IOC Bulletin - DarkSide Campaign:
Network Indicators:
- 192.165.211.198
- 10.120.107.20
- 208.237.179.30
- mailrelay.link
- cloud-secure.xyz
URLs:
- https://gateway-update.dev/api/v2/auth
- https://storageupdate.org/api/v2/auth
Email Senders:
- helpdesk@phishing-domain.com
- support@credential-check.site
File Indicators:
- SHA256: dfb1915e383c3ff3b8ff043e0869d55f397a9fac03ecb6963c95f9cbb9da1d11
- SHA1: 632b5fcc182fe43e9621d3fcb46d85b4136d101e
- Drop path: C:\Program Files\Common Files\beacon.dll


IOC Bulletin - AgentTesla Campaign:
Network Indicators:
- 84.174.173.244
- 192.173.49.78
- 12.151.224.46
- portal-gateway.cc
- portallogin.online
URLs:
- hxxps://storageauth.io/portal/verify
- hxxp://cdn-backup.link/admin/config
Email Senders:
- confirm@mail-service.info
- ceo@phishing-domain.com
File Indicators:
- SHA256: 9440ba3edf5b3390613c179299461272f259412aeab57ee8ba8f101b69cf9d84
- SHA1: 6e3179959ea843208ac96e8fbee9db114307df65
- Drop path: /usr/local/bin/lsass.dmp


IOC Bulletin - LockBit Campaign:
Network Indicators:
- 172.197.133.170
- 172.103.146.28
- 201.193.229.66
- relay-edge.dev
- cachenode.club
URLs:
- hxxps://relaysync.cc/api/v2/auth
- hxxp://portal-gateway.online/callback
Email Senders:
- finance@secure-verify.net
- account@credential-check.site
File Indicators:
- SHA1: 69d5106c76d9e5adcb1642f7f64fd98eb2d6ca3f
- MD5: 6c882e4fb7d3a25b8f7d63ce3afc95b6
- Drop path: /var/tmp/shell.php


IOC Bulletin - PlugX Campaign:
Network Indicators:
- 56.232.242.14
- 10.142.108.225
- 172.136.182.174
- sync-data.dev
- edgeupdate.info
URLs:
- hxxp://cdnproxy.top/callback
- http://apinode.live/secure/token
Email Senders:
- service@document-share.link
- security@identity-verify.cc
File Indicators:
- MD5: bc24f36c03e01f9f80578817e81957e3
- SHA256: d5acfa97c7acb53dcc1b0ab551b5f133e2b575284dafcbd81613d084608d11ad
- Drop path: C:\Windows\System32\update.dll


IOC Bulletin - Play Campaign:
Network Indicators:
- 172.106.175.199
- 31.72.186.100
- 48.37.79.219
- update-update.io
- relaynode.live
URLs:
- https://mail-data.org/download/update.exe
- hxxps://portalportal.com/collect
Email Senders:
- confirm@phishing-domain.com
- ceo@credential-check.site
File Indicators:
- SHA1: b84fe35e65346699b2f5359604602bbeecb06fe7
- MD5: 99661b1b8e3d254323eb0c86d886d658
- Drop path: /tmp/ntds.dit


IOC Bulletin - StealC Campaign:
Network Indicators:
- 192.105.15.52
- 19.125.207.87
- 10.165.222.188
- staticstatic.live
- relayupdate.club
URLs:
- https://cdnupdate.online/callback
- http://sync-data.xyz/login
Email Senders:
- support@mail-service.info
- notification@secure-verify.net
File Indicators:
- MD5: 28f8f6f55196d13d79552700a9a2959a
- SHA256: f6847a0dbed71b6c728a3eb3fcbb9112a58131cf6dc4ed99296c03166e27f4f3
- Drop path: /dev/shm/agent.py


IOC Bulletin - Gootloader Campaign:
Network Indicators:
- 172.224.42.170
- 62.234.223.48
- 172.244.250.205
- updatestorage.info
- nodegateway.site
URLs:
- http://backup-edge.club/portal/verify
- https://sync-secure.online/wp-content/uploads/doc.php
Email Senders:
- info@mail-service.info
- alert@document-share.link
File Indicators:
- SHA256: 6f0eec3b56e615ce6c2c3b2e641ae5c508b67bd12ba90a503ab2ab2d91a145d5
- SHA1: face70133b9a466129224ca195fa53c9e3f4c8a1
- Drop path: /dev/shm/config.dat


IOC Bulletin - FormBook Campaign:
Network Indicators:
- 192.132.88.22
- 10.104.112.148
- 10.160.12.4
- authcloud.live
- update-backup.club
URLs:
- http://mailgateway.online/api/v2/auth
- http://syncauth.club/admin/config
Email Senders:
- service@identity-verify.cc
- admin@mail-service.info
File Indicators:
- MD5: 5c77fb3c6ffa667e66e610c7eee271a4
- SHA1: 2c292a41f640b16c4934e115a8493109dcc83cfe
- Drop path: /opt/app/bin/ntds.dit


IOC Bulletin - Latrodectus Campaign:
Network Indicators:
- 192.43.50.103
- 95.225.205.126
- 193.204.190.210
- gatewayportal.site
- proxyportal.com
URLs:
- https://update-node.top/admin/config
- https://cache-gateway.info/secure/token
Email Senders:
- security@secure-verify.net
- verify@auth-check.org
File Indicators:
- SHA1: 1a69fa1df9c84cd5c8854e75f7b92a8da68083da
- MD5: 2ef6bc7ac3d5b6d1862ed6a1320e4b96
- Drop path: C:\Users\admin\AppData\Local\Temp\agent.py


IOC Bulletin - DanaBot Campaign:
Network Indicators:
- 136.68.249.37
- 93.153.141.37
- 10.220.39.176
- cdngateway.dev
- static-edge.online
URLs:
- http://synccdn.com/gate.php
- http://backup-gateway.live/wp-content/uploads/doc.php
Email Senders:
- notification@phishing-domain.com
- helpdesk@account-update.xyz
File Indicators:
- SHA1: a775d55e113fbf45d0c1c23024b33e1b8d311a62
- SHA256: 29840b734af86993d19545d75a2a799d62e27c2eebba15a8ca0b8eb4d599822a
- Drop path: C:\ProgramData\backdoor.elf


IOC Bulletin - BumbleBee Campaign:
Network Indicators:
- 10.45.97.146
- 10.10.40.28
- 192.134.10.103
- syncnode.io
- storagenode.online
URLs:
- http://backup-mail.org/api/v2/auth
- http://apisync.xyz/collect
Email Senders:
- updates@mail-service.info
- it@credential-check.site
File Indicators:
- MD5: fff247031ec7bd8e09b2bdfeed816ee2
- MD5: 58fffedd9d9f1a954694d4d13470f228
- Drop path: /tmp/winlogon.exe


IOC Bulletin - IcedID Campaign:
Network Indicators:
- 147.102.233.183
- 192.123.168.90
- 109.221.126.169
- edge-cache.tech
- syncapi.online
URLs:
- hxxps://storage-portal.dev/assets/js/payload.js
- hxxps://static-static.club/assets/js/payload.js
Email Senders:
- contact@account-update.xyz
- hr@identity-verify.cc
File Indicators:
- SHA1: c1f5adb3899ea694523d44b79e7bf6787a8dd5e3
- SHA1: de427e1805919c3cb7968b63461be6a6d3368e89
- Drop path: /home/user/.config/beacon.dll


IOC Bulletin - FormBook Campaign:
Network Indicators:
- 192.100.201.206
- 36.220.185.215
- 172.234.97.112
- cachestatic.dev
- api-update.org
URLs:
- https://static-cdn.top/assets/js/payload.js
- http://update-cloud.io/download/update.exe
Email Senders:
- alert@account-update.xyz
- alert@auth-check.org
File Indicators:
- SHA1: 23dc382b600a69f4ef7bcb10b99a5ac3b6e8a490
- MD5: c3318098c6d5d76e6febb40abef2dc59
- Drop path: C:\ProgramData\shell.php


IOC Bulletin - Cobalt Strike Campaign:
Network Indicators:
- 91.195.87.212
- 209.138.213.177
- 10.18.48.101
- gatewaygateway.xyz
- static-cloud.top
URLs:
- hxxp://backup-cloud.club/callback
- hxxps://storage-data.top/portal/verify
Email Senders:
- admin@login-portal.tech
- support@credential-check.site
File Indicators:
- MD5: 279c48cae6018507b8e5ecb11bfaad97
- SHA256: 6f8f4d12afc7289095d1e60ddd0a81879c035579ac89e0d3bd33181892fe944f
- Drop path: /opt/app/bin/winlogon.exe


IOC Bulletin - StealC Campaign:
Network Indicators:
- 17.140.81.16
- 172.152.97.193
- 13.249.143.95
- static-cloud.club
- secure-node.com
URLs:
- https://updatelogin.info/login
- hxxps://cloudapi.com/gate.php
Email Senders:
- verify@secure-verify.net
- confirm@account-update.xyz
File Indicators:
- SHA1: e1949bd3ca1e16e2a6775a72f4314eef026229f9
- SHA1: c6cb01fffb5ed69a480cef383a7a25570ef39aa8
- Drop path: /var/tmp/winlogon.exe


IOC Bulletin - BumbleBee Campaign:
Network Indicators:
- 172.243.112.126
- 91.175.131.113
- 17.224.65.114
- proxydata.tech
- backupedge.dev
URLs:
- http://authsecure.dev/callback
- hxxp://authstorage.dev/collect
Email Senders:
- billing@document-share.link
- noreply@document-share.link
File Indicators:
- SHA256: 67778e4a7cc0aa37fc999dcd453d3acc97e4263a659a45f4536a2dc088581cb5
- MD5: 0957fcf13fb365823854fec6542ee5b4
- Drop path: /usr/local/bin/config.dat


IOC Bulletin - ShadowPad Campaign:
Network Indicators:
- 10.35.177.16
- 10.130.113.163
- 192.25.223.41
- staticedge.cc
- nodesecure.dev
URLs:
- hxxps://cloudcloud.club/download/update.exe
- hxxps://data-relay.dev/assets/js/payload.js
Email Senders:
- report@secure-verify.net
- noreply@credential-check.site
File Indicators:
- MD5: 49d14e4d50023123f0c4b8306a759d39
- MD5: 98d302927c57a256df6cd7d7d6a49cc3
- Drop path: /etc/cron.d/implant.so


IOC Bulletin - BumbleBee Campaign:
Network Indicators:
- 81.236.44.243
- 206.92.43.203
- 172.95.90.9
- storagestatic.net
- update-sync.live
URLs:
- https://synccloud.site/portal/verify
- http://cloudsecure.club/collect
Email Senders:
- info@mail-service.info
- noreply@account-update.xyz
File Indicators:
- MD5: df51b52f73b1801c9eba8bb2be452606
- SHA256: 69a0dd5abe8c25ba6ce737f39bbbcf61cac216ceffe1582f6c7beb586a0d22a9
- Drop path: C:\Windows\Temp\update.dll


