User Guide
Synapse-Group-IB User Guide
Synapse-Group-IB adds new Storm commands to allow you to query the Group-IB TI API using your existing API credentials.
Getting Started
Check with your Admin to enable permissions and find out if you need personal API credentials.
Examples
Setting your personal API credentials
To set-up personal use API credentials for Group-IB Threat Intelligence:
> groupib.ti.config.add myconfig mylogin myapikey --scope self
Synapse-Group-IB config "myconfig" added
To use a configuration other than your default, pass --config <name> to the
Synapse-Group-IB commands.
Search using inbound nodes
Search for threat actors using an inet:fqdn node:
> [ inet:fqdn=anydeskupdate.com ] | groupib.ti.threat.actors.search --yield
risk:threat=f2ce0a52bcb2eb80646e94cfe9d6c730
.created = 2026/11/05 22:40:23.937
.seen = ('2020/01/18 00:00:00.000', '2026/10/19 00:00:00.000')
:desc = <p>Lockbit - is the cybercrime group, which used Lockbit ransomware for attacks. Lockbit ransomware was discovered in December 2019. In January 2020, the victims were from the USA, Germany, France, China.</p><p>LockBIt is a Ransomware advertised by seller under names LockBit and LockBIt on Russian forums since January 2020. LockBit uses RSA and AES algorithms for encryption. Ransomware has the following capabilities: volume shadow copies and system backup deleting, UAC bypassing and SMB propagation using stolen account with high privileges.</p><p> </p><p>TTPs are observed in the report: https://tap.group-ib.com/ta/actors?ta=01b0e643235e668704b92833a23224e4c64434e4&tab=timeline&reportId=b2b8964867b2c949520532ad44fe34176698a7b9</p><p>Lockbit Ransomware has DLS (Old domains):</p><pre><code class="language-plaintext">hxxp://lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead[.]onion
hxxp://lockbitapt2yfbt7lchxejug47kmqvqqxvvjpqkmevv4l3azl3gy6pyd[.]onion
hxxp://lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd[.]onion
hxxp://lockbitapt5x4zkjbcqmz6frdhecqqgadevyiwqxukksspnlidyvd7qd[.]onion
hxxp://lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd[.]onion
hxxp://lockbitapt72iw55njgnqpymggskg5yp75ry7rirtdg4m7i42artsbqd[.]onion
hxxp://lockbitaptawjl6udhpd323uehekiyatj6ftcxmkwe5sezs4fqgpjpid[.]onion
hxxp://lockbitaptbdiajqtplcrigzgdjprwugkkut63nbvy2d5r4w2agyekqd[.]onion
hxxp://lockbitaptc2iq4atewz2ise62q63wfktyrl4qtwuk5qax262kgtzjqd[.]onion</code></pre><p style="text-align:center;">Screenshot of old DLS:<br><img src="/api/v2/hi/threat_actor/01b0e643235e668704b92833a23224e4c64434e4/file/2a27882a5d7eacc8c2d0c0388f76d84b65a6e96144c76ed7a883c402080981f7?placeholder=__IMAGE_01b0e643235e668704b92833a23224e4c64434e4:2a27882a5d7eacc8c2d0c0388f76d84b65a6e96144c76ed7a883c402080981f7_IMAGE__" /></p><p>New onion domain of LockBit 5.0:</p><pre><code class="language-plaintext">hxxp://lockbitapt67g6rwzjbcxnww5efpg4qok6vpfeth7wx3okj52ks4wtad[.]onion/</code></pre><p>Screenshot of updated DLS:</p><figure class="image"><img src="/api/v2/hi/threat_actor/01b0e643235e668704b92833a23224e4c64434e4/file/52f939e96d675d49c9d9a4922b014f9ea06903718a9105234aea430a14ec1c56?placeholder=__IMAGE_01b0e643235e668704b92833a23224e4c64434e4:52f939e96d675d49c9d9a4922b014f9ea06903718a9105234aea430a14ec1c56_IMAGE__" width="2744" data-mce-src="__IMAGE_01b0e643235e668704b92833a23224e4c64434e4:52f939e96d675d49c9d9a4922b014f9ea06903718a9105234aea430a14ec1c56_IMAGE__" /></figure><p>Name of the ransom note (Restore-My-Files.txt)</p><p>All encrypted files ends with .lockbit</p><p>Intruders have chat to communicate with victims.</p><p>Links to the chat: </p><pre><code class="language-plaintext">hxxp://lockbit7z2jwcskxpbokpemdxmltipntwlkmidcll2qirbu7ykg46eyd[.]onion
