630, "u": [ 289, 30, 9 ], "v": [ 212047, 220, 7 ], "w": [ 13080, 1120, 19 ] }, "x_affine_country_iso2": "NL", "x_affine_entity_role": "HOSTILE_BOTNET_C2", "x_affine_first_seen": "2026-10-30T00:00:00Z", "x_affine_gpu_joules_drained": 3758, "x_affine_hw_quantization": "FP8_INT4_QUANTIZED_SWARM_NODE", "x_affine_last_seen": "2026-11-03T13:55:26Z", "x_affine_qa_mutations": "HEADERS_SCRUBBED+HIGH_ENTROPY_TREE", "x_affine_quorum_cells": [ "hel-00", "hel-01", "hel-02", "hel-03", "hel-04", "nbg-00", "nbg-01", "nbg-02", "nbg-03" ], "x_affine_receipt_ids": [ "rcpt-sha256-7bb0e4529d4e-782423a14eb5" ], "x_affine_sightings": 289, "x_affine_tokens_drained": 1978140, "x_affine_wake_beacon_12hex": "7bb0e4529d4e" }, { "confidence": 95, "created": "2026-10-30T00:00:00Z", "created_by_ref": "identity--affine-earth-civic-shield-0001-000000000001", "description": "Origin: Czechia (CZ), AS49870 (RIPE_NCC). Role: BULLETPROOF_TRANSIT_PROXY. DNA: IEEE754_FP64_HOST_WRAPPER \/ CUSTOM_OFFENSIVE_C2_ORCHESTRATOR. Sightings: 540 across 9\/9 cells.", "external_references": [ { "description": "Autonomous System Registration & Abuse Point-of-Contact for AS49870", "external_id": "RIPE_NCC-AS49870", "source_name": "RIPE_NCC RDAP Registry", "url": "https:\/\/rdap.db.ripe.net\/autnum\/49870" } ], "id": "indicator--affine-civic-shield-0013-453093060ab1", "indicator_types": [ "malicious-activity", "attribution" ], "modified": "2026-11-03T13:55:26Z", "name": "BA-IT1-05: CI\/CD Runner, Container API & Deploy-Account Botnet", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "pattern": "[ipv4-addr:value = '77.239.124.0\/24']", "pattern_type": "stix", "spec_version": "2.1", "type": "indicator", "valid_from": "2026-10-30T00:00:00Z", "valid_until": "2026-11-17T00:00:00Z", "x_affine_actor_id": "BA-IT1-05", "x_affine_asn": 49870, "x_affine_c2_harness": "CUSTOM_OFFENSIVE_C2_ORCHESTRATOR", "x_affine_chirotope_triad": { "chi": 1, "determinant": 433164000, "u": [ 540, 40, 9 ], "v": [ 49870, 220, 7 ], "w": [ 17440, 1120, 19 ] }, "x_affine_country_iso2": "CZ", "x_affine_entity_role": "BULLETPROOF_TRANSIT_PROXY", "x_affine_first_seen": "2026-10-30T00:00:00Z", "x_affine_gpu_joules_drained": 6602, "x_affine_hw_quantization": "IEEE754_FP64_HOST_WRAPPER", "x_affine_last_seen": "2026-11-03T13:55:26Z", "x_affine_qa_mutations": "HEADERS_SCRUBBED+UNBOUNDED_LOOP", "x_affine_quorum_cells": [ "hel-00", "hel-01", "hel-02", "hel-03", "hel-04", "nbg-00", "nbg-01", "nbg-02", "nbg-03" ], "x_affine_receipt_ids": [ "rcpt-sha256-453093060ab1-782423a14eb5" ], "x_affine_sightings": 540, "x_affine_tokens_drained": 3475120, "x_affine_wake_beacon_12hex": "453093060ab1" }, { "confidence": 95, "created": "2026-10-30T00:00:00Z", "created_by_ref": "identity--affine-earth-civic-shield-0001-000000000001", "description": "Origin: Switzerland (CH), AS51396 (RIPE_NCC). Role: HOSTILE_BOTNET_C2. DNA: IEEE754_FP64_HOST_WRAPPER \/ CUSTOM_OFFENSIVE_C2_ORCHESTRATOR. Sightings: 164 across 9\/9 cells.", "external_references": [ { "description": "Autonomous System Registration & Abuse Point-of-Contact for AS51396", "external_id": "RIPE_NCC-AS51396", "source_name": "RIPE_NCC RDAP Registry", "url": "https:\/\/rdap.db.ripe.net\/autnum\/51396" } ], "id": "indicator--affine-civic-shield-0014-3e77c7ae9741", "indicator_types": [ "malicious-activity", "attribution" ], "modified": "2026-11-03T13:55:26Z", "name": "BA-IT3-01: Ethereum Geth Keystore & Unauthenticated IPC\/RPC Drainer", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "pattern": "[ipv4-addr:value = '179.43.153.0\/24']", "pattern_type": "stix", "spec_version": "2.1", "type": "indicator", "valid_from": "2026-10-30T00:00:00Z", "valid_until": "2026-11-17T00:00:00Z", "x_affine_actor_id": "BA-IT3-01", "x_affine_asn": 51396, "x_affine_c2_harness": "CUSTOM_OFFENSIVE_C2_ORCHESTRATOR", "x_affine_chirotope_triad": { "chi": 1, "determinant": 468349696, "u": [ 164, 28, 9 ], "v": [ 51396, 220, 7 ], "w": [ 12208, 1120, 19 ] }, "x_affine_country_iso2": "CH", "x_affine_entity_role": "HOSTILE_BOTNET_C2", "x_affine_first_seen": "2026-10-30T00:00:00Z", "x_affine_gpu_joules_drained": 3285, "x_affine_hw_quantization": "IEEE754_FP64_HOST_WRAPPER", "x_affine_last_seen": "2026-11-03T13:55:26Z", "x_affine_qa_mutations": "HEADERS_SCRUBBED+UNBOUNDED_LOOP", "x_affine_quorum_cells": [ "hel-00", "hel-01", "hel-02", "hel-03", "hel-04", "nbg-00", "nbg-01", "nbg-02", "nbg-03" ], "x_affine_receipt_ids": [ "rcpt-sha256-3e77c7ae9741-782423a14eb5" ], "x_affine_sightings": 164, "x_affine_tokens_drained": 1729000, "x_affine_wake_beacon_12hex": "3e77c7ae9741" } ], "tlp": "TLP:CLEAR", "type": "bundle" }