[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6wvYObymz42JzHC2X6QgydJAqFxscvkOtVx5HVm1pSs":3},{"article":4,"iocs":33},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":21,"category":22,"article_tags":25},"15d97f04-f2ae-425b-ab94-4a2b1ccec2bb","In the past like few months, shared some possible interesting samples with the guys that are usin...","in-the-past-like-few-months-shared-some-possible-interesting-samples-with-the-gu-52227a","In the past like few months, shared some possible interesting samples with the guys that are using PHP in some way. This is one such sample.\nThe 202.6.2[.]36 IP address is in the network of the \"Ministry of Foreign Affairs of Vietnam - MOFA\"...\n🤔\n🤷‍♂️ https:\u002F\u002Ft.co\u002Fb4YDI2qMmk https:\u002F\u002Ft.co\u002F6u0dldNDg9","A threat actor is using PHP-based malware in their attacks. One identified sample connects to an IP address within the network of the Ministry of Foreign Affairs of Vietnam.","Attackers are using PHP-based malware; one sample connects to Vietnam's Ministry of Foreign Affairs network.",null,"https:\u002F\u002Fx.com\u002Fmalwrhunterteam\u002Fstatus\u002F2061348376466051269","https:\u002F\u002Fpbs.twimg.com\u002Fmedia\u002FHJtgMLQWsAM_MK7.png","2026-06-01T07:25:25+00:00","2026-06-01T08:00:09.586777+00:00",7,[18],{"name":19,"type":20},"PHP","technology","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":21,"icon":11,"name":23,"slug":24},"Threat Intelligence","threat-intelligence",[26,31],{"category":27},{"id":28,"icon":11,"name":29,"slug":30},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":32},{"id":21,"icon":11,"name":23,"slug":24},[34],{"type":35,"value":36,"context":37},"ip","202.6.2.36","Connects to network of the Ministry of Foreign Affairs of Vietnam"]