hxxp://lockbit7z2mmiz3ryxafn5kapbvbbiywsxwovasfkgf5dqqp5kxlajad[.]onion
hxxp://lockbit7z2og4jlsmdy7dzty3g42eu3gh2sx2b6ywtvhrjtss7li4fyd[.]onion
hxxp://lockbit7z355oalq4hiy5p7de64l6rsqutwlvydqje56uvevcc57r6qd[.]onion
hxxp://lockbit7z36ynytxwjzuoao46ck7b3753gpedary3qvuizn3iczhe4id[.]onion
hxxp://lockbit7z37ntefjdbjextn6tmdkry4j546ejnru5cejeguitiopvhad[.]onion
hxxp://lockbit7z3azdoxdpqxzliszutufbc2fldagztdu47xyucp25p4xtqad[.]onion
hxxp://lockbit7z3ddvg5vuez2vznt73ljqgwx5tnuqaa2ye7lns742yiv2zyd[.]onion
hxxp://lockbit7z3hv7ev5knxbrhsvv2mmu2rddwqizdz4vwfvxt5izrq6zqqd[.]onion
hxxp://lockbit7z3ujnkhxwahhjduh5me2updvzxewhhc5qvk2snxezoi5drad[.]onion
hxxp://lockbit7z4bsm63m3dagp5xglyacr4z4bwytkvkkwtn6enmuo5fi5iyd[.]onion
hxxp://lockbit7z4cgxvictidwfxpuiov4scdw34nxotmbdjyxpkvkg34mykyd[.]onion
hxxp://lockbit7z4k5zer5fbqi2vdq5sx2vuggatwyqvoodrkhubxftyrvncid[.]onion
hxxp://lockbit7z4ndl6thsct34yd47jrzdkpnfg3acfvpacuccb45pnars2ad[.]onion
hxxp://lockbit7z55tuwaflw2c7torcryobdvhkcgvivhflyndyvcrexafssad[.]onion
hxxp://lockbit7z57mkicfkuq44j6yrpu5finwvjllczkkp2uvdedsdonjztyd[.]onion
hxxp://lockbit7z5ehshj6gzpetw5kso3onts6ty7wrnneya5u4aj3vzkeoaqd[.]onion
hxxp://lockbit7z5hwf6ywfuzipoa42tjlmal3x5suuccngsamsgklww2xgyqd[.]onion
hxxp://lockbit7z5ltrhzv46lsg447o3cx2637dloc3qt4ugd3gr2xdkkkeayd[.]onion
hxxp://lockbit7z6choojah4ipvdpzzfzxxchjbecnmtn4povk6ifdvx2dpnid[.]onion
hxxp://lockbit7z6dqziutocr43onmvpth32njp4abfocfauk2belljjpobxyd[.]onion
hxxp://lockbit7z6f3gu6rjvrysn5gjbsqj3hk3bvsg64ns6pjldqr2xhvhsyd[.]onion
hxxp://lockbit7z6qinyhhmibvycu5kwmcvgrbpvtztkvvmdce5zwtucaeyrqd[.]onion
hxxp://lockbit7z6rzyojiye437jp744d4uwtff7aq7df7gh2jvwqtv525c4yd[.]onion
hxxp://lockbitsup4yezcd5enk5unncx3zcy7kw6wllyqmiyhvanjj352jayid[.]onion</code></pre><p>From 17th of July intruders started using Lockbit2.0 ransomware.<br>And from 6th of June intruders started using Lockbit3.0 ransomware: https://tap.group-ib.com/ta/actors?ta=01b0e643235e668704b92833a23224e4c64434e4&tab=timeline&reportId=edeec5e65ea59636065d5b2488af798e52ccbfcc</p><p>At the time of 29 August 2022 Lockbit Ransomware had 1071 victims from different countries.</p><p> </p><p> </p><p>Screenshots of Lockbit panels:</p><p> </p><p>Lockbit Black</p><figure class="image"><img src="/api/v2/hi/threat_actor/01b0e643235e668704b92833a23224e4c64434e4/file/697a6ba3de71841086e7592ad9bed7cd364f596637f03dd9b7a5ab3acbdb51d5?placeholder=__IMAGE_01b0e643235e668704b92833a23224e4c64434e4:697a6ba3de71841086e7592ad9bed7cd364f596637f03dd9b7a5ab3acbdb51d5_IMAGE__" /></figure><figure class="image"><img src="/api/v2/hi/threat_actor/01b0e643235e668704b92833a23224e4c64434e4/file/b23c2c6b4aba6aadb255f85f1812174a48bef25bdd8244e7ac7b17dbccbdc876?placeholder=__IMAGE_01b0e643235e668704b92833a23224e4c64434e4:b23c2c6b4aba6aadb255f85f1812174a48bef25bdd8244e7ac7b17dbccbdc876_IMAGE__" /></figure><p> </p><p> </p><p>Lockbit