IOC Bulletin - ShadowPad Campaign:
Network Indicators:
- 10.226.203.184
- 172.80.236.131
- 192.228.163.172
- authcdn.cc
- cloud-edge.link
URLs:
- hxxps://update-cdn.cc/login
- http://cloudlogin.tech/admin/config
Email Senders:
- verify@credential-check.site
- ceo@mail-service.info
File Indicators:
- MD5: 60c186c997456d0731f863b38a7d49df
- SHA256: 04193e805bde2c1493840fc7ee018e5a1dd4dd47d395b1b0cf6746b27c9ed327
- Drop path: C:\Users\admin\Desktop\csrss.exe


IOC Bulletin - Latrodectus Campaign:
Network Indicators:
- 31.245.84.142
- 119.14.123.75
- 206.215.110.57
- backup-portal.tech
- nodebackup.live
URLs:
- hxxps://gatewaycloud.tech/gate.php
- hxxps://proxycloud.tech/panel/index.html
Email Senders:
- it@secure-verify.net
- verify@identity-verify.cc
File Indicators:
- SHA256: d063c90e7ef193b8c61289d09a0ee89e4b43cf96445f2d3acc1ef13622274e2c
- MD5: aa0a99368152f0ad455c2ffcbd4b3a6f
- Drop path: C:\Users\admin\Desktop\csrss.exe


IOC Bulletin - DanaBot Campaign:
Network Indicators:
- 149.209.167.203
- 4.21.117.181
- 172.161.78.47
- syncnode.info
- api-update.cc
URLs:
- https://storage-api.club/secure/token
- https://proxycache.top/assets/js/payload.js
Email Senders:
- billing@credential-check.site
- noreply@login-portal.tech
File Indicators:
- SHA256: 1a2830e238308a60105a18eb6044adf951b50b0d26a502e1a30346d10cf28ba0
- SHA256: b09fb144eaa11e697fd61317e005b2f773f8f9d16b327d844ecbc0a147dc8586
- Drop path: /dev/shm/lsass.dmp


IOC Bulletin - FormBook Campaign:
Network Indicators:
- 172.35.145.37
- 79.109.29.48
- 12.39.112.203
- loginsecure.cc
- auth-update.cc
URLs:
- hxxp://backup-cloud.cc/download/update.exe
- https://cdnapi.club/collect
Email Senders:
- service@account-update.xyz
- confirm@mail-service.info
File Indicators:
- SHA256: 3b6acba67c49e178c68b1ec790613042c3d4bc9933ffa4870c1751586af1e2d0
- MD5: 0f079b049ef800e02a67fc222cb36ee5
- Drop path: C:\Windows\Temp\sam.hive


IOC Bulletin - XLoader Campaign:
Network Indicators:
- 51.27.239.138
- 192.150.255.104
- 176.12.25.244
- nodelogin.info
- portalgateway.site
URLs:
- hxxps://edgedata.site/admin/config
- hxxp://cloudnode.site/admin/config
Email Senders:
- it@phishing-domain.com
- account@auth-check.org
File Indicators:
- MD5: c58850cc770528f4fa883b59e8cfda55
- SHA1: 07ea732840713e55a5462ce05861a31b264090ef
- Drop path: /opt/app/bin/shell.php


IOC Bulletin - DarkSide Campaign:
Network Indicators:
- 202.218.84.147
- 203.94.193.98
- 10.73.167.115
- proxy-data.top
- gatewayedge.live
URLs:
- https://proxy-cdn.club/gate.php
- https://cloud-data.info/callback
Email Senders:
- contact@identity-verify.cc
- alert@phishing-domain.com
File Indicators:
- SHA1: c60b0b49fa71b2818e9895b6561c4d5aee6f3c67
- SHA1: 6aae40c1d8adc5d1c55382a063af98350c61fa1e
- Drop path: /etc/cron.d/taskhost.exe


IOC Bulletin - AsyncRAT Campaign:
Network Indicators:
- 23.24.193.223
- 44.197.241.242
- 172.128.130.228
- data-static.tech
- node-gateway.cc
URLs:
- https://apidata.top/portal/verify
- hxxp://edge-edge.xyz/api/v2/auth
Email Senders:
- confirm@login-portal.tech
- confirm@phishing-domain.com
File Indicators:
- SHA1: cc438674a980b1c2667a930be4caea0bd75d4bd2
- MD5: aac50b087c533fa0444c58229edba82e
- Drop path: C:\Users\Public\Documents\lsass.dmp


IOC Bulletin - Lumma Stealer Campaign:
Network Indicators:
- 172.240.215.150
- 10.104.252.248
- 155.126.1.24
- secure-update.net
- cloudauth.io
URLs:
- hxxps://update-login.xyz/secure/token
- hxxp://cloud-api.dev/wp-content/uploads/doc.php
Email Senders:
- service@login-portal.tech
- info@mail-service.info
File Indicators:
- MD5: 40e0d120d6e188c5c0d9ea83a23b5e6a
- SHA256: 2c9d196410573193e1d369fc6ed96f2b9fcc512066a63ffac0e293df05becce1
- Drop path: C:\Windows\Temp\shell.php


IOC Bulletin - Latrodectus Campaign:
Network Indicators:
- 10.85.248.12
- 10.62.218.124
- 10.57.93.160
- staticupdate.dev
- auth-relay.online
URLs:
- hxxps://cacheupdate.com/assets/js/payload.js
- http://cache-api.online/secure/token
Email Senders:
- billing@account-update.xyz
- finance@mail-service.info
File Indicators:
- SHA1: 3af38fa6956c4e65d18a6827eafa577ea98a2013
- MD5: c9571d12f4364371cd624c01015611c7
- Drop path: /var/tmp/backdoor.elf


IOC Bulletin - Royal Campaign:
Network Indicators:
- 30.190.37.81
- 185.252.155.112
- 10.238.29.230
- updatelogin.online
- edge-secure.dev
URLs:
- hxxps://cdn-static.xyz/panel/index.html
- hxxps://backup-cache.top/download/update.exe
Email Senders:
- billing@account-update.xyz
- alert@identity-verify.cc
File Indicators:
- SHA256: 1e99f50449c41e61bf3df4650bd7bdd3a117cbc353206190587a06f1715d389a
- MD5: 8a3f8060a00ae84c88535c25fcdcc9a8
- Drop path: C:\Windows\Temp\svchost.exe


IOC Bulletin - RedLine Stealer Campaign:
Network Indicators:
- 10.135.38.140
- 10.179.95.183
- 99.82.184.38
- secure-api.xyz
- auth-gateway.online
URLs:
- hxxp://securenode.dev/download/update.exe
- hxxps://proxyupdate.net/callback
Email Senders:
- updates@urgent-notice.online
- alert@secure-verify.net
File Indicators:
- SHA1: b4bbff27cbeef0ca0ca2637799972820e3572c06
- MD5: 606bb0202afe86276cb24369610ec191
- Drop path: C:\Program Files\Common Files\sam.hive


IOC Bulletin - WarmCookie Campaign:
Network Indicators:
- 189.69.3.46
- 25.170.96.130
- 66.86.221.114
- update-secure.org
- static-cache.info
URLs:
- hxxps://cloudupdate.info/secure/token
- https://api-static.io/api/v2/auth
Email Senders:
- support@auth-check.org
- admin@credential-check.site
File Indicators:
- SHA256: 22d153d3c1bc2cef017f4210f70b21b5e73c891d565aaf2ea05f346a2bfdaf16
- MD5: fbb667b197451022c562843de98b9f5d
- Drop path: /opt/app/bin/winlogon.exe


IOC Bulletin - Emotet Campaign:
Network Indicators:
- 129.163.83.141
- 106.250.228.16
- 172.128.223.116
- cdnupdate.io
- update-relay.site
URLs:
- hxxp://cdnstorage.dev/secure/token
- hxxp://updateapi.online/gate.php
Email Senders:
- security@credential-check.site
- report@credential-check.site
File Indicators:
- MD5: 2cc4a6023a3b1083daeb0706d763b66b
- SHA1: 0125658267cb1a9b9c25e4075994d42383dba0d9
- Drop path: /var/tmp/payload.bin


IOC Bulletin - Latrodectus Campaign:
Network Indicators:
- 192.13.60.217
- 10.5.184.28
- 10.32.98.66
- gateway-cloud.live
- edgeupdate.net
URLs:
- https://mail-update.org/login
- http://storageapi.net/admin/config
Email Senders:
- hr@credential-check.site
- info@secure-verify.net
File Indicators:
- SHA1: f92e0166e87c9064bdefb5c7eb357fc6fcc4867b
- SHA1: da33a7648a5e1b694edcd890b52c7bdb9be3dc4e
- Drop path: C:\Windows\Tasks\update.dll


IOC Bulletin - Vidar Campaign:
Network Indicators:
- 139.180.225.146
- 131.207.99.162
- 10.130.28.115
- backup-backup.io
- data-edge.top
URLs:
- https://auth-auth.link/secure/token
- http://proxyportal.online/callback
Email Senders:
- info@document-share.link
- ceo@account-update.xyz
File Indicators:
- SHA1: 9ac06ce6d73407ad1bf6bc321fe5998e13a076ac
- SHA256: e667d610d13e603d571e1bdb31395c30fbd308a95dce909716b1f31555881036
- Drop path: /usr/local/bin/shell.php


IOC Bulletin - Vidar Campaign:
Network Indicators:
- 10.247.19.146
- 10.230.216.79
- 20.247.238.195
- login-login.top
- edge-update.info
URLs:
- hxxp://backup-relay.io/gate.php
- hxxp://loginstorage.live/assets/js/payload.js
Email Senders:
- noreply@phishing-domain.com
- report@auth-check.org
File Indicators:
- SHA1: 988831c8980abdf6e5fe8c0421575ffdba5a5893
- MD5: 7d59ef93027fadaa5f6407ea17cc3db5
- Drop path: C:\Users\admin\Downloads\dropper.ps1


IOC Bulletin - SystemBC Campaign:
Network Indicators:
- 201.120.184.182
- 45.234.87.159
- 10.173.241.229
- secure-sync.com
- cache-node.site
URLs:
- http://static-node.info/portal/verify
- http://synclogin.top/wp-content/uploads/doc.php
Email Senders:
- notification@urgent-notice.online
- helpdesk@auth-check.org
File Indicators:
- SHA1: f0fbf39e7c2e6911cafb7689ddde128ebb075953
- MD5: 7aec4ec51ae460a3260d45f1915d37b6
- Drop path: C:\Users\admin\Desktop\csrss.exe


IOC Bulletin - BlackCat Campaign:
Network Indicators:
- 192.39.213.170
- 104.85.79.122
- 172.115.120.220
- updateportal.top
- cdn-auth.site
URLs:
- https://sync-cdn.net/assets/js/payload.js
- hxxp://api-mail.site/portal/verify
Email Senders:
- ceo@account-update.xyz
- contact@login-portal.tech
File Indicators:
- MD5: a684c5433c11d14954d4738083f4b211
- SHA256: 7323c26776121d940e08f91469b64175c8ab98803e0a3fd3b9fbfc3f073502d4
- Drop path: C:\Users\admin\Desktop\config.dat


