{"id":12279,"date":"2018-09-10T13:24:00","date_gmt":"2018-09-10T13:24:00","guid":{"rendered":"http:\/\/8d8d6c84-31d5-4f55-9da6-c717bb56dd2d"},"modified":"2018-09-10T13:24:00","modified_gmt":"2018-09-10T13:24:00","slug":"luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities\/","title":{"rendered":"LuckyMouse uses malicious NDISProxy Windows driver to target gov’t entities"},"content":{"rendered":"
<\/div>\n

The LuckyMouse advanced persistent threat (APT) is back with a twist in tactics that harnesses LeagSoft certificates to spread Trojans by way of malicious NDISProxy drivers.<\/p>\n

\n

More security news<\/span><\/h3>\n<\/div>\n

It was back in June<\/a> that researchers discovered that LuckyMouse, also known as EmissaryPanda and APT27, had targeted a national data center containing Asian government resources.<\/p>\n

In this previous campaign, LuckyMouse used malicious documents embedded with macros which exploited a widely-known Microsoft Word vulnerability. The Chinese-speaking threat group chose the center in order to steal a “wide range of government resources at one fell swoop.”<\/p>\n

However, in a fresh twist, the APT is back which uses seemingly legitimate security certificates issued by VeriSign to Chinese security software developer LeagSoft.<\/p>\n

Kaspersky researchers said on Monday<\/a> that LuckyMouse has harnessed the certificates belonging to the Shenzhen, Guangdong-based firm since March 2018. It appears they have been stolen.<\/p>\n

By utilizing these certificates, the threat actors have launched a new campaign which aims to exploits the Windows network filtering driver NDISProxy, in both 32- and 64-bit versions, depending on the target machine.<\/p>\n

NDISProxy<\/a>, also known as Ndproxy.sys, is legitimate driver software which brings together NDISWAN and CoNDIS WAN drivers with TAPI services.<\/p>\n

\n<\/section>\n

By compromising this Windows component by the use of a malicious NDISProxy tool signed off with a legitimate certificate, the driver tool can be used to infect lsass.exe system process memory.<\/p>\n

The Trojan payload, which was previously unrecorded, consists of three main modules. The first is a custom C++ installer which creates a Windows autorun service for Trojan persistency. In addition, the module is able to drop the encrypted Trojan into the system registry.<\/p>\n

Instead of using Windows executable file loaders, the remote access Trojan (RAT) is decrypted by the NDISProxy driver from the system registry and injected into the lsass.exe process memory through the use of Shellcode.<\/p>\n

See also: Top Mac anti-adware software in App Store steals your browsing history<\/a><\/strong><\/p>\n

The second module filters port 3389 traffic to hide the Trojan’s malicious network activities within. This step ensures the malware is able to communicate with its command-and-control (C2) server without detection.<\/p>\n

The final module is a custom C++ Trojan which acts as an HTTPS server and platform for C2 communications.<\/p>\n

“These modules allow attackers to silently move laterally in the infected infrastructure, but don’t allow them to communicate with an external C2 if the new infected host only has a LAN IP,” the researchers say. “Because of this, the operators used an Earthworm SOCKS tunneler in order to connect the LAN of the infected host to the external C2.”<\/p>\n

The Trojans will listen in and install keyloggers in order to harvest administrator credentials. If successful, the Scanline network scanner is also used in order to spread the malware via file sharing across a corporate network.<\/p>\n

CNET: Justice Department charges North Korean over WannaCry, Sony hack<\/a><\/strong><\/p>\n

The Trojan is able to complete many of the tasks of a typical member of this malware family; including command execution and keylogging, as well as downloading and uploading files.<\/p>\n

LuckyMouse’s NDISProxy tool also makes use of a variety of other third-party components and open-source code, such as the Blackbone<\/a> Windows hacking library hosted on GitHub.<\/p>\n

TechRepublic: How you can get low-tech hacked<\/a><\/strong><\/p>\n

The researchers say that no phishing campaigns have been detected which use the Trojan dropper. Instead, it is currently believed that the malware is currently only spreading in networks which are already compromised in some way.<\/p>\n

The latest LuckyMouse attacks have focused on government entities in the middle of Asia and took place at the same time as a “high-level meeting,” although it has not been disclosed exactly what political situation was at hand.<\/p>\n