Linux/ESXi:</p><figure class="image"><img src="/api/v2/hi/threat_actor/01b0e643235e668704b92833a23224e4c64434e4/file/68169ec39f89ca4bce42cf2fd7446f81b7f945c73dfb38419b423d9ebe325261?placeholder=__IMAGE_01b0e643235e668704b92833a23224e4c64434e4:68169ec39f89ca4bce42cf2fd7446f81b7f945c73dfb38419b423d9ebe325261_IMAGE__" /></figure><p> </p><p>StealBit:</p><figure class="image"><img src="/api/v2/hi/threat_actor/01b0e643235e668704b92833a23224e4c64434e4/file/7d173d15418fe97de8e659c331e2db31284efebbd18ab35de07ff1f7dcabed9f?placeholder=__IMAGE_01b0e643235e668704b92833a23224e4c64434e4:7d173d15418fe97de8e659c331e2db31284efebbd18ab35de07ff1f7dcabed9f_IMAGE__" /></figure><p>In October 2021 LockBit ransomware added support for Linux systems. Experts have spotted a new version that targets VMware ESXi virtual machines, which is aimed at expanding the group of potential targets to include organizations that are migrating to virtualization environments. LockBit operations have been advertising a new Linux version that targets VMware ESXi virtual machines since October 2021. An announcement for LockBit Linux-ESXi Locker version 1.0 has been advertised in the underground forum “RAMP” since October. Security researchers analyzed the LockBit Linux-ESXi Locker version 1.0, which uses a combination of Advanced Encryption Standard (AES) and Elliptic-Curve Cryptography (ECC) algorithms for data encryption. This version is able to gather information such as processor information, volumes in the system, virtual machines to skip, total files, total virtual machines, encrypted files, encrypted virtual machines, total encrypted size, and time spent for encryption. It also supports commands that allow it to determine the type of virtual machines registered on the target system and power off them to unlock and encrypt their resources.</p><p><img src="/api/v2/hi/threat_actor/01b0e643235e668704b92833a23224e4c64434e4/file/093a2b8d439e3df42fe1411ed0373d1630cf801ed4b3e324da309d9de4926779?placeholder=__IMAGE_01b0e643235e668704b92833a23224e4c64434e4:093a2b8d439e3df42fe1411ed0373d1630cf801ed4b3e324da309d9de4926779_IMAGE__" /></p><p> </p><p>In January 2023 Lockbit introduced a new variant, referred to as "Lockbit Green", based on Conti source codes.</p><p> </p><p>On April 16th 2023, Twitter researcher @malwrhunterteam tweeted details of a sample of the LockBit ransomware compiled for Apple’s macOS arm64 architecture.<br>Researcher found a ZIP archive on VirusTotal that contained what appears to be most of the available LockBit encryptors.</p><p>These encryptors include one named 'locker_Apple_M1_64' that targets the newer Macs running on Apple Silicon. The archive also contains lockers for PowerPC CPUs, which older Macs use. No macOS Intel sample is known at this time.</p><p>Archive from VirusTotal also contained previously unknown encryptors for ARM, FreeBSD, MIPS, and SPARC CPUs.