{"id":18222,"date":"2022-02-08T07:10:13","date_gmt":"2022-02-08T15:10:13","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2022\/02\/08\/news-11955\/"},"modified":"2022-02-08T07:10:13","modified_gmt":"2022-02-08T15:10:13","slug":"news-11955","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2022\/02\/08\/news-11955\/","title":{"rendered":"&#8220;We absolutely do not care about you&#8221;: Sugar ransomware targets individuals"},"content":{"rendered":"<p><strong>Credit to Author: Jovi Umawing| Date: Tue, 08 Feb 2022 14:04:51 +0000<\/strong><\/p>\n<p>Ransomware tends to target organizations. Corporations not only house a trove of valuable data they can&#8217;t function without, but they are also expected to cough up a considerable amount of ransom money in exchange for their encrypted files. And while corporations struggle to keep up with attacks, ransomware groups have left the average consumer relatively untouched\u2014until now.<\/p>\n<p>Sugar ransomware, a new strain <a href=\"https:\/\/medium.com\/walmartglobaltech\/sugar-ransomware-a-new-raas-a5d94d58d9fb\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">recently discovered by the Walmart Security Team<\/a>, is a <a href=\"https:\/\/blog.malwarebytes.com\/glossary\/ransomware-as-a-service\/\">ransomware-as-a-service (RaaS)&nbsp;<\/a>that targets single computers and (likely) small businesses, too. Sugar, also known to many as Encoded01, has been in operation since November 2021.<\/p>\n<p>Bleeping Computer <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/a-look-at-the-new-sugar-ransomware-demanding-low-ransoms\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">notes<\/a> that the Walmart Security Team got the name &#8216;Sugar&#8217; from a site belonging to an affiliate of the ransomware operation: <code>sugarpanel.space<\/code>.<\/p>\n<p>As with many ransomware strains, the authors aren&#8217;t holding back in their note which is dropped onto the system as <code>BackFiles_encoded01.txt:<\/code><\/p>\n<pre class=\"wp-block-preformatted\">Whats Happen? [+]  Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension .encoded01. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).  [+] What guarantees? [+]  Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our] work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt 1-5 files for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money.  [+] How to get access on website? [+] You can open our site by the shortcut \"SUPPORT (TOR_BROWSER)\" created on the desktop. Also as the second option you can install the tor browser: a) Download and install TOR browser from this site: https:\/\/torproject.org\/ b) Open our website. Full link will be provided below.  ---------------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions- ints may entail damge of the private key and, as result, THE Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interest to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!! ---------------------------------------------------------------------------------------------- Your ID:  {redacted} <\/pre>\n<h2>How it works<\/h2>\n<p>Once executed, Sugar connects to two URLs,&nbsp;<em>whatismyipaddress.com<\/em>&nbsp;and&nbsp;<em>ip2location.com<\/em>, to identify the device&#8217;s IP address and geographic location. It then downloads a 76MB file, the use of which is currently unclear.<\/p>\n<p>Sugar then connects to its&nbsp;<a href=\"https:\/\/blog.malwarebytes.com\/glossary\/cc\/\">command &amp; control (C2)<\/a>&nbsp;server where it transmits and receives data related to its attack. It then encrypts files located in the below folders:<\/p>\n<ul>\n<li>boot<\/li>\n<li>DRIVERS<\/li>\n<li>PerfLogs<\/li>\n<li>temp<\/li>\n<li>windows<\/li>\n<\/ul>\n<p>However, it avoids the following files:<\/p>\n<ul>\n<li>.exe<\/li>\n<li>.dll<\/li>\n<li>.sys<\/li>\n<li>.lnk<\/li>\n<li>.bat<\/li>\n<li>.cmd<\/li>\n<li>.ttf<\/li>\n<li>.manifest<\/li>\n<li>.ttc<\/li>\n<li>.cat<\/li>\n<li>.msi;<\/li>\n<li>BOOTNXT<\/li>\n<li>bootmgr<\/li>\n<li>pagefile<\/li>\n<\/ul>\n<p>The files are encrypted using the SCOP encryption algorithm, a stream cipher&nbsp;<a href=\"https:\/\/groups.google.com\/g\/sci.crypt.research\/c\/ZD82NIacVmU\/m\/WDYm8_xmzTQJ\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">created in 1997 by Simeon Maltchev and Peter Antonov<\/a>&nbsp;for Pentium processors but also runs very fast on other 32-bit processors. Furthermore, modifying SCOP to create a cipher optimized for 64-bit processors, which most machines run nowadays, is easy, according to Maltchev&#8217;s research. This modification will double the cipher&#8217;s speed.