IOC Bulletin - PikaBot Campaign:
Network Indicators:
- 47.111.99.94
- 9.145.141.69
- 93.60.156.53
- backuplogin.net
- auth-relay.tech
URLs:
- http://backupcache.tech/admin/config
- https://secureapi.top/download/update.exe
Email Senders:
- finance@identity-verify.cc
- helpdesk@urgent-notice.online
File Indicators:
- MD5: 7340e50df65a8e311be839b32ccad3ce
- SHA1: cda5963b28aecea57a6ead9900f3590cb44505b8
- Drop path: C:\Users\Public\Documents\csrss.exe


IOC Bulletin - IcedID Campaign:
Network Indicators:
- 192.56.62.251
- 70.251.88.231
- 170.198.147.46
- securesync.online
- storage-cloud.top
URLs:
- hxxps://mailcache.link/secure/token
- https://update-cdn.online/api/v2/auth
Email Senders:
- hr@auth-check.org
- info@urgent-notice.online
File Indicators:
- SHA1: 64c42dce271af80efb79ad71bd787fbb1939b16d
- SHA1: c8304404a396ad1cb9347181599ef02186411074
- Drop path: /var/tmp/backdoor.elf


IOC Bulletin - Amadey Campaign:
Network Indicators:
- 192.120.24.87
- 209.87.133.84
- 10.13.46.36
- portalbackup.dev
- proxy-edge.top
URLs:
- hxxps://backup-cloud.club/admin/config
- http://sync-gateway.com/callback
Email Senders:
- notification@identity-verify.cc
- alert@phishing-domain.com
File Indicators:
- SHA1: 16a5dda976f7d1ec45c5fbab15c47ea8c9a32ea9
- MD5: 6b16b202e24b1f53b19d58211fa3b529
- Drop path: C:\Users\admin\Desktop\implant.so


IOC Bulletin - FormBook Campaign:
Network Indicators:
- 192.228.158.156
- 10.32.251.154
- 172.173.4.109
- sync-relay.net
- cacheupdate.net
URLs:
- hxxp://updatelogin.club/api/v2/auth
- https://cdnupdate.dev/login
Email Senders:
- security@credential-check.site
- security@urgent-notice.online
File Indicators:
- SHA256: 2cf3367a5509d881aa6bc8ba5dfda4470e4826255f7edfac34abd382ea8e862a
- SHA256: 98d066c45682520c9fb75ade51c7f5d635371c31443e12ef26b79bf95fa4c20f
- Drop path: C:\Program Files\Common Files\loader.exe


IOC Bulletin - Play Campaign:
Network Indicators:
- 10.88.30.142
- 21.135.151.37
- 10.236.202.196
- staticstatic.live
- nodesync.org
URLs:
- https://backup-api.info/download/update.exe
- http://portalupdate.top/wp-content/uploads/doc.php
Email Senders:
- verify@account-update.xyz
- helpdesk@urgent-notice.online
File Indicators:
- SHA256: 98cabf56849253fd02c371721e26a682bcbf43ef5b2dc030647918a9a3ad3fc4
- SHA256: 1938c214fc8694b8c5d96a5a719dc48524c4f229cbe0b239844c7bf809a145ab
- Drop path: C:\Program Files\Common Files\chrome_helper.exe


IOC Bulletin - AgentTesla Campaign:
Network Indicators:
- 44.164.139.117
- 169.240.223.55
- 180.87.117.8
- storageproxy.online
- staticedge.live
URLs:
- https://gatewayupdate.online/assets/js/payload.js
- hxxp://cdn-mail.cc/collect
Email Senders:
- hr@urgent-notice.online
- alert@auth-check.org
File Indicators:
- SHA256: a49f1f0aaaf90902f06fe9ed8c026ba75825b82a96e345478dc899845a47d5d5
- MD5: 8c7e26c5c1a52d2d98da90cc292fea46
- Drop path: C:\Windows\Temp\backdoor.elf


IOC Bulletin - Play Campaign:
Network Indicators:
- 10.174.222.190
- 10.182.209.159
- 109.7.214.55
- backuprelay.dev
- updateproxy.tech
URLs:
- https://cdn-api.io/download/update.exe
- https://securelogin.site/admin/config
Email Senders:
- finance@secure-verify.net
- account@phishing-domain.com
File Indicators:
- SHA256: 989f8db33b493973b4143a9847f8f1feaa9feb2aa844d64c98e02b8460e45ce2
- SHA256: 1f79b6c475a8b6264c38419a0b5047b1a74bd54abc60da3dabde317b09f3b527
- Drop path: C:\Windows\System32\backdoor.elf


IOC Bulletin - AgentTesla Campaign:
Network Indicators:
- 16.178.119.83
- 96.123.172.41
- 165.125.240.198
- cachestorage.com
- gatewaymail.link
URLs:
- https://proxy-sync.io/assets/js/payload.js
- hxxp://storage-api.org/secure/token
Email Senders:
- confirm@mail-service.info
- contact@credential-check.site
File Indicators:
- MD5: 841eace060d62ecc8481450275c640cc
- MD5: d90fed3c2ae0c3c1ad0bc46d552c5ba0
- Drop path: C:\Users\admin\AppData\Local\Temp\chrome_helper.exe


IOC Bulletin - Qbot Campaign:
Network Indicators:
- 198.86.80.219
- 151.89.140.145
- 84.82.107.202
- proxysync.top
- login-cdn.live
URLs:
- hxxps://synccdn.online/login
- hxxps://apistorage.cc/download/update.exe
Email Senders:
- finance@account-update.xyz
- contact@document-share.link
File Indicators:
- SHA256: 6f3229bcedc97881aedb5e037f951f137189732eb7d4e559ef7ccc558e158f85
- SHA1: 273b7b83f3593d2c35b90c9c6c451e51c981ef61
- Drop path: /opt/app/bin/beacon.dll


IOC Bulletin - RemcosRAT Campaign:
Network Indicators:
- 192.174.35.182
- 192.246.192.181
- 172.82.145.107
- backup-login.club
- secureupdate.info
URLs:
- hxxp://loginupdate.site/wp-content/uploads/doc.php
- http://gatewayapi.net/panel/index.html
Email Senders:
- verify@login-portal.tech
- updates@account-update.xyz
File Indicators:
- SHA256: 358c3b3fdb9b39b987052c0916bce1e09d32012ba9cca92ad694a80bd24f87e2
- SHA1: 8d1e8918e2c323b9814ea59555065674e74267e0
- Drop path: C:\Users\admin\Downloads\lsass.dmp


IOC Bulletin - AgentTesla Campaign:
Network Indicators:
- 192.111.21.74
- 192.33.246.22
- 13.125.103.253
- cdn-node.live
- backupbackup.net
URLs:
- http://datagateway.top/login
- hxxp://update-static.dev/api/v2/auth
Email Senders:
- helpdesk@credential-check.site
- confirm@urgent-notice.online
File Indicators:
- SHA1: a34df86b79e3d5ec2224784e6b919ae3d30b41f2
- SHA1: 6bf5878fe08df0b69c68cb7f085524568d1041bd
- Drop path: C:\Users\admin\AppData\Local\Temp\config.dat


IOC Bulletin - IcedID Campaign:
Network Indicators:
- 192.123.212.125
- 128.234.237.117
- 172.175.233.97
- mailmail.info
- staticcdn.xyz
URLs:
- https://static-storage.link/wp-content/uploads/doc.php
- hxxps://authauth.dev/download/update.exe
Email Senders:
- service@document-share.link
- billing@document-share.link
File Indicators:
- MD5: c20ee49afe74aa2ff060cebbabbaca7a
- SHA1: 8a85ee193e4a86f9675425d2670695d602a1691a
- Drop path: /opt/app/bin/csrss.exe


IOC Bulletin - Royal Campaign:
Network Indicators:
- 10.69.98.177
- 10.42.105.94
- 172.161.172.192
- relay-update.org
- syncupdate.site
URLs:
- hxxps://portal-relay.info/secure/token
- http://backup-backup.live/callback
Email Senders:
- security@secure-verify.net
- contact@mail-service.info
File Indicators:
- SHA256: fc62c55f7ad83e2f5b06a2cc3682f846045ded0a0f8bd5f5f4de5d4925eae59d
- MD5: 3d3e964f0cd79892221cddf1a11bdc0a
- Drop path: /var/tmp/backdoor.elf


IOC Bulletin - BlackCat Campaign:
Network Indicators:
- 179.232.127.14
- 192.144.27.112
- 212.244.86.89
- cdn-secure.xyz
- nodestatic.xyz
URLs:
- hxxp://secure-mail.io/panel/index.html
- hxxps://nodeedge.cc/collect
Email Senders:
- notification@mail-service.info
- report@auth-check.org
File Indicators:
- MD5: b6f6e2a4c50c814e4d64bdc23fa2908d
- MD5: d81ebbc9a775b05466d3c3604ac0b4dd
- Drop path: C:\ProgramData\lsass.dmp


IOC Bulletin - NjRAT Campaign:
Network Indicators:
- 192.141.160.215
- 169.150.152.111
- 197.164.73.61
- update-sync.net
- securebackup.live
URLs:
- https://proxyedge.tech/portal/verify
- http://updateapi.io/gate.php
Email Senders:
- report@auth-check.org
- support@secure-verify.net
File Indicators:
- SHA256: 07d74d8ab071f8be242bc15510b1edb860eb63b7a8426caceaad63213336f6df
- SHA1: 7ca699f631f3ccebf72fe1da8c479403d7ed80c4
- Drop path: /home/user/.config/lsass.dmp


IOC Bulletin - PlugX Campaign:
Network Indicators:
- 192.116.216.126
- 192.175.22.191
- 192.14.29.205
- apirelay.online
- proxy-data.info
URLs:
- hxxps://data-auth.site/wp-content/uploads/doc.php
- hxxp://updateproxy.cc/admin/config
Email Senders:
- info@identity-verify.cc
- hr@auth-check.org
File Indicators:
- SHA1: c03ad1fe88229f2bde29b0577713874c177bd07f
- MD5: fa45535aa698876cae96006e99947e11
- Drop path: /dev/shm/winlogon.exe


IOC Bulletin - DarkSide Campaign:
Network Indicators:
- 89.147.91.184
- 10.204.250.176
- 24.181.26.109
- nodenode.net
- mailrelay.net
URLs:
- http://gatewaygateway.net/callback
- http://cdncache.xyz/assets/js/payload.js
Email Senders:
- helpdesk@identity-verify.cc
- hr@identity-verify.cc
File Indicators:
- SHA1: 3c5a9c622974d3604c85d43e996fc689512fb447
- MD5: a10d04413df69b1e1f0577dfac9609ea
- Drop path: C:\Windows\Temp\winlogon.exe