</p><p>Text of the ransom note:</p><pre><code class="language-plaintext">LockBit 3.0 the world's fastest and most stable ransomware from 2019 >>>>> Your data is stolen and encrypted. BLOG Tor Browser Links: hxxp://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id[.]onion/ hxxp://lockbit3g3ohd3katajf6zaehxz4h4cnhmz5t735zpltywhwpc6oy3id[.]onion/ hxxp://lockbit3olp7oetlc4tl5zydnoluphh7fvdt5oa6arcp2757r7xkutid[.]onion/ hxxp://lockbit435xk3ki62yun7z5nhwz6jyjdp2c64j5vge536if2eny3gtid[.]onion/ hxxp://lockbit4lahhluquhoka3t4spqym2m3dhe66d6lr337glmnlgg2nndad[.]onion/ hxxp://lockbit6knrauo3qafoksvl742vieqbujxw7rd6ofzdtapjb4rrawqad[.]onion/ hxxp://lockbit7ouvrsdgtojeoj5hvu6bljqtghitekwpdy3b6y62ixtsu5jqd[.]onion/ >>>>> What guarantee is there that we won't cheat you We are the oldest ransomware affiliate program on the planet, nothing is more important than our reputation. We are not a politically motivated group and we want nothing more than money. If you pay, we will fulfill all the terms we agree on during the negotiation process. Treat this situation simply as a paid training session for your system administrators, because it was the misconfiguration of your corporate network that allowed us to attack you. Our pentesting services should be paid for the same way you pay your system administrators salaries. You can get more information about us on Ilon Musk's Twitter hxxps://twitter[.]com/hashtag/lockbit f=live >>>>> You need to contact us on TOR darknet sites with your personal ID Download and install Tor Browser hxxps://www[.]torproject[.]org/ Write to the chat room and wait for an answer, we'll guarantee a response from us. If you need a unique ID for correspondence with us that no one will know about, ask it in the chat, we will generate a secret chat for you and give you his ID via private one-time memos service, no one can find out this ID but you. Sometimes you will have to wait some time for our reply, this is because we have a lot of work and we attack hundreds of companies around the world. Tor Browser personal link for CHAT available only to you (available during a ddos attack): hxxp://lockbitb42tkml3ipianjbs6e33vhcshb7oxm2stubfvdzn3y2yqgbad[.]onion Tor Browser Links for CHAT (sometimes unavailable due to ddos attacks): hxxp://lockbit5eevg7vec4vwwtzgkl4kulap6oxbic2ye4mnmlq6njnpc47qd[.]onion hxxp://lockbit74beza5z3e3so7qmjnvlgoemscp7wtp33xo7xv7f7xtlqbkqd[.]onion hxxp://lockbit75naln4yj44rg6ez6vjmdcrt7up4kxmmmuvilcg4ak3zihxid[.]onion hxxp://lockbit7a2g6ve7etbcy6iyizjnuleffz4szgmxaawcbfauluavi5jqd[.]onion hxxp://lockbitaa46gwjck2xzmi2xops6x4x3aqn6ez7yntitero2k7ae6yoyd[.]onion hxxp://lockbitcuo23q7qrymbk6dsp2sadltspjvjxgcyp4elbnbr6tcnwq7qd[.]onion >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> >> Your personal Black ID: << >>>>> Warning Do not delete or modify encrypted files, it will lead to problems with decryption of files >>>>> Don't go to the police or the FBI for help and don't tell anyone that we attacked you.</code></pre><p>Screenshot of the ransom note:</p><figure class="image"><img src="/api/v2/hi/threat_actor/01b0e643235e668704b92833a23224e4c64434e4/file/d3ca869b9c857009f9fbb7bc6d3ef00f63f6b6c4527e9cb97d334454eac29389?placeholder=__IMAGE_01b0e643235e668704b92833a23224e4c64434e4:d3ca869b9c857009f9fbb7bc6d3ef00f63f6b6c4527e9cb97d334454eac29389_IMAGE__" /></figure><h2>Lockbit5 Announcement</h2><p>The threat actor publicly introduced LockBit 5.0 on dark web marketplaces and underground forums in September 2025, signaling both the continuation of their operations and a strategic rebranding effort aimed at reasserting their influence within the ransomware ecosystem.