{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2022:SETOJT2XB2ZTOOFZYQGQJPGAL5","short_pith_number":"pith:SETOJT2X","canonical_record":{"source":{"id":"2203.03175","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2022-03-07T07:03:43Z","cross_cats_sorted":[],"title_canon_sha256":"2025e601b685e979b2853d6d37c10cea23fe2abeec6ebbab9312d82a6b865320","abstract_canon_sha256":"8671f9358ce623b80e04d4817a8c136d66330ef0f32619b2ad0a8f6510cad009"},"schema_version":"1.0"},"canonical_sha256":"9126e4cf570eb33738b9c40d04bcc05f6b828a26a9f644fd4826fda55edfa919","source":{"kind":"arxiv","id":"2203.03175","version":2},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2203.03175","created_at":"2026-07-05T04:03:16Z"},{"alias_kind":"arxiv_version","alias_value":"2203.03175v2","created_at":"2026-07-05T04:03:16Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2203.03175","created_at":"2026-07-05T04:03:16Z"},{"alias_kind":"pith_short_12","alias_value":"SETOJT2XB2ZT","created_at":"2026-07-05T04:03:16Z"},{"alias_kind":"pith_short_16","alias_value":"SETOJT2XB2ZTOOFZ","created_at":"2026-07-05T04:03:16Z"},{"alias_kind":"pith_short_8","alias_value":"SETOJT2X","created_at":"2026-07-05T04:03:16Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2022:SETOJT2XB2ZTOOFZYQGQJPGAL5","target":"record","payload":{"canonical_record":{"source":{"id":"2203.03175","kind":"arxiv","version":2},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2022-03-07T07:03:43Z","cross_cats_sorted":[],"title_canon_sha256":"2025e601b685e979b2853d6d37c10cea23fe2abeec6ebbab9312d82a6b865320","abstract_canon_sha256":"8671f9358ce623b80e04d4817a8c136d66330ef0f32619b2ad0a8f6510cad009"},"schema_version":"1.0"},"canonical_sha256":"9126e4cf570eb33738b9c40d04bcc05f6b828a26a9f644fd4826fda55edfa919","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T04:03:16.409755Z","signature_b64":"fzruIKf5aErED4YiuwxVGVaRH00ij+1jtN+MGEYSG4ewP/ckEGD/upptUb9zaCfus8ghK4Q8NIqXadx6wdbQBQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"9126e4cf570eb33738b9c40d04bcc05f6b828a26a9f644fd4826fda55edfa919","last_reissued_at":"2026-07-05T04:03:16.409280Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T04:03:16.409280Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2203.03175","source_version":2,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T04:03:16Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"AzqaRyowkKlSXz150Etr5o+kJWP8foDBVZrF/bRipoy942VWY20aRFPFHcHklJIw+onD8SsAnoDdCUL9Gm0oDA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-03T15:19:06.508135Z"},"content_sha256":"00b76c4dc93c49b208e681d786420a716c1d6ccdb00bca5e9ac36bfb2edae772","schema_version":"1.0","event_id":"sha256:00b76c4dc93c49b208e681d786420a716c1d6ccdb00bca5e9ac36bfb2edae772"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2022:SETOJT2XB2ZTOOFZYQGQJPGAL5","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"The Dangerous Combo: Fileless Malware and Cryptojacking","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Murat Ozer, Nelly Elsayed, Said Varlioglu, Zag ElSayed","submitted_at":"2022-03-07T07:03:43Z","abstract_excerpt":"Fileless malware and cryptojacking attacks have appeared independently as the new alarming threats in 2017. After 2020, fileless attacks have been devastating for victim organizations with low-observable characteristics. Also, the amount of unauthorized cryptocurrency mining has increased after 2019. Adversaries have started to merge these two different cyberattacks to gain more invisibility and profit under \"Fileless Cryptojacking.\" This paper aims to provide a literature review in academic papers and industry reports for this new threat. Additionally, we present a new threat hunting-oriented"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2203.03175","kind":"arxiv","version":2},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2203.03175/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T04:03:16Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"193eI3fdK5VLn6VKYD1HSJqwxv+L0JhDHoU5ORyQxuV7zsc4EpC32OYLcZK6HYH+TJ7e/trOFhQT94zdvEDTBg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-03T15:19:06.508635Z"},"content_sha256":"81668ee6cd4ea4f5ab16fbbb3e286f0ee5a0ff876218e58d434d20d6b691c661","schema_version":"1.0","event_id":"sha256:81668ee6cd4ea4f5ab16fbbb3e286f0ee5a0ff876218e58d434d20d6b691c661"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/SETOJT2XB2ZTOOFZYQGQJPGAL5/bundle.json","state_url":"https://pith.science/pith