IOC Bulletin - DanaBot Campaign:
Network Indicators:
- 81.61.211.30
- 10.106.171.107
- 10.67.133.233
- apinode.org
- portalstatic.site
URLs:
- http://api-login.top/collect
- http://backupedge.live/collect
Email Senders:
- verify@urgent-notice.online
- finance@urgent-notice.online
File Indicators:
- SHA256: b762fce4b63247a949d78d30c345c0419ae2f419a7bdbc5b5577b5e67cd3f873
- SHA1: 178385680f70cd7240be13c3aeb796b8002faa3e
- Drop path: /dev/shm/shell.php


IOC Bulletin - BatLoader Campaign:
Network Indicators:
- 190.101.43.147
- 58.29.177.42
- 161.26.133.182
- portal-cache.dev
- secure-mail.live
URLs:
- hxxp://gateway-sync.org/login
- http://login-proxy.info/collect
Email Senders:
- admin@secure-verify.net
- verify@identity-verify.cc
File Indicators:
- SHA1: 74806f38495308385f63bda18588e6bf028a278e
- SHA1: 775c91a65ca47896e2c25c41b2732bcd3cf6022c
- Drop path: /tmp/taskhost.exe


IOC Bulletin - StealC Campaign:
Network Indicators:
- 192.217.124.120
- 192.185.177.58
- 2.215.76.45
- update-gateway.xyz
- gatewayproxy.xyz
URLs:
- http://proxyrelay.tech/collect
- https://securestatic.io/api/v2/auth
Email Senders:
- admin@mail-service.info
- admin@phishing-domain.com
File Indicators:
- SHA1: 3023345a555c0278bc9f32850cb8ce3f88b0c9f4
- SHA1: 48bbf93c83908fd0cdc5297a756a6afe03fbd956
- Drop path: /tmp/config.dat


IOC Bulletin - Amadey Campaign:
Network Indicators:
- 10.111.65.79
- 192.227.155.222
- 53.166.65.175
- storage-gateway.net
- edge-node.club
URLs:
- http://edge-update.top/admin/config
- hxxps://nodegateway.org/panel/index.html
Email Senders:
- ceo@login-portal.tech
- info@secure-verify.net
File Indicators:
- SHA256: acfb7cb7d5bc258dc599f52c0044cc504b6b0b08a343592643d73dd2aa56bb99
- SHA256: 6f3d80fa8331de8fdb519eb67ebc29e88ca7b092bba7dc74ccd4d4ae5a62530c
- Drop path: C:\Users\Public\Documents\config.dat


IOC Bulletin - BatLoader Campaign:
Network Indicators:
- 172.248.15.208
- 192.200.217.99
- 59.200.155.123
- node-api.top
- secure-gateway.live
URLs:
- hxxp://storageupdate.xyz/admin/config
- hxxp://staticcdn.club/admin/config
Email Senders:
- report@mail-service.info
- admin@login-portal.tech
File Indicators:
- MD5: c1222654d6632cc35d6fea6d6b7a0a7a
- SHA1: bd3d87b90c40eddafb119c004ab378ca6a2b96f1
- Drop path: /dev/shm/csrss.exe


IOC Bulletin - Royal Campaign:
Network Indicators:
- 163.101.55.169
- 10.128.175.33
- 177.168.212.116
- cache-storage.com
- cdn-mail.site
URLs:
- http://relay-api.org/secure/token
- hxxps://backup-static.info/panel/index.html
Email Senders:
- it@account-update.xyz
- report@urgent-notice.online
File Indicators:
- SHA1: ca3ff41f5d258f837c84eb0c2f474993d2c667a8
- MD5: d1df35e334d24bab4e10c12bc5d57bbd
- Drop path: /var/tmp/loader.exe


IOC Bulletin - BatLoader Campaign:
Network Indicators:
- 10.37.167.31
- 151.239.226.128
- 69.45.125.103
- gateway-mail.online
- maillogin.io
URLs:
- https://authcache.top/admin/config
- hxxp://cacheupdate.dev/collect
Email Senders:
- finance@urgent-notice.online
- hr@document-share.link
File Indicators:
- SHA256: f17dfb325aae3769ed6d97fdf16a808076b29ad99fcaaa2261b081bd9ba92791
- SHA256: de77c2714cf083bd3342baab540941779740c8a1f122eb26a729bec54f23b419
- Drop path: /home/user/.config/runtime.dll


IOC Bulletin - SmokeLoader Campaign:
Network Indicators:
- 118.245.209.222
- 20.121.223.88
- 5.17.46.179
- staticmail.club
- relaynode.xyz
URLs:
- hxxps://cachecloud.site/api/v2/auth
- http://apilogin.top/login
Email Senders:
- contact@identity-verify.cc
- alert@urgent-notice.online
File Indicators:
- SHA256: 0a15bd5951703f091bd9efc7ca0720d1173973a627624c704fe12d231461e0f4
- SHA256: 0e0aa25ec710d059739c30dd0662252817cd8f33c114157c66830f53b70a5b9f
- Drop path: /opt/app/bin/helper.sh


IOC Bulletin - FormBook Campaign:
Network Indicators:
- 192.252.21.240
- 35.0.71.8
- 192.109.51.242
- secure-update.link
- portalproxy.site
URLs:
- http://update-cloud.top/wp-content/uploads/doc.php
- http://syncnode.xyz/secure/token
Email Senders:
- contact@credential-check.site
- admin@credential-check.site
File Indicators:
- SHA256: 71e4258394d11ecf266d00340c8207d2d8ad1a753309fb535a8af2142642cb81
- MD5: a1e81665e736adbb608c59112090304a
- Drop path: C:\Users\Public\Documents\shell.php


IOC Bulletin - Emotet Campaign:
Network Indicators:
- 104.166.251.207
- 215.99.208.126
- 9.162.133.101
- cloudstatic.xyz
- portal-sync.club
URLs:
- http://syncgateway.dev/assets/js/payload.js
- http://cdn-mail.io/panel/index.html
Email Senders:
- alert@phishing-domain.com
- security@auth-check.org
File Indicators:
- SHA1: 563506088a916cef4a3020830e27f4e26813564f
- SHA256: 47351e55946b8ddb7f9e007a1d48ad8a9ffaf214ee5df590ec7b7c4c79ce8dc0
- Drop path: /tmp/taskhost.exe


IOC Bulletin - BlackCat Campaign:
Network Indicators:
- 172.214.65.81
- 127.24.16.145
- 133.26.156.4
- backup-portal.net
- staticrelay.link
URLs:
- hxxps://update-api.dev/login
- https://cloudnode.io/portal/verify
Email Senders:
- service@credential-check.site
- helpdesk@mail-service.info
File Indicators:
- SHA1: 3154292e94d84d66d2ac9363f8ad862292f78b17
- SHA256: c651925518198642a56e46608a9e6a8c6884c5b4d81c8f30f9989019bb06c65a
- Drop path: /dev/shm/agent.py


IOC Bulletin - BumbleBee Campaign:
Network Indicators:
- 193.118.16.142
- 27.107.54.148
- 148.193.254.18
- login-auth.xyz
- mail-backup.org
URLs:
- hxxps://securemail.top/api/v2/auth
- https://cache-cdn.xyz/collect
Email Senders:
- finance@phishing-domain.com
- notification@mail-service.info
File Indicators:
- SHA1: 783cc21132fb7b32668322156eb608431693f540
- SHA1: f3d579b1abaca1884c1d0d7f5253ed18094bdc6e
- Drop path: C:\Users\admin\Downloads\shell.php


IOC Bulletin - Gootloader Campaign:
Network Indicators:
- 10.160.229.160
- 192.116.71.64
- 174.214.239.100
- cdnportal.live
- node-cache.tech
URLs:
- http://updatecloud.cc/panel/index.html
- https://edge-relay.info/admin/config
Email Senders:
- billing@phishing-domain.com
- account@secure-verify.net
File Indicators:
- SHA256: d4b17d947dfb22e79432077e7099cf1396d0797839ae1d5a1898db079a86ced8
- SHA256: ada1cc909fea52c64ffae371cc0fc78a0828307c9cd7ad662bcccb92cd297781
- Drop path: /tmp/ntds.dit


IOC Bulletin - BumbleBee Campaign:
Network Indicators:
- 192.104.229.181
- 10.197.195.63
- 10.241.62.90
- edgeapi.io
- authdata.xyz
URLs:
- https://nodegateway.com/gate.php
- hxxps://portalrelay.online/collect
Email Senders:
- noreply@urgent-notice.online
- confirm@document-share.link
File Indicators:
- SHA256: f5d1bc9b876af8dc58341783c1fdc9e966c8dfb00fe823e4f72491fbbbbca166
- SHA256: 057d39b05f1838fd299857f78b68eb2f6d1ff895720cbbabea08b9ee424399e7
- Drop path: C:\Windows\System32\update.dll


IOC Bulletin - Play Campaign:
Network Indicators:
- 10.227.163.206
- 70.17.183.129
- 10.6.107.107
- portal-relay.online
- authstatic.live
URLs:
- hxxp://staticproxy.top/callback
- hxxp://storagerelay.net/callback
Email Senders:
- finance@document-share.link
- contact@credential-check.site
File Indicators:
- SHA1: ea83709aed3daf1b2259b01c7fb883fc644aaa7e
- SHA256: 567c69a7bb8ee27e156680a7d2a0b283a87474ad95fb811a1ad912e91ca4d261
- Drop path: /usr/local/bin/csrss.exe


IOC Bulletin - Ryuk Campaign:
Network Indicators:
- 81.117.231.92
- 172.227.153.249
- 174.74.165.36
- staticcache.com
- node-mail.net
URLs:
- hxxp://gatewayproxy.dev/wp-content/uploads/doc.php
- http://apistorage.online/portal/verify
Email Senders:
- contact@credential-check.site
- support@auth-check.org
File Indicators:
- SHA256: ccc0856d69fde79776a992ae1835e87aa1e8fb2a6acc95ab977174a0b9c7d204
- SHA256: 73e198a2f6af79570fcd71fdc641927a2c8ad7d1b1f5144db7c6f4d9e0c05cf6
- Drop path: C:\Users\admin\AppData\Local\Temp\ntds.dit


IOC Bulletin - WarmCookie Campaign:
Network Indicators:
- 192.103.107.18
- 172.222.165.180
- 10.248.163.131
- cdndata.dev
- mailportal.xyz
URLs:
- hxxp://edge-cache.org/portal/verify
- https://loginsync.link/gate.php
Email Senders:
- support@auth-check.org
- info@auth-check.org
File Indicators:
- SHA1: 9527a08241233b00932bd2d56ff598560a29418d
- SHA256: b1a9d2bab11c6b2d2a02dca337e54190d0b7b45533cf75584b12b6b3420972e7
- Drop path: /opt/app/bin/beacon.dll