<\/p>\n<p>Sugar is also called Encoded01 because this is the extension it appends to names of files it has encrypted. For example, after encoding a file called <code>1.jpg<\/code>, the resulting filename is now <code>1.jpg.encoded01<\/code>.<\/p>\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img decoding=\"async\" data-attachment-id=\"54194\" data-permalink=\"https:\/\/blog.malwarebytes.com\/ransomware\/2022\/02\/we-absolutely-do-not-care-about-you-sugar-ransomware-targets-individuals\/attachment\/mwb-sugar-encoded\/\" data-orig-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/MWB-sugar-encoded.png\" data-orig-size=\"500,368\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"MWB-sugar-encoded\" data-image-description=\"\" data-image-caption=\"\" data-medium-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/MWB-sugar-encoded-300x221.png\" data-large-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/MWB-sugar-encoded.png\" loading=\"lazy\" width=\"500\" height=\"368\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/MWB-sugar-encoded.png\" alt=\"\" class=\"wp-image-54194\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/MWB-sugar-encoded.png 500w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/MWB-sugar-encoded-300x221.png 300w\" sizes=\"auto, (max-width: 500px) 100vw, 500px\" \/><figcaption>Shot of Sugar-encrypted files (Courtesy of Marcelo Rivero)<\/figcaption><\/figure>\n<\/div>\n<p>The ransomware note points victims at a Tor site which contains a page with the amount they have to pay in Bitcoin, a chat feature they can use to negotiate with the cybercriminals, and an offer to have five files decrypted for free.<\/p>\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img decoding=\"async\" data-attachment-id=\"54196\" data-permalink=\"https:\/\/blog.malwarebytes.com\/ransomware\/2022\/02\/we-absolutely-do-not-care-about-you-sugar-ransomware-targets-individuals\/attachment\/mwb-sugar-tor-page\/\" data-orig-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/MWB-sugar-tor-page.png\" data-orig-size=\"950,525\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"MWB-sugar-tor-page\" data-image-description=\"\" data-image-caption=\"\" data-medium-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/MWB-sugar-tor-page-300x166.png\" data-large-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/MWB-sugar-tor-page-600x332.png\" loading=\"lazy\" width=\"600\" height=\"332\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/MWB-sugar-tor-page-600x332.png\" alt=\"\" class=\"wp-image-54196\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/MWB-sugar-tor-page-600x332.png 600w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/MWB-sugar-tor-page-300x166.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/MWB-sugar-tor-page.png 950w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><figcaption>Screenshot of a victim&#8217;s personal Tor ransom site (Courtesy of Marcelo Rivero)<\/figcaption><\/figure>\n<\/div>\n<p>According to <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/a-look-at-the-new-sugar-ransomware-demanding-low-ransoms\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">BleepingComputer<\/a>, the ransom amount is automatically generated based on the number of files Sugar successfully encrypts. The amount tends to be relatively affordable, usually a few hundred dollars, making it more likely that people will stump up the cash for their files.<\/p>\n<h2>Borrowed content<\/h2>\n<p>Several researchers have noted Sugar&#8217;s similarities with other ransomware families. The ransom note, for example, is reminiscent of REvil&#8217;s ransom note.