Hacking Attack

This document defines the data structure for "Hacking Attack" articles. These articles provide insights into real-world cyberattacks, threat actor operations, malware campaigns, and observed attack infrastructure.

🧱 Core Fields

Field	Type	Description
`summary`	string	Summary or key message of the article.
`title`	string	Title of the original attack report.
`published_date`	string (ISO 8601)	When the article was first published.
`last_updated_date`	string (ISO 8601)	(Optional) Last modification date from the source.
`scraped_date`	string (ISO 8601)	Date when the report was ingested.
`url`	string	Direct link to the original article.
`publishing_company`	string	Entity or company publishing the report.
`version_info`	string	Version or tag of the report (if any).
`classification`	string	Always set to `Hacking Attack`.

🎯 Attack Context

Field	Type	Description
`groups`	List[string]	Threat actor group names (e.g., APT28, Lazarus).
`botnets`	List[string]	Named botnets involved in the attack.
`campaigns`	List[string]	Named attack campaigns referenced in the article.
`tools`	List[string]	Tools or malware mentioned (e.g., Cobalt Strike, Mimikatz).
`references`	List[string]	Additional URLs or citations in the article.
`victim_names`	List[string]	Named victim organizations if publicly known.
`target_sectors`	List[string]	Sectors targeted (e.g., Finance, Healthcare, Government).
`target_geographies`	List[string]	Geographic regions or countries affected.
`CVEs`	List[string]	Related CVE identifiers used in the attack.

✅ Integration Guidance

Use classification == "Hacking Attack" to classify this type.
If groups or botnets are mentioned, they can be cross-referenced against threat intel databases.
victim_names should be anonymized if needed for internal tooling.
tools, campaigns, and CVEs are helpful for correlating with IOC datasets.
Dates are stored in ISO 8601 format (e.g., 2025-06-01T00:00:00Z).

Published with Nuclino