IOC Bulletin - PikaBot Campaign:
Network Indicators:
- 172.98.3.211
- 10.137.74.119
- 172.56.199.198
- node-portal.cc
- syncproxy.site
URLs:
- https://proxy-update.xyz/admin/config
- http://proxyedge.link/assets/js/payload.js
Email Senders:
- security@identity-verify.cc
- account@secure-verify.net
File Indicators:
- SHA1: e5c68534cf17919dff8a2be68465a2d73f0e7fac
- SHA256: e71c55a1c5a20a0a33d4471352ee73d1bc47db64764fc7ee43fea23d4cb86773
- Drop path: /tmp/taskhost.exe


IOC Bulletin - Meduza Stealer Campaign:
Network Indicators:
- 10.143.46.198
- 192.114.71.131
- 172.94.178.62
- authnode.tech
- storagemail.info
URLs:
- hxxp://storage-edge.dev/api/v2/auth
- hxxp://updatecdn.dev/secure/token
Email Senders:
- service@login-portal.tech
- admin@login-portal.tech
File Indicators:
- SHA256: 13bc7078d254063e5d45ba0580bc85f008076b67c6dc5556a84e35cf2917687c
- SHA1: f56ecda5823de4a73e2bb579c2a2d0be6f3b6125
- Drop path: C:\Users\admin\Downloads\loader.exe


IOC Bulletin - LockBit Campaign:
Network Indicators:
- 122.97.167.171
- 223.4.157.252
- 149.194.184.114
- gateway-node.cc
- loginapi.xyz
URLs:
- hxxp://cdnnode.site/panel/index.html
- https://edgestorage.site/admin/config
Email Senders:
- billing@mail-service.info
- updates@identity-verify.cc
File Indicators:
- SHA256: 0860b888ff4fa3932219c787d878766e3e86bc1510fdd857dde29b5f54a199a0
- SHA1: 587d422fa4c94f583158eb6a0c744e8f0f063855
- Drop path: C:\Users\admin\AppData\Local\Temp\loader.exe


IOC Bulletin - WarmCookie Campaign:
Network Indicators:
- 10.10.87.218
- 140.224.90.134
- 102.239.109.101
- api-portal.xyz
- update-edge.info
URLs:
- http://proxy-secure.club/download/update.exe
- http://data-cloud.club/portal/verify
Email Senders:
- report@phishing-domain.com
- account@mail-service.info
File Indicators:
- MD5: 156af39be9b520c4c110258bbfab84c6
- SHA256: 6f2935cf8ab114370f34a59ea6a628c5afe4e5234d9627f368b5792b1bf83fa8
- Drop path: /dev/shm/agent.py


IOC Bulletin - DanaBot Campaign:
Network Indicators:
- 192.46.221.207
- 172.113.17.59
- 10.50.198.106
- portal-gateway.org
- node-sync.tech
URLs:
- https://backup-update.io/gate.php
- https://loginsecure.dev/api/v2/auth
Email Senders:
- alert@phishing-domain.com
- account@mail-service.info
File Indicators:
- MD5: aeb5f673bfd75b9d889918d4e8826b9e
- MD5: 3a1cb75272e164c3cf001bb2480764d7
- Drop path: C:\Program Files\Common Files\chrome_helper.exe


IOC Bulletin - Cobalt Strike Campaign:
Network Indicators:
- 188.212.22.190
- 10.199.3.76
- 152.9.53.114
- staticstorage.xyz
- portal-login.dev
URLs:
- http://update-gateway.site/panel/index.html
- hxxp://storageproxy.live/download/update.exe
Email Senders:
- info@identity-verify.cc
- it@phishing-domain.com
File Indicators:
- MD5: efc36db0e1a50b4e1562fa6618ab16c9
- MD5: 8e8221ecabc23f07673d6c7fd53587dc
- Drop path: C:\Users\admin\Downloads\backdoor.elf


IOC Bulletin - LockBit Campaign:
Network Indicators:
- 192.99.177.69
- 217.7.235.20
- 192.7.237.194
- static-node.tech
- secure-data.top
URLs:
- http://updategateway.site/api/v2/auth
- hxxp://edgestorage.xyz/admin/config
Email Senders:
- billing@secure-verify.net
- verify@secure-verify.net
File Indicators:
- SHA1: 3981d9dfc054681a987485a28356baf4d23c469e
- SHA256: a646338b2a209096e6fbda18dddade1247d3ca8fd938b0a2aa398b3afd7dfea1
- Drop path: /usr/local/bin/sam.hive


IOC Bulletin - DanaBot Campaign:
Network Indicators:
- 92.130.33.44
- 172.91.80.2
- 192.36.182.202
- cdn-node.cc
- loginauth.live
URLs:
- http://auth-secure.site/download/update.exe
- hxxps://cdnstorage.link/gate.php
Email Senders:
- helpdesk@account-update.xyz
- hr@document-share.link
File Indicators:
- MD5: 07811ed598441dbf7348e798e53533ff
- MD5: f2b334df58cfeebc0281f98bed20ab85
- Drop path: C:\ProgramData\helper.sh


IOC Bulletin - StealC Campaign:
Network Indicators:
- 62.27.126.210
- 172.23.86.125
- 154.203.77.202
- edge-data.io
- backupcdn.link
URLs:
- hxxp://portalmail.info/collect
- https://loginedge.link/assets/js/payload.js
Email Senders:
- account@phishing-domain.com
- billing@login-portal.tech
File Indicators:
- SHA1: 2ae72ca5c277630c3b23cc2924be7053716f92b2
- SHA256: 3d4dddc282508d0530106908be184b41c142e40067db3be634e852f6db3193f6
- Drop path: C:\Windows\Temp\loader.exe


IOC Bulletin - FormBook Campaign:
Network Indicators:
- 211.49.147.143
- 168.125.65.152
- 192.163.10.86
- sync-node.live
- authstorage.cc
URLs:
- hxxp://edge-login.dev/gate.php
- hxxps://secureauth.com/gate.php
Email Senders:
- hr@mail-service.info
- hr@credential-check.site
File Indicators:
- SHA256: aa5f4f4a25f513b13273810758a5e631648ea6340d84e33ce745261f333d4eb2
- MD5: 51805cb55b7c7818060a98af6f4d1d1c
- Drop path: /var/tmp/shell.php


IOC Bulletin - Ryuk Campaign:
Network Indicators:
- 172.63.248.241
- 219.5.15.52
- 92.201.141.235
- storageproxy.link
- proxy-backup.link
URLs:
- http://portalportal.com/download/update.exe
- hxxps://portal-portal.club/portal/verify
Email Senders:
- verify@mail-service.info
- alert@account-update.xyz
File Indicators:
- MD5: 358de74077e360f643efce8b9904214d
- SHA1: 58f8c74e2e01b9c0b063f4972b29620253fba227
- Drop path: C:\Windows\Temp\dropper.ps1


IOC Bulletin - Ryuk Campaign:
Network Indicators:
- 10.223.107.129
- 172.67.144.2
- 56.126.186.30
- updatelogin.site
- proxyrelay.tech
URLs:
- hxxps://gatewayedge.info/wp-content/uploads/doc.php
- http://gateway-cloud.site/panel/index.html
Email Senders:
- info@credential-check.site
- ceo@account-update.xyz
File Indicators:
- SHA256: d20891da2b69f0e944d0073524e00d9793600df2cedbd895ed5e5e97c57c8b25
- SHA1: 6984833a22fc2cd198bd346e4d15264a924e7de2
- Drop path: /usr/local/bin/dropper.ps1


IOC Bulletin - IcedID Campaign:
Network Indicators:
- 172.124.249.99
- 41.117.112.3
- 192.183.123.154
- loginportal.com
- cloudsecure.cc
URLs:
- hxxps://backup-update.net/portal/verify
- https://backuprelay.tech/assets/js/payload.js
Email Senders:
- verify@login-portal.tech
- updates@credential-check.site
File Indicators:
- SHA1: 54319f215964cedf6475e53b0a57f8279d07544e
- MD5: b871a38cd83c9274c97d9fb44f071535
- Drop path: C:\Users\admin\AppData\Local\Temp\backdoor.elf


IOC Bulletin - Lumma Stealer Campaign:
Network Indicators:
- 192.213.234.137
- 192.158.186.211
- 221.172.245.243
- datastatic.site
- cdn-cloud.link
URLs:
- http://storage-proxy.xyz/panel/index.html
- hxxps://cdn-node.live/portal/verify
Email Senders:
- alert@credential-check.site
- ceo@identity-verify.cc
File Indicators:
- SHA1: 10d233a5dc3750ff6348c2564c023341cdaef7f0
- MD5: 52834916cf40440e0a44dc9955918f5c
- Drop path: /usr/local/bin/runtime.dll


IOC Bulletin - Cobalt Strike Campaign:
Network Indicators:
- 220.82.53.230
- 170.232.34.174
- 148.51.198.82
- securedata.site
- backup-api.net
URLs:
- http://relayedge.dev/gate.php
- http://login-portal.tech/assets/js/payload.js
Email Senders:
- security@urgent-notice.online
- info@urgent-notice.online
File Indicators:
- SHA256: 21900a03ad8cc29e4a2a4e644610ea041285817be606566ed36c64c14968e5ec
- MD5: 45ef1fc452d01dc9d39fe6e2a0e6e7ff
- Drop path: C:\Windows\System32\shell.php


IOC Bulletin - Conti Campaign:
Network Indicators:
- 172.187.84.67
- 192.207.13.164
- 26.178.171.225
- cloudrelay.club
- cdn-sync.xyz
URLs:
- https://auth-node.tech/collect
- hxxps://proxyupdate.online/callback
Email Senders:
- report@mail-service.info
- hr@urgent-notice.online
File Indicators:
- MD5: 97c93758fc7466a7abf30c63e55c47c1
- MD5: 34ea6ded5f50ffba8d3a1048de5f949f
- Drop path: C:\Users\Public\Documents\backdoor.elf


IOC Bulletin - AsyncRAT Campaign:
Network Indicators:
- 10.30.139.10
- 95.210.23.39
- 10.26.216.80
- relay-static.online
- cache-gateway.io
URLs:
- https://edge-node.top/assets/js/payload.js
- hxxp://loginrelay.dev/assets/js/payload.js
Email Senders:
- hr@mail-service.info
- notification@credential-check.site
File Indicators:
- SHA1: 4df2eabd3c8c4d7ca15d3159dd53cd1a2d4a961d
- SHA256: 2119069d976ef7df11ffbb979165cb57f582982a0ca359b257ff7a3cb3c426fb
- Drop path: C:\Windows\System32\csrss.exe


IOC Bulletin - Conti Campaign:
Network Indicators:
- 177.99.210.105
- 71.228.187.131
- 215.124.247.233
- cdn-storage.xyz
- mail-cache.com
URLs:
- https://relayauth.io/wp-content/uploads/doc.php
- https://updateauth.online/wp-content/uploads/doc.php
Email Senders:
- admin@mail-service.info
- support@account-update.xyz
File Indicators:
- MD5: 976f74083a5780dcf563e00751c44406
- SHA1: 992a1bc84be507c4dfe69046188f1880b8214bca
- Drop path: /etc/cron.d/lsass.dmp