/SETOJT2XB2ZTOOFZYQGQJPGAL5/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/SETOJT2XB2ZTOOFZYQGQJPGAL5/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-03T15:19:06Z","links":{"resolver":"https://pith.science/pith/SETOJT2XB2ZTOOFZYQGQJPGAL5","bundle":"https://pith.science/pith/SETOJT2XB2ZTOOFZYQGQJPGAL5/bundle.json","state":"https://pith.science/pith/SETOJT2XB2ZTOOFZYQGQJPGAL5/state.json","well_known_bundle":"https://pith.science/.well-known/pith/SETOJT2XB2ZTOOFZYQGQJPGAL5/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2022:SETOJT2XB2ZTOOFZYQGQJPGAL5","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"8671f9358ce623b80e04d4817a8c136d66330ef0f32619b2ad0a8f6510cad009","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2022-03-07T07:03:43Z","title_canon_sha256":"2025e601b685e979b2853d6d37c10cea23fe2abeec6ebbab9312d82a6b865320"},"schema_version":"1.0","source":{"id":"2203.03175","kind":"arxiv","version":2}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2203.03175","created_at":"2026-07-05T04:03:16Z"},{"alias_kind":"arxiv_version","alias_value":"2203.03175v2","created_at":"2026-07-05T04:03:16Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2203.03175","created_at":"2026-07-05T04:03:16Z"},{"alias_kind":"pith_short_12","alias_value":"SETOJT2XB2ZT","created_at":"2026-07-05T04:03:16Z"},{"alias_kind":"pith_short_16","alias_value":"SETOJT2XB2ZTOOFZ","created_at":"2026-07-05T04:03:16Z"},{"alias_kind":"pith_short_8","alias_value":"SETOJT2X","created_at":"2026-07-05T04:03:16Z"}],"graph_snapshots":[{"event_id":"sha256:81668ee6cd4ea4f5ab16fbbb3e286f0ee5a0ff876218e58d434d20d6b691c661","target":"graph","created_at":"2026-07-05T04:03:16Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2203.03175/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Fileless malware and cryptojacking attacks have appeared independently as the new alarming threats in 2017. After 2020, fileless attacks have been devastating for victim organizations with low-observable characteristics. Also, the amount of unauthorized cryptocurrency mining has increased after 2019. Adversaries have started to merge these two different cyberattacks to gain more invisibility and profit under \"Fileless Cryptojacking.\" This paper aims to provide a literature review in academic papers and industry reports for this new threat. Additionally, we present a new threat hunting-oriented","authors_text":"Murat Ozer, Nelly Elsayed, Said Varlioglu, Zag ElSayed","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2022-03-07T07:03:43Z","title":"The Dangerous Combo: Fileless Malware and Cryptojacking"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2203.03175","kind":"arxiv","version":2},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:00b76c4dc93c49b208e681d786420a716c1d6ccdb00bca5e9ac36bfb2edae772","target":"record","created_at":"2026-07-05T04:03:16Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"8671f9358ce623b80e04d4817a8c136d66330ef0f32619b2ad0a8f6510cad009","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2022-03-07T07:03:43Z","title_canon_sha256":"2025e601b685e979b2853d6d37c10cea23fe2abeec6ebbab9312d82a6b865320"},"schema_version":"1.0","source":{"id":"2203.03175","kind":"arxiv","version":2}},"canonical_sha256":"9126e4cf570eb33738b9c40d04bcc05f6b828a26a9f644fd4826fda55edfa919","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"9126e4cf570eb33738b9c40d04bcc05f6b828a26a9f644fd4826fda55edfa919","first_computed_at":"2026-07-05T04:03:16.409280Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T04:03:16.409280Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"fzruIKf5aErED4YiuwxVGVaRH00ij+1jtN+MGEYSG4ewP/ckEGD/upptUb9zaCfus8ghK4Q8NIqXadx6wdbQBQ==","signature_status":"signed_v1","signed_at":"2026-07-05T04:03:16.409755Z","signed_message":"canonical_sha256_bytes"},"source_id":"2203.03175","source_kind":"arxiv","source_version":2}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:00b76c4dc93c49b208e681d786420a716c1d6ccdb00bca5e9ac36bfb2edae772","sha256:81668ee6cd4ea4f5ab16fbbb3e286f0ee5a0ff876218e58d434d20d6b691c661"],"state_sha256":"ea44e4ffc3b75269b025d8314c5a8401fe9834e0380f61b1dfb86942795e6337"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"kQp1UsjGhchhuIEqIhgbKh5++oKJ8zVcZm362xzv7gW1xx045+g8R2wjFUViUykBHmLt/mhc4S/gWLpxAj8mDg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-03T15:19:06.512607Z","bundle_sha256":"1dfe55343b3ce533e0f6bd63bdb56ae215f11e27f0f789c7fa26e774082d59b6"}}