</p><figure class="image"><img src="/api/v2/hi/threat_actor/01b0e643235e668704b92833a23224e4c64434e4/file/067d09a674451d2bbc35960ab767b4b826264d67e20aa73b3d7c39a8c5d49d86?placeholder=__IMAGE_01b0e643235e668704b92833a23224e4c64434e4:067d09a674451d2bbc35960ab767b4b826264d67e20aa73b3d7c39a8c5d49d86_IMAGE__" width="624" /><figcaption><i>Screenshot of the message from RAMP forum</i></figcaption></figure><p>The text from the screenshot in English:</p><pre><code class="language-plaintext">LockBit:
“Today our affiliate program turns 6 years old. On this day, we are releasing the long-awaited update LockBit 5.0
hxxp://lockbitfbinpwhbyomxkiqtwhwiyetrbkb4hnqmshaonqxmsrqwg7yad[.]onion”
blessthefall:
(quoting LockBit’s message)
“Today our affiliate program turns 6 years old. On this day, we are releasing the long-awaited update LockBit 5.0
hxxp://lockbitfbinpwhbyomxkiqtwhwiyetrbkb4hnqmshaonqxmsrqwg7yad[.]onion”
“Let me get myself a tattoo ‘LB 5.0’ for $1000.”</code></pre><p>LockBit 5.0 represents the most recent step in the group's progress. The malware is touted as more modular, with faster encryption and better ways to avoid defenses. The affiliate program has also been updated, giving cybercriminal partners more reasons to join. If the upgrade backs up these assertions, LockBit might soon regain traction and expand its activity throughout the ransomware ecosystem.</p><figure class="image"><img src="/api/v2/hi/threat_actor/01b0e643235e668704b92833a23224e4c64434e4/file/d14d6cc9b9eac51cb3c3d4bdf3f2a0f481220ac2cea4158ae3ef196bb9571452?placeholder=__IMAGE_01b0e643235e668704b92833a23224e4c64434e4:d14d6cc9b9eac51cb3c3d4bdf3f2a0f481220ac2cea4158ae3ef196bb9571452_IMAGE__" width="624" /><figcaption><i>Lockbit5 Login Page</i></figcaption></figure><p>Lockbit is going to be a bigger threat since they have created a cartel with DragonForce and Qilin. They started actively hiring new members, improved the software and now cooperate with other big ransomware groups:</p><figure class="image"><img src="/api/v2/hi/threat_actor/01b0e643235e668704b92833a23224e4c64434e4/file/be9aeebca893b60681074ff7c660bbb9e4e8685fc47f173706c54d2c9ef77267?placeholder=__IMAGE_01b0e643235e668704b92833a23224e4c64434e4:be9aeebca893b60681074ff7c660bbb9e4e8685fc47f173706c54d2c9ef77267_IMAGE__" width="624" /><figcaption>Conversation Between DragonForce and LockBit </figcaption></figure><p>The text from the screenshot:</p><pre><code class="language-plaintext">DragonForce:“Welcome home (LB). I think we should all establish communication (LockBit, Qilin, DragonForce). I have a proposal for everyone: create equal competition conditions, no conflicts and no public insults… Clear agreements, understandable to everyone. No undercutting percentages or deposits. This way, we can all increase our income and dictate market conditions. Call it whatever you like — coalition, cartel, etc. The main thing is to stay in touch, be friendly to each other, and be strong allies, not enemies. There’s enough pie here for everyone.”