IOC Bulletin - QakBot Campaign:
Network Indicators:
- 172.61.102.231
- 172.203.253.120
- 38.245.0.113
- login-relay.cc
- authrelay.site
URLs:
- https://updategateway.live/download/update.exe
- hxxps://securecache.club/assets/js/payload.js
Email Senders:
- finance@login-portal.tech
- account@urgent-notice.online
File Indicators:
- SHA256: 03caf3fd49f1d75b471964453f6bf461967c9d578fdd9fa2479336d30a57248a
- SHA1: c439fc2bef4506ab8a1a09bdd4610aa91823629b
- Drop path: C:\Users\Public\Documents\beacon.dll


IOC Bulletin - FormBook Campaign:
Network Indicators:
- 102.69.85.218
- 9.73.178.80
- 10.202.118.148
- storage-node.info
- syncproxy.org
URLs:
- http://backup-portal.link/panel/index.html
- hxxps://cdn-cloud.site/callback
Email Senders:
- alert@auth-check.org
- it@phishing-domain.com
File Indicators:
- MD5: 9b6385424b9f081d046178570cb90641
- MD5: e8f93b9c1049d6be248e593dd035864a
- Drop path: C:\Users\admin\Downloads\lsass.dmp


IOC Bulletin - IcedID Campaign:
Network Indicators:
- 172.15.241.58
- 10.79.28.209
- 99.224.222.104
- backupupdate.tech
- secure-sync.org
URLs:
- hxxp://gateway-cache.info/secure/token
- http://secure-node.club/api/v2/auth
Email Senders:
- updates@urgent-notice.online
- admin@auth-check.org
File Indicators:
- SHA1: af3927f6fcab3290177351a4ad04408c0596b7ee
- SHA1: 104137e6b283615d57085631a535fec195bc3d92
- Drop path: C:\ProgramData\helper.sh


Blog Post by NSA: Tracking APT29's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-34807 against VMware ESXi deployments. The initial access vector involves spear-phishing emails from it@auth-check.org delivering NjRAT. Post-compromise, the attackers deploy PlugX and use PsExec for reconnaissance. C2 infrastructure includes 172.227.197.76 and storagemail.org. A staging server at hxxps://authstorage.net/gate.php hosts additional tooling. Key artifact: /dev/shm/svchost.exe (SHA256: accaa4f886ffd011384debbaab4c2630059aed2e5ec0ce20c86c9508ad72be0d).


Blog Post by SentinelOne: Tracking Turla's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-27219 against Barracuda ESG deployments. The initial access vector involves spear-phishing emails from service@login-portal.tech delivering Meduza Stealer. Post-compromise, the attackers deploy RedLine Stealer and use BloodHound for reconnaissance. C2 infrastructure includes 205.136.148.24 and cloud-storage.dev. A staging server at http://securestorage.io/collect hosts additional tooling. Key artifact: /opt/app/bin/ntds.dit (SHA256: 62f46c0faa720a9f297447d48fbc1dff5f4f4d726763d38ffd9f7fdf6d2ff6f6).


Blog Post by CrowdStrike: Tracking APT29's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2024-14337 against Ubuntu 22.04 deployments. The initial access vector involves spear-phishing emails from security@credential-check.site delivering Raccoon Stealer. Post-compromise, the attackers deploy DarkSide and use Hashcat for reconnaissance. C2 infrastructure includes 23.247.228.178 and apicache.xyz. A staging server at https://nodesync.cc/wp-content/uploads/doc.php hosts additional tooling. Key artifact: /tmp/backdoor.elf (SHA256: 2a79b51534d78604dba5d95d396d2bd3d6f72bf87c752461b3af635fb53c4b4e).


Blog Post by Huntress: Tracking Salt Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-19144 against Ubuntu 22.04 deployments. The initial access vector involves spear-phishing emails from ceo@login-portal.tech delivering SmokeLoader. Post-compromise, the attackers deploy NjRAT and use LaZagne for reconnaissance. C2 infrastructure includes 109.81.57.51 and gatewayapi.site. A staging server at hxxp://portalapi.tech/assets/js/payload.js hosts additional tooling. Key artifact: C:\Windows\System32\payload.bin (MD5: da530bbbb0018619e5581fe65b72dc5a).


Blog Post by Microsoft MSRC: Tracking Salt Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2026-27486 against VMware ESXi deployments. The initial access vector involves spear-phishing emails from finance@urgent-notice.online delivering SmokeLoader. Post-compromise, the attackers deploy PlugX and use BloodHound for reconnaissance. C2 infrastructure includes 10.138.55.43 and apistatic.io. A staging server at https://cdnedge.cc/wp-content/uploads/doc.php hosts additional tooling. Key artifact: C:\Users\Public\Documents\payload.bin (MD5: 4cef9e6649d9b6590b197a296edc4359).


Blog Post by Symantec: Tracking Volt Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-39714 against Windows Server 2019 deployments. The initial access vector involves spear-phishing emails from admin@auth-check.org delivering BatLoader. Post-compromise, the attackers deploy Conti and use PowerShell Empire for reconnaissance. C2 infrastructure includes 192.9.165.132 and storage-node.com. A staging server at hxxp://sync-update.xyz/portal/verify hosts additional tooling. Key artifact: C:\Users\admin\AppData\Local\Temp\dropper.ps1 (SHA1: 8f1cc2fbb5a96127ac01c81b6a2e5ebbd91f1987).


Blog Post by Tenable: Tracking Aqua Blizzard's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2024-19363 against Microsoft Exchange deployments. The initial access vector involves spear-phishing emails from noreply@secure-verify.net delivering Conti. Post-compromise, the attackers deploy QakBot and use Hashcat for reconnaissance. C2 infrastructure includes 165.221.19.163 and auth-data.net. A staging server at https://gateway-gateway.cc/callback hosts additional tooling. Key artifact: C:\Users\admin\Downloads\agent.py (SHA256: d8af6d83bde0ff03c5ed2671f598fa20dd0ac3a3b72d4c8c12bb3df461d4fd1d).


Blog Post by Symantec: Tracking Storm-0558's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-34260 against Citrix NetScaler deployments. The initial access vector involves spear-phishing emails from ceo@document-share.link delivering PlugX. Post-compromise, the attackers deploy XLoader and use Seatbelt for reconnaissance. C2 infrastructure includes 10.177.97.102 and cdn-relay.live. A staging server at https://staticnode.live/collect hosts additional tooling. Key artifact: C:\ProgramData\config.dat (SHA1: 4dcbb7a75dd7862d404fdeaed3beb59323b1d3a5).


Blog Post by Proofpoint: Tracking APT28's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-28217 against Microsoft Exchange deployments. The initial access vector involves spear-phishing emails from alert@login-portal.tech delivering Lumma Stealer. Post-compromise, the attackers deploy LockBit and use Mimikatz for reconnaissance. C2 infrastructure includes 192.132.221.95 and mailproxy.club. A staging server at http://gateway-portal.tech/panel/index.html hosts additional tooling. Key artifact: C:\Windows\Temp\agent.py (SHA1: 143eca93862194e53b2ba58f5d79b3c3249c64ae).


Blog Post by Europol: Tracking Gamaredon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-16619 against Juniper SRX deployments. The initial access vector involves spear-phishing emails from admin@credential-check.site delivering AgentTesla. Post-compromise, the attackers deploy QakBot and use Burp Suite for reconnaissance. C2 infrastructure includes 75.51.203.70 and cdnnode.site. A staging server at hxxp://cache-storage.xyz/download/update.exe hosts additional tooling. Key artifact: C:\Windows\System32\backdoor.elf (SHA256: ca75918ba9553a2d2b86a1b6adcf61e66715933cff2a596a896dfa3d404837ab).


Blog Post by Symantec: Tracking Aqua Blizzard's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-20659 against VMware ESXi deployments. The initial access vector involves spear-phishing emails from account@login-portal.tech delivering Latrodectus. Post-compromise, the attackers deploy Qbot and use Ligolo for reconnaissance. C2 infrastructure includes 172.50.111.172 and mailproxy.info. A staging server at hxxps://edgeportal.net/assets/js/payload.js hosts additional tooling. Key artifact: /var/tmp/agent.py (MD5: d18dd20df96d1fdff92806c64bddbf48).


Blog Post by Symantec: Tracking APT29's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-27496 against Active Directory deployments. The initial access vector involves spear-phishing emails from security@auth-check.org delivering PikaBot. Post-compromise, the attackers deploy Play and use Chisel for reconnaissance. C2 infrastructure includes 192.242.180.145 and cache-secure.com. A staging server at http://staticportal.tech/collect hosts additional tooling. Key artifact: C:\Program Files\Common Files\payload.bin (SHA256: 70ec50ea641eac1378e81a87214f0beb39ea05ea05c386fee7171ec31c902a25).


Blog Post by CISA: Tracking Storm-0558's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-36175 against Barracuda ESG deployments. The initial access vector involves spear-phishing emails from verify@urgent-notice.online delivering REvil. Post-compromise, the attackers deploy BlackCat and use PsExec for reconnaissance. C2 infrastructure includes 10.89.240.88 and sync-auth.io. A staging server at https://static-static.club/secure/token hosts additional tooling. Key artifact: C:\Users\admin\AppData\Local\Temp\config.dat (SHA1: 84cead1be1bb20babc7bd427d844ff0481f8dab2).


Blog Post by Symantec: Tracking Granite Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-37493 against Zyxel USG deployments. The initial access vector involves spear-phishing emails from billing@mail-service.info delivering BlackCat. Post-compromise, the attackers deploy BatLoader and use Mimikatz for reconnaissance. C2 infrastructure includes 21.13.215.34 and mailupdate.org. A staging server at http://cachebackup.info/wp-content/uploads/doc.php hosts additional tooling. Key artifact: C:\Users\Public\Documents\agent.py (MD5: c728f362cf186320f8cd5513eaf0e6dd).


Blog Post by Secureworks: Tracking FIN7's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-13003 against Fortinet FortiGate deployments. The initial access vector involves spear-phishing emails from verify@credential-check.site delivering Meduza Stealer. Post-compromise, the attackers deploy IcedID and use Mimikatz for reconnaissance. C2 infrastructure includes 192.63.220.215 and relaycache.top. A staging server at http://gateway-gateway.top/assets/js/payload.js hosts additional tooling. Key artifact: C:\Windows\System32\update.dll (MD5: 945453f42f7d49a82106cc31badabcee).


Blog Post by Secureworks: Tracking Diamond Sleet's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-25247 against Apache Struts deployments. The initial access vector involves spear-phishing emails from report@auth-check.org delivering Ryuk. Post-compromise, the attackers deploy Dridex and use PowerView for reconnaissance. C2 infrastructure includes 192.117.128.64 and edgesecure.site. A staging server at http://api-edge.online/assets/js/payload.js hosts additional tooling. Key artifact: /var/tmp/runtime.dll (MD5: 1ed83de6a245f96cab5945a143f35fe1).