While attribution is difficult, Kaspersky researchers believe that politics, in some manner, is at the heart of the campaign.<\/p>\n

“This campaign appears to demonstrate once again LuckyMouse’s interest in Central Asia and the political agenda surrounding the Shanghai Cooperation Organization,” the firm says.<\/p>\n

The Shanghai Cooperation Organization (SCO) is a pact made up of countries including China, Russia, and European entities to discuss global political, economic, and security issues.<\/p>\n

Kaspersky has made LeagSoft aware of the issue via CN-CERT. ZDNet has also attempted to contact the company and Verisign and will update if we hear back.<\/p>\n

Previous and related coverage<\/h3>\n

READ MORE HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

The hacking group is covertly infecting Windows machines with Trojans by way of stolen certificates belonging to a Chinese security company.
\nREAD MORE HERE…<\/p>\n","protected":false},"author":2,"featured_media":12280,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[62],"tags":[],"class_list":["post-12279","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-zdnet-security"],"yoast_head":"\nLuckyMouse uses malicious NDISProxy Windows driver to target gov't entities 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"LuckyMouse uses malicious NDISProxy Windows driver to target gov't entities 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2018-09-10T13:24:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2018\/09\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities.png\" \/>\n\t<meta property=\"og:image:width\" content=\"770\" \/>\n\t<meta property=\"og:image:height\" content=\"578\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.threatshub.org\/blog\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.threatshub.org\/blog\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"LuckyMouse uses malicious NDISProxy Windows driver to target gov’t entities\",\"datePublished\":\"2018-09-10T13:24:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.threatshub.org\/blog\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities\/\"},\"wordCount\":729,\"publisher\":{\"@id\":\"https:\/\/www.threatshub.org\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.threatshub.org\/blog\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2018\/09\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities.png\",\"articleSection\":[\"ZDNet | Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.threatshub.org\/blog\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities\/\",\"url\":\"https:\/\/www.threatshub.org\/blog\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities\/\",\"name\":\"LuckyMouse uses malicious NDISProxy Windows driver to target gov't entities 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\/\/www.threatshub.org\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.threatshub.org\/blog\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.threatshub.org\/blog\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2018\/09\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities.png\",\"datePublished\":\"2018-09-10T13:24:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.threatshub.org\/blog\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.threatshub.org\/blog\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.threatshub.org\/blog\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities\/#primaryimage\",\"url\":\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2018\/09\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities.png\",\"contentUrl\":\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2018\/09\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities.png\",\"width\":770,\"height\":578},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.threatshub.org\/blog\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.threatshub.org\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"LuckyMouse uses malicious NDISProxy Windows driver to target gov’t entities\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.threatshub.org\/blog\/#website\",\"url\":\"https:\/\/www.threatshub.org\/blog\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\/\/www.threatshub.org\/blog\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.threatshub.org\/blog\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\/\/www.threatshub.org\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/x.com\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"LuckyMouse uses malicious NDISProxy Windows driver to target gov't entities 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities\/","og_locale":"en_US","og_type":"article","og_title":"LuckyMouse uses malicious NDISProxy Windows driver to target gov't entities 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2018-09-10T13:24:00+00:00","og_image":[{"width":770,"height":578,"url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2018\/09\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities.png","type":"image\/png"}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"LuckyMouse uses malicious NDISProxy Windows driver to target gov’t entities","datePublished":"2018-09-10T13:24:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities\/"},"wordCount":729,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2018\/09\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities.png","articleSection":["ZDNet | Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities\/","url":"https:\/\/www.threatshub.org\/blog\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities\/","name":"LuckyMouse uses malicious NDISProxy Windows driver to target gov't entities 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2018\/09\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities.png","datePublished":"2018-09-10T13:24:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2018\/09\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities.png","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2018\/09\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities.png","width":770,"height":578},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/luckymouse-uses-malicious-ndisproxy-windows-driver-to-target-govt-entities\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"LuckyMouse uses malicious NDISProxy Windows driver to target gov’t entities"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/12279","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=12279"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/12279\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/12280"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=12279"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=12279"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=12279"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}