LockBit:“I completely agree with you. I love you and I don’t wish you anything bad. As people are to me, so I am to people.”
LockBit:“Give me your Tox [ID], I’ll add you as a friend.”</code></pre><p> </p>
:org:name = lockbit
:org:names = ['34585', 'bitwise spider', 'lockbit 3.0', 'lockbitsupp', 'neverentrustcom', 'uhodiransomwar', 'xyxy']
:reporter = ef267a83d0dd3a81a105aa52f6e02b07
:reporter:discovered = 2020/01/18 00:00:00.000
:reporter:name = group-ib
:tag = rep.groupib.lockbit
:type = groupib.cybercriminal
#rep.groupib.expertise.access
#rep.groupib.expertise.accounts
#rep.groupib.expertise.autoreport
#rep.groupib.expertise.compromised_data
#rep.groupib.expertise.corporate_network
#rep.groupib.expertise.current_crisis
#rep.groupib.expertise.cve
#rep.groupib.expertise.database
#rep.groupib.expertise.ddos
#rep.groupib.expertise.gib_origin
#rep.groupib.expertise.highlight
#rep.groupib.expertise.leak
#rep.groupib.expertise.legal_remote_control_tools
#rep.groupib.expertise.ransomware
#rep.groupib.expertise.rdp
#rep.groupib.expertise.unique_data
#rep.groupib.expertise.update
Search using a query string
The Group-IB TI API also allows using Lucene query syntax to perform a search. For example, to search for malware configs by malware name:
> groupib.ti.malware.configs.search --query 'malware: "Cobalt Strike"' --size 1 --yield
it:sec:c2:config=c586b1de29d04ebd5ed4514ba54a500f
.created = 2026/11/05 22:40:27.372
.seen = ('2023/05/22 07:15:59.000', '2023/05/22 07:15:59.001')
:family = cobalt strike
:file = sha256:9a89ebe9de5711806e0a75919f30971d2df30bbc2b56525f4d92d99931d53e30
:raw = {'func': 0, 'Spawnto_x86': '%windir%\\syswow64\\runonce.exe', 'DNS_strategy': 0, 'PublicKey_MD5': '357c86281a2ff4b7249b9170acc48a96', 'Unknown-36': 'QmV1ZHRLZ3FubG0wUnV2ZitWWXh1dz09AAAAAAAAAAA=', 'smbFrameHeader': 'AAWAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=', 'DNS_strategy_fail_seconds': -1, 'HostHeader': 'Host: staos.microsoft.com\r\n', 'Proxy_AccessType': '2 (use IE settings)', 'SpawnTo': 'AAAAAAAAAAAAAAAAAAAAAA==', 'Unknown-71': 0, 'Unknown-72': 0, 'Unknown-73': 0, 'bUsesCookies': 'True', 'Spawnto_x64': '%windir%\\sysnative\\runonce.exe', 'Watermark': 100000, 'bProcInject_MinAllocSize': 18700, 'bProcInject_StartRWX': 'True', 'binary.http-get.server.output': 