Blog Post by Qualys: Tracking Diamond Sleet's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2024-25010 against Palo Alto PAN-OS deployments. The initial access vector involves spear-phishing emails from ceo@phishing-domain.com delivering Gootloader. Post-compromise, the attackers deploy LockBit and use CrackMapExec for reconnaissance. C2 infrastructure includes 192.66.68.68 and mail-proxy.online. A staging server at https://securerelay.online/secure/token hosts additional tooling. Key artifact: C:\Users\admin\Downloads\taskhost.exe (MD5: 91a2bb161097d0e547fddd7907f2cbb6).


Blog Post by Zscaler ThreatLabz: Tracking Granite Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-24446 against VMware ESXi deployments. The initial access vector involves spear-phishing emails from finance@account-update.xyz delivering PikaBot. Post-compromise, the attackers deploy AgentTesla and use Rubeus for reconnaissance. C2 infrastructure includes 135.158.221.9 and portal-cloud.io. A staging server at http://cache-portal.club/panel/index.html hosts additional tooling. Key artifact: C:\Windows\Temp\agent.py (SHA1: 32ad0456a4bb79c0707c23630c427901e8e2bca7).


Blog Post by CISA: Tracking Scattered Spider's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2024-35928 against Juniper SRX deployments. The initial access vector involves spear-phishing emails from support@account-update.xyz delivering Lumma Stealer. Post-compromise, the attackers deploy Latrodectus and use PsExec for reconnaissance. C2 infrastructure includes 115.243.28.226 and cachedata.top. A staging server at hxxp://node-storage.xyz/admin/config hosts additional tooling. Key artifact: /opt/app/bin/agent.py (SHA1: dca2b64bda8ee69bddc9a871f5aa78c4f4eda0fb).


Blog Post by Dragos: Tracking Lazarus Group's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-26043 against SonicWall SMA deployments. The initial access vector involves spear-phishing emails from notification@account-update.xyz delivering FormBook. Post-compromise, the attackers deploy Amadey and use BITSAdmin for reconnaissance. C2 infrastructure includes 166.231.34.134 and cloudgateway.club. A staging server at https://data-cache.tech/admin/config hosts additional tooling. Key artifact: C:\ProgramData\taskhost.exe (MD5: cdd631f6fdd06f878cc0e3f28162e4b3).


Blog Post by Secureworks: Tracking MuddyWater's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-15229 against Atlassian Confluence deployments. The initial access vector involves spear-phishing emails from notification@document-share.link delivering NjRAT. Post-compromise, the attackers deploy PlugX and use Rubeus for reconnaissance. C2 infrastructure includes 10.143.235.55 and proxycache.site. A staging server at http://portal-cloud.io/secure/token hosts additional tooling. Key artifact: /dev/shm/sam.hive (MD5: 32efe474d2b81c0e116158b281fc6cee).


Blog Post by Europol: Tracking Lazarus Group's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-33526 against Citrix NetScaler deployments. The initial access vector involves spear-phishing emails from info@auth-check.org delivering Amadey. Post-compromise, the attackers deploy Latrodectus and use Sharphound for reconnaissance. C2 infrastructure includes 10.63.11.202 and auth-sync.org. A staging server at http://gatewaystatic.com/download/update.exe hosts additional tooling. Key artifact: /dev/shm/winlogon.exe (MD5: 946c0c961fe129f536e958f3e3bca12e).


Blog Post by Europol: Tracking Scattered Spider's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-37651 against MOVEit Transfer deployments. The initial access vector involves spear-phishing emails from security@credential-check.site delivering Ryuk. Post-compromise, the attackers deploy SmokeLoader and use Havoc for reconnaissance. C2 infrastructure includes 114.50.7.170 and update-sync.top. A staging server at hxxp://nodeproxy.dev/portal/verify hosts additional tooling. Key artifact: /home/user/.config/shell.php (SHA256: 48543e3f2e319fbaaf263854e8b40567843b8858b0e07684f183e7166d1c66ce).


Blog Post by Proofpoint: Tracking Storm-0558's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-40294 against Juniper SRX deployments. The initial access vector involves spear-phishing emails from helpdesk@auth-check.org delivering AgentTesla. Post-compromise, the attackers deploy BlackCat and use ADFind for reconnaissance. C2 infrastructure includes 10.176.58.117 and cache-relay.org. A staging server at hxxp://apisecure.top/portal/verify hosts additional tooling. Key artifact: /var/tmp/ntds.dit (SHA256: 445a6f831271be20694121e613dff1e0da10559ab3fc3e83e8fd159f13a289ef).


Blog Post by CISA: Tracking BlackTech's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-13087 against Palo Alto PAN-OS deployments. The initial access vector involves spear-phishing emails from notification@credential-check.site delivering PlugX. Post-compromise, the attackers deploy Amadey and use PowerShell Empire for reconnaissance. C2 infrastructure includes 185.66.198.205 and edgeproxy.tech. A staging server at https://cloud-api.com/assets/js/payload.js hosts additional tooling. Key artifact: C:\ProgramData\backdoor.elf (SHA1: 9fed3db381c16e81ef3ec24c22be8d33a1bd50a7).


Blog Post by CrowdStrike: Tracking Ember Bear's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-18180 against Juniper SRX deployments. The initial access vector involves spear-phishing emails from info@credential-check.site delivering Amadey. Post-compromise, the attackers deploy IcedID and use Sharphound for reconnaissance. C2 infrastructure includes 172.43.18.124 and portalportal.dev. A staging server at https://staticproxy.live/gate.php hosts additional tooling. Key artifact: C:\Users\Public\Documents\config.dat (SHA256: 0e6dc43d30db1a09c7283ba4164bc8b0d9346ace54b160310e40ffd9562189f6).


Blog Post by Trend Micro: Tracking Velvet Tempest's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-24373 against Juniper SRX deployments. The initial access vector involves spear-phishing emails from service@credential-check.site delivering Play. Post-compromise, the attackers deploy RedLine Stealer and use Ligolo for reconnaissance. C2 infrastructure includes 192.25.111.40 and cloudportal.dev. A staging server at http://loginmail.tech/assets/js/payload.js hosts additional tooling. Key artifact: /tmp/winlogon.exe (SHA1: c3c144f4a5f181fa96281a4b9f2270359e502683).


Blog Post by Volexity: Tracking APT28's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-24446 against Windows 11 deployments. The initial access vector involves spear-phishing emails from report@document-share.link delivering Amadey. Post-compromise, the attackers deploy Latrodectus and use Seatbelt for reconnaissance. C2 infrastructure includes 46.114.152.208 and portalsync.club. A staging server at http://apisecure.top/api/v2/auth hosts additional tooling. Key artifact: /tmp/lsass.dmp (MD5: c7e92aff25d00347cea3efa7cfa826bc).


Blog Post by Zscaler ThreatLabz: Tracking Diamond Sleet's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-45322 against Fortinet FortiGate deployments. The initial access vector involves spear-phishing emails from billing@phishing-domain.com delivering BumbleBee. Post-compromise, the attackers deploy Ryuk and use Seatbelt for reconnaissance. C2 infrastructure includes 86.201.152.66 and cache-cdn.cc. A staging server at https://apistatic.live/callback hosts additional tooling. Key artifact: C:\Users\admin\AppData\Local\Temp\lsass.dmp (MD5: 1e4dff910efdd3118affa0a49b1e992d).


Blog Post by Cisco Talos: Tracking Volt Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-16140 against Ivanti Connect Secure deployments. The initial access vector involves spear-phishing emails from verify@login-portal.tech delivering LockBit. Post-compromise, the attackers deploy Conti and use GhostPack for reconnaissance. C2 infrastructure includes 172.132.28.115 and cdnbackup.live. A staging server at https://api-cloud.club/wp-content/uploads/doc.php hosts additional tooling. Key artifact: C:\Program Files\Common Files\csrss.exe (SHA1: 17dce84c6bdbe6c3ef264e47f1a1213b10ba04c0).


Blog Post by FireEye: Tracking Turla's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2024-31252 against MOVEit Transfer deployments. The initial access vector involves spear-phishing emails from alert@auth-check.org delivering Amadey. Post-compromise, the attackers deploy REvil and use Seatbelt for reconnaissance. C2 infrastructure includes 113.235.240.179 and storage-mail.info. A staging server at http://proxy-api.org/collect hosts additional tooling. Key artifact: /home/user/.config/dropper.ps1 (SHA1: 421073df09c6f7ac94c0a7340f91c85710acb5bf).


Blog Post by Google TAG: Tracking Flax Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-20189 against MOVEit Transfer deployments. The initial access vector involves spear-phishing emails from helpdesk@identity-verify.cc delivering Amadey. Post-compromise, the attackers deploy Emotet and use BloodHound for reconnaissance. C2 infrastructure includes 10.53.108.252 and portal-node.cc. A staging server at hxxps://proxy-sync.site/download/update.exe hosts additional tooling. Key artifact: /home/user/.config/chrome_helper.exe (SHA256: 730d166bdb838914131532255df933f0f7915497dc3612c9d42cb84622d1dc62).


Blog Post by SentinelOne: Tracking Ember Bear's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-32059 against Progress Telerik deployments. The initial access vector involves spear-phishing emails from report@account-update.xyz delivering Amadey. Post-compromise, the attackers deploy Dridex and use WinPEAS for reconnaissance. C2 infrastructure includes 192.136.88.180 and apicache.tech. A staging server at https://apiproxy.site/secure/token hosts additional tooling. Key artifact: C:\Windows\System32\helper.sh (SHA1: 16553bc830aba4b230b857739f34a41115e03529).


Blog Post by Secureworks: Tracking BlackTech's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2026-42806 against Atlassian Confluence deployments. The initial access vector involves spear-phishing emails from confirm@credential-check.site delivering RedLine Stealer. Post-compromise, the attackers deploy BlackCat and use WinPEAS for reconnaissance. C2 infrastructure includes 172.13.223.50 and login-login.io. A staging server at hxxp://static-data.link/secure/token hosts additional tooling. Key artifact: /dev/shm/taskhost.exe (SHA256: fe8f2afae71ef804fbf2a01faacc6981208fb45574a41c539bcc1d1e33d46d45).


Blog Post by SentinelOne: Tracking Aqua Blizzard's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-38077 against Apache Struts deployments. The initial access vector involves spear-phishing emails from alert@phishing-domain.com delivering Hive. Post-compromise, the attackers deploy AgentTesla and use GhostPack for reconnaissance. C2 infrastructure includes 41.210.158.218 and syncgateway.info. A staging server at hxxp://storagecdn.online/panel/index.html hosts additional tooling. Key artifact: C:\Users\Public\Documents\dropper.ps1 (SHA256: c667b59102c406431aa25cd1a577ce4e6104683c9af1ff23fa277aa9198b344b).