<\/p>\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img decoding=\"async\" data-attachment-id=\"54197\" data-permalink=\"https:\/\/blog.malwarebytes.com\/ransomware\/2022\/02\/we-absolutely-do-not-care-about-you-sugar-ransomware-targets-individuals\/attachment\/sodi_rnote-1-600x516-1\/\" data-orig-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/Sodi_rnote-1-600x516-1.png\" data-orig-size=\"600,516\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"Sodi_rnote-1-600&#215;516-1\" data-image-description=\"\" data-image-caption=\"\" data-medium-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/Sodi_rnote-1-600x516-1-300x258.png\" data-large-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/Sodi_rnote-1-600x516-1.png\" loading=\"lazy\" width=\"600\" height=\"516\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/Sodi_rnote-1-600x516-1.png\" alt=\"\" class=\"wp-image-54197\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/Sodi_rnote-1-600x516-1.png 600w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/Sodi_rnote-1-600x516-1-300x258.png 300w\" sizes=\"auto, (max-width: 600px) 100vw, 600px\" \/><figcaption>REvil&#8217;s ransom note (Source: Malwarebytes)<\/figcaption><\/figure>\n<\/div>\n<p>The Tor site the victim sees, on the other hand, is a lookalike of the page Cl0p used in its attacks.<\/p>\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img decoding=\"async\" data-attachment-id=\"54198\" data-permalink=\"https:\/\/blog.malwarebytes.com\/ransomware\/2022\/02\/we-absolutely-do-not-care-about-you-sugar-ransomware-targets-individuals\/attachment\/walmart-cl0p\/\" data-orig-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/walmart-cl0p.png\" data-orig-size=\"495,279\" data-comments-opened=\"1\" data-image-meta=\"{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}\" data-image-title=\"walmart-cl0p\" data-image-description=\"\" data-image-caption=\"\" data-medium-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/walmart-cl0p-300x169.png\" data-large-file=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/walmart-cl0p.png\" loading=\"lazy\" width=\"495\" height=\"279\" src=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/walmart-cl0p.png\" alt=\"\" class=\"wp-image-54198\" srcset=\"https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/walmart-cl0p.png 495w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/walmart-cl0p-300x169.png 300w, https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/walmart-cl0p-400x225.png 400w\" sizes=\"auto, (max-width: 495px) 100vw, 495px\" \/><figcaption>Cl0p&#8217;s Tor site to their victims (Source: Walmart Security Team)<\/figcaption><\/figure>\n<\/div>\n<h2>How to protect yourself from ransomware<\/h2>\n<p>We don&#8217;t know yet how Sugar lands onto systems. So, as ever, we should continue to remain vigilant whatever we do online.<\/p>\n<ul>\n<li>Keep your system up to date. Cybercriminals take advantage of known vulnerabilities to infect computers. Make sure you apply patches as soon as they&#8217;re available, whether they&#8217;re for your operating system, your apps, or your browser.<\/li>\n<li><a href=\"https:\/\/blog.malwarebytes.com\/malwarebytes-news\/2021\/10\/ransomware-why-do-backups-fail-when-you-need-them-most\/\">Back up your files<\/a>. If you get infected with ransomware, you&#8217;re going to want to get hold of those backups. Make sure you back up offline to somewhere the attackers can&#8217;t reach.<\/li>\n<li>Don&#8217;t reuse your passwords, and make sure to choose strong ones for each account. Password managers can help with this.<\/li>\n<li>Be careful of unsolicited messages on social media, emails, online games, or anywhere else. Never click on a link sent in the message, and never enable macros in documents sent to you this way.<\/li>\n<li>Make sure all computers are protected with security protection. (<a href=\"https:\/\/www.malwarebytes.com\/for-home\/products\">Malwarebytes<\/a> can help with this.)<\/li>\n<\/ul>\n<p>Stay safe!<\/p>\n<p>The post <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\/ransomware\/2022\/02\/we-absolutely-do-not-care-about-you-sugar-ransomware-targets-individuals\/\">&#8220;We absolutely do not care about you&#8221;: Sugar ransomware targets individuals<\/a> appeared first on <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\">Malwarebytes Labs<\/a>.