'AAAABAAAAAEAAAbjAAAAAgAABuMAAAACAAACXAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==', 'HttpGet_Verb': 'GET', 'version': '4', 'DNS_strategy_fail_x': -1, 'UserAgent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4044.62 Safari/537.36', 'tcpFrameHeader': 'AAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=', 'KillDate': '0', 'HttpPost_Verb': 'POST', 'HttpPostChunk': 0, 'textSectionEnd (0 if !sleep_mask)': 1, 'BeaconType': '8 (HTTPS)', 'HttpGet_Metadata': ('Accept-Encoding: gzip, deflate', 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9', 'Upgrade-Insecure-Requests: 1', 'ANID=', '__Secure-3PAPISID=noskin;', ';CONSENT=YES+CN.zh-CN+20210917-09-0', 'Cookie'), 'ProcInject_PrependAppend_x86': 'AAAABJCQkJAAAAAEkJCQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==', 'ProcInject_AllocationMethod': 'VirtualAllocEx', 'ProcInject_PrependAppend_x64': 'AAAABJCQkJAAAAAEkJCQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==', 'Jitter': 37, 'SleepTime': 30000, 'bStageCleanup': 'True', 'DNS_strategy_rotate_seconds': -1, 'MaxGetSize': 2101282, 'CryptoScheme': 0, 'Port': 443, 'PublicKey': 'MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3xa1GioeOfHbj0SafCB8qyR0hPQs3Te4HcNG/AsJAGeNGMRz18dl0j7fwYN+u/z9soX0oN7aBkqN8LB2ecrmkB1cd6mAvjZpIwbKhQGHesz9JBueFL2Wods1MmW1KWrceHuw1nX25C+rt3sBsOdDdEPn0MJgdvTI20y86xrGm9wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==', 'obfuscate_section': 'ANACABLJAwAA0AMAaKIEAACwBADQ0AQAAOAEAHLvBAAAAAAAAAAAAA==', 'ProcInject_Execute': ('CreateThread', 'SetThreadContext', 'NtQueueApcThread-s', 'RtlCreateUserThread', '7', '16'), 'ProcInject_Stub': 'BOChG+WRR6jXPSs+n+qDLA==', 'bProcInject_UseRWX': 'True', 'HttpPost_Metadata': ('Content-Type: text/plain;charset=UTF-8', 'Referer: http://www.10086.cn/', 'Accept: */*', '__formid', 'adv_url=DsIQFPt', 'commend_flag=HysZPJ', 'is_stock=YdlTgqbVTyCh', 'aid_=522005705&accver=1&showtype=embed&ua='), 'bCFGCaution': 'True', 'C2Server': 'res-ghesh.imoba.com.cn,/', 'HttpPostUri': '/web-Center/commonservice/ipLocation.do'}
:servers = ['8 (https)://res-ghesh.imoba.com.cn:443/']
#rep.groupib.cobalt_strike
Additional information on the search syntax can be found in the Group-IB TI Searching and Filtering documentation.
Use of meta:source nodes
Synapse-Group-IB uses a meta:source node and -(seen)> light
weight edges to track nodes observed from the Group-IB API.
> meta:source=25fed133fa8944e403bfffe5ce31d975
meta:source=25fed133fa8944e403bfffe5ce31d975
.created = 2026/11/05 22:40:23.616
:name = group-ib ti api
Storm can be used to filter nodes to include/exclude nodes which have been observed by Synapse-Group-IB. The following example shows how to filter the results of a query to include only results observed by Synapse-Group-IB:
> it:sec:c2:config +{ <(seen)- meta:source=25fed133fa8944e403bfffe5ce31d975 } | limit 1
it:sec:c2:config=c586b1de29d04ebd5ed4514ba54a500f
.created = 2026/11/05 22:40:27.372
.seen = ('2023/05/22 07:15:59.000', '2023/05/22 07:15:59.001')
:family = cobalt strike
:file = sha256:9a89ebe9de5711806e0a75919f30971d2df30bbc2b56525f4d92d99931d53e30
:raw = {'func': 0, 'Spawnto_x86': '%windir%\\syswow64\\runonce.exe', 'DNS_strategy': 0, 'PublicKey_MD5': '357c86281a2ff4b7249b9170acc48a96', 'Unknown-36': 'QmV1ZHRLZ3FubG0wUnV2ZitWWXh1dz09AAAAAAAAAAA=', 'smbFrameHeader': 'AAWAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=', 'DNS_strategy_fail_seconds': -1, 'HostHeader': 'Host: staos.microsoft.com\r\n', 'Proxy_AccessType': '2 (use IE settings)', 'SpawnTo': 'AAAAAAAAAAAAAAAAAAAAAA==', 'Unknown-71': 0, 'Unknown-72': 0, 'Unknown-73': 0, 'bUsesCookies': 'True', 'Spawnto_x64': '%windir%\\sysnative\\runonce.exe', 'Watermark': 100000, 'bProcInject_MinAllocSize': 18700, 'bProcInject_StartRWX': 'True', 'binary.http-get.server.output': 'AAAABAAAAAEAAAbjAAAAAgAABuMAAAACAAACXAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==', 'HttpGet_Verb': 'GET', 'version': '4', 'DNS_strategy_fail_x': -1, 'UserAgent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4044.62 Safari/537.36', 'tcpFrameHeader': 'AAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=', 'KillDate': '0', 'HttpPost_Verb': 'POST', 'HttpPostChunk': 0, 'textSectionEnd (0 if !sleep_mask)': 1, 'BeaconType': '8 (HTTPS)', 'HttpGet_Metadata': ('Accept-Encoding: gzip, deflate', 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9', 'Upgrade-Insecure-Requests: 1', 'ANID=', '__Secure-3PAPISID=noskin;', ';CONSENT=YES+CN.zh-CN+20210917-09-0', 'Cookie'), 'ProcInject_PrependAppend_x86': 'AAAABJCQkJAAAAAEkJCQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==', 'ProcInject_AllocationMethod': 'VirtualAllocEx', 'ProcInject_PrependAppend_x64': 'AAAABJCQkJAAAAAEkJCQkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==', 'Jitter': 37, 'SleepTime': 30000, 'bStageCleanup': 'True', 'DNS_strategy_rotate_seconds': -1, 'MaxGetSize': 2101282, 'CryptoScheme': 0, 'Port': 443, 'PublicKey': 'MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3xa1GioeOfHbj0SafCB8qyR0hPQs3Te4HcNG/AsJAGeNGMRz18dl0j7fwYN+u/z9soX0oN7aBkqN8LB2ecrmkB1cd6mAvjZpIwbKhQGHesz9JBueFL2Wods1MmW1KWrceHuw1nX25C+rt3sBsOdDdEPn0MJgdvTI20y86xrGm9wIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==', 'obfuscate_section': 'ANACABLJAwAA0AMAaKIEAACwBADQ0AQAAOAEAHLvBAAAAAAAAAAAAA==', 'ProcInject_Execute': ('CreateThread', 'SetThreadContext', 'NtQueueApcThread-s', 'RtlCreateUserThread', '7', '16'), 'ProcInject_Stub': 'BOChG+WRR6jXPSs+n+qDLA==', 'bProcInject_UseRWX': 'True', 'HttpPost_Metadata': ('Content-Type: text/plain;charset=UTF-8', 'Referer: http://www.10086.cn/', 'Accept: */*', '__formid', 'adv_url=DsIQFPt', 'commend_flag=HysZPJ', 'is_stock=YdlTgqbVTyCh', 'aid_=522005705&accver=1&showtype=embed&ua='), 'bCFGCaution': 'True', 'C2Server': 'res-ghesh.imoba.com.cn,/', 'HttpPostUri': '/web-Center/commonservice/ipLocation.do'}
:servers = ['8 (https)://res-ghesh.imoba.com.cn:443/']
#rep.groupib.cobalt_strike