<\/p>\n<p><a href=\"https:\/\/blog.malwarebytes.com\/ransomware\/2022\/02\/we-absolutely-do-not-care-about-you-sugar-ransomware-targets-individuals\/\" target=\"bwo\" >https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p><strong>Credit to Author: Jovi Umawing| Date: Tue, 08 Feb 2022 14:04:51 +0000<\/strong><\/p>\n<table cellpadding='10'>\n<tr>\n<td valign='top' align='center'><a href='https:\/\/blog.malwarebytes.com\/ransomware\/2022\/02\/we-absolutely-do-not-care-about-you-sugar-ransomware-targets-individuals\/' title='\"We absolutely do not care about you\": Sugar ransomware targets individuals'><img src='https:\/\/blog.malwarebytes.com\/wp-content\/uploads\/2022\/02\/GettyImages-1253229585.jpg' border='0'  width='300px'  \/><\/a><\/td>\n<\/tr>\n<tr>\n<td valign='top' align='left'>They call it Sugar ransomware, but it&#8217;s not sweet in any way.<\/p>\n<p>Categories: <a href=\"https:\/\/blog.malwarebytes.com\/category\/ransomware\/\" rel=\"category tag\">Ransomware<\/a><\/p>\n<p>Tags: <a href=\"https:\/\/blog.malwarebytes.com\/tag\/cl0p\/\" rel=\"tag\">Cl0p<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/cl0p-ransomware\/\" rel=\"tag\">Cl0P ransomware<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/encoded01\/\" rel=\"tag\">Encoded01<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/encoded01-ransomware\/\" rel=\"tag\">Encoded01 ransomware<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/marcelo-rivero\/\" rel=\"tag\">Marcelo Rivero<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/peter-antonov\/\" rel=\"tag\">Peter Antonov<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/ransomware\/\" rel=\"tag\">ransomware<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/revil\/\" rel=\"tag\">revil<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/revil-ransomware\/\" rel=\"tag\">REvil ransomware<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/scop-encryption-algorithm\/\" rel=\"tag\">SCOP encryption algorithm<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/simeon-maltchev\/\" rel=\"tag\">Simeon Maltchev<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/stream-cipher\/\" rel=\"tag\">stream cipher<\/a><a href=\"https:\/\/blog.malwarebytes.com\/tag\/sugar-ransomware\/\" rel=\"tag\">Sugar ransomware<\/a><\/p>\n<table width='100%'>\n<tr>\n<td align=right>\n<p><b>(<a href='https:\/\/blog.malwarebytes.com\/ransomware\/2022\/02\/we-absolutely-do-not-care-about-you-sugar-ransomware-targets-individuals\/' title='\"We absolutely do not care about you\": Sugar ransomware targets individuals'>Read more&#8230;<\/a>)<\/b><\/p>\n<\/td>\n<\/tr>\n<\/table>\n<\/td>\n<\/tr>\n<\/table>\n<p>The post <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\/ransomware\/2022\/02\/we-absolutely-do-not-care-about-you-sugar-ransomware-targets-individuals\/\">&#8220;We absolutely do not care about you&#8221;: Sugar ransomware targets individuals<\/a> appeared first on <a rel=\"nofollow\" href=\"https:\/\/blog.malwarebytes.com\">Malwarebytes Labs<\/a>.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10488,10378],"tags":[24873,24874,24875,24876,12934,24877,3765,22297,24878,24879,24880,24881,24882],"class_list":["post-18222","post","type-post","status-publish","format-standard","hentry","category-malwarebytes","category-security","tag-cl0p","tag-cl0p-ransomware","tag-encoded01","tag-encoded01-ransomware","tag-marcelo-rivero","tag-peter-antonov","tag-ransomware","tag-revil","tag-revil-ransomware","tag-scop-encryption-algorithm","tag-simeon-maltchev","tag-stream-cipher","tag-sugar-ransomware"],"_links":{"self":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/18222","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=18222"}],"version-history":[{"count":0,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/18222\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=18222"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=18222"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=18222"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}