Blog Post by SentinelOne: Tracking Aqua Blizzard's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-11952 against Barracuda ESG deployments. The initial access vector involves spear-phishing emails from confirm@urgent-notice.online delivering QakBot. Post-compromise, the attackers deploy PikaBot and use Certutil for reconnaissance. C2 infrastructure includes 81.206.158.210 and updatestorage.io. A staging server at hxxps://update-storage.io/api/v2/auth hosts additional tooling. Key artifact: C:\Program Files\Common Files\beacon.dll (SHA256: a91a9088dc61dfa074cc496bf630cae738dd44967ad31a4e96a210cd616dbeb2).


Blog Post by INTERPOL: Tracking Ember Bear's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-23031 against MOVEit Transfer deployments. The initial access vector involves spear-phishing emails from hr@document-share.link delivering SmokeLoader. Post-compromise, the attackers deploy Qbot and use Sliver for reconnaissance. C2 infrastructure includes 172.218.192.50 and backupportal.link. A staging server at https://datadata.xyz/gate.php hosts additional tooling. Key artifact: C:\Program Files\Common Files\helper.sh (MD5: 0eeb77513d93383a1d309b5599e37af6).


Blog Post by Cisco Talos: Tracking Ember Bear's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-43392 against Fortinet FortiGate deployments. The initial access vector involves spear-phishing emails from ceo@account-update.xyz delivering DanaBot. Post-compromise, the attackers deploy LockBit and use CrackMapExec for reconnaissance. C2 infrastructure includes 192.38.176.1 and cloud-proxy.info. A staging server at https://edge-proxy.xyz/secure/token hosts additional tooling. Key artifact: C:\Users\Public\Documents\implant.so (SHA256: 9383b1f64be5d04e8eef7cb896bcede2d784adb71536e8d74e4038d4629c2ed3).


Blog Post by Trend Micro: Tracking APT28's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2026-35009 against Citrix NetScaler deployments. The initial access vector involves spear-phishing emails from confirm@auth-check.org delivering RemcosRAT. Post-compromise, the attackers deploy Emotet and use Nmap for reconnaissance. C2 infrastructure includes 7.244.218.42 and sync-mail.cc. A staging server at http://relaydata.site/login hosts additional tooling. Key artifact: C:\Users\Public\Documents\implant.so (SHA1: fa5956a7d8611623d4d1033b0aef96c346caf9de).


Blog Post by NCSC: Tracking Lazarus Group's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-25256 against Cisco ASA deployments. The initial access vector involves spear-phishing emails from updates@secure-verify.net delivering PlugX. Post-compromise, the attackers deploy AsyncRAT and use PowerShell Empire for reconnaissance. C2 infrastructure includes 94.104.225.166 and noderelay.link. A staging server at https://nodestatic.top/admin/config hosts additional tooling. Key artifact: /var/tmp/taskhost.exe (MD5: e43ad5c1bb92065f33714edb50954a2e).


Blog Post by Rapid7: Tracking UNC2452's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-33283 against Active Directory deployments. The initial access vector involves spear-phishing emails from security@secure-verify.net delivering Meduza Stealer. Post-compromise, the attackers deploy WarmCookie and use Nmap for reconnaissance. C2 infrastructure includes 17.222.124.217 and securestorage.online. A staging server at https://proxyproxy.online/wp-content/uploads/doc.php hosts additional tooling. Key artifact: C:\Windows\System32\helper.sh (MD5: 9232bfa04385a15de7c2c5d84f6f0132).


Blog Post by NSA: Tracking FIN11's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2024-35928 against Cisco ASA deployments. The initial access vector involves spear-phishing emails from support@auth-check.org delivering BatLoader. Post-compromise, the attackers deploy ShadowPad and use Brute Ratel for reconnaissance. C2 infrastructure includes 192.41.240.86 and proxycache.live. A staging server at hxxps://login-secure.live/admin/config hosts additional tooling. Key artifact: C:\Windows\Temp\winlogon.exe (SHA256: babdb4bd3156a7ba713973ecc41eb38e029b52603a0bcfea19674e7e5598dab5).


Blog Post by Trend Micro: Tracking BlackTech's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2024-27359 against Atlassian Confluence deployments. The initial access vector involves spear-phishing emails from verify@secure-verify.net delivering Conti. Post-compromise, the attackers deploy PlugX and use PsExec for reconnaissance. C2 infrastructure includes 73.16.165.187 and cache-data.info. A staging server at hxxp://securebackup.site/admin/config hosts additional tooling. Key artifact: C:\Windows\System32\runtime.dll (SHA1: 0b462a466b69be91392bd2f0a7caa06e5145bb13).


Blog Post by INTERPOL: Tracking FIN7's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-38077 against Atlassian Confluence deployments. The initial access vector involves spear-phishing emails from alert@document-share.link delivering BumbleBee. Post-compromise, the attackers deploy QakBot and use Seatbelt for reconnaissance. C2 infrastructure includes 10.190.99.225 and staticproxy.tech. A staging server at hxxp://cache-portal.link/panel/index.html hosts additional tooling. Key artifact: C:\Users\admin\Desktop\svchost.exe (SHA256: 7c438a6638a18b87b6145c9a3bdbf0395687ba6e0f234ec9418a7b3dfa27d9a8).


Blog Post by NSA: Tracking Ember Bear's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2024-25010 against F5 BIG-IP deployments. The initial access vector involves spear-phishing emails from contact@phishing-domain.com delivering Latrodectus. Post-compromise, the attackers deploy Qbot and use Seatbelt for reconnaissance. C2 infrastructure includes 192.243.97.120 and datacdn.cc. A staging server at hxxp://relaydata.cc/callback hosts additional tooling. Key artifact: /dev/shm/shell.php (MD5: 7e302aee93139d9f3aaf9a363fe1eba1).


Blog Post by FBI: Tracking Charming Kitten's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-24328 against Apache Struts deployments. The initial access vector involves spear-phishing emails from security@account-update.xyz delivering RemcosRAT. Post-compromise, the attackers deploy NjRAT and use Mimikatz for reconnaissance. C2 infrastructure includes 94.23.227.181 and static-portal.org. A staging server at http://api-update.dev/collect hosts additional tooling. Key artifact: C:\Users\admin\Desktop\csrss.exe (SHA256: 9739e7ee2596811e3a8b997e0c7dba2c3595da01467962c343640b24164a72c6).


Blog Post by Microsoft MSRC: Tracking Midnight Blizzard's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-26043 against Cisco ASA deployments. The initial access vector involves spear-phishing emails from confirm@credential-check.site delivering PikaBot. Post-compromise, the attackers deploy REvil and use Chisel for reconnaissance. C2 infrastructure includes 10.170.155.172 and mail-gateway.online. A staging server at https://api-relay.online/wp-content/uploads/doc.php hosts additional tooling. Key artifact: C:\Users\admin\Downloads\backdoor.elf (SHA1: 10f4fe817ab1e1efab56f2cb7805e98cc6a3caf3).


Blog Post by Rapid7: Tracking UNC2452's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-37666 against Windows 11 deployments. The initial access vector involves spear-phishing emails from verify@account-update.xyz delivering RemcosRAT. Post-compromise, the attackers deploy Latrodectus and use Impacket for reconnaissance. C2 infrastructure includes 2.253.168.183 and cloudedge.link. A staging server at http://mail-cloud.club/secure/token hosts additional tooling. Key artifact: C:\Program Files\Common Files\loader.exe (SHA1: 7152a2dd386c6afb2d701303f4ed9e5f933540e5).


Blog Post by Cisco Talos: Tracking Salt Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-20484 against Windows Server 2019 deployments. The initial access vector involves spear-phishing emails from confirm@credential-check.site delivering Meduza Stealer. Post-compromise, the attackers deploy RedLine Stealer and use BloodHound for reconnaissance. C2 infrastructure includes 22.97.23.105 and relaysecure.net. A staging server at http://edge-auth.tech/panel/index.html hosts additional tooling. Key artifact: C:\Windows\Temp\config.dat (SHA256: fc536cd5fbaeb7819a4cee31a137e680f7cb9e0491bcda395ec5b99312d319f3).


Blog Post by FBI: Tracking Salt Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-20016 against MOVEit Transfer deployments. The initial access vector involves spear-phishing emails from notification@phishing-domain.com delivering PikaBot. Post-compromise, the attackers deploy NjRAT and use PsExec for reconnaissance. C2 infrastructure includes 10.147.87.80 and data-proxy.net. A staging server at http://dataupdate.live/assets/js/payload.js hosts additional tooling. Key artifact: /etc/cron.d/loader.exe (SHA256: 2f19f8492457076d00340766316fd4ddacf8fe7136b1136c73f39eb00b0f9314).


Blog Post by Cisco Talos: Tracking APT29's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2026-17507 against Palo Alto PAN-OS deployments. The initial access vector involves spear-phishing emails from it@auth-check.org delivering FormBook. Post-compromise, the attackers deploy Latrodectus and use Nmap for reconnaissance. C2 infrastructure includes 200.63.216.114 and cloud-edge.site. A staging server at http://storagegateway.com/gate.php hosts additional tooling. Key artifact: /etc/cron.d/sam.hive (MD5: 3ff7213f45bf0e819c0752d43de0f75d).


Blog Post by Rapid7: Tracking FIN7's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-17296 against Atlassian Confluence deployments. The initial access vector involves spear-phishing emails from confirm@auth-check.org delivering RemcosRAT. Post-compromise, the attackers deploy Gootloader and use Metasploit for reconnaissance. C2 infrastructure includes 124.66.181.251 and backup-cdn.org. A staging server at hxxps://edgestatic.club/login hosts additional tooling. Key artifact: /opt/app/bin/loader.exe (SHA1: 79c08e77f2ee94783432e33d9eb054e7e67d7960).


Blog Post by CISA: Tracking Mustang Panda's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2026-17507 against Apache Struts deployments. The initial access vector involves spear-phishing emails from finance@document-share.link delivering Royal. Post-compromise, the attackers deploy NjRAT and use PowerShell Empire for reconnaissance. C2 infrastructure includes 201.241.76.12 and login-backup.net. A staging server at hxxps://backup-api.tech/gate.php hosts additional tooling. Key artifact: /var/tmp/taskhost.exe (SHA1: 83f9f90e2439e89e30ca90486e0c9b146586b992).


Blog Post by Proofpoint: Tracking Volt Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-32298 against SonicWall SMA deployments. The initial access vector involves spear-phishing emails from support@mail-service.info delivering Emotet. Post-compromise, the attackers deploy PikaBot and use PowerView for reconnaissance. C2 infrastructure includes 10.175.187.162 and gatewayapi.xyz. A staging server at https://updatesync.online/login hosts additional tooling. Key artifact: /opt/app/bin/dropper.ps1 (SHA256: d836f74d29aa07470b6cf68c09ea5d33405a0c73ec69b3bf84822ac1fc297343).


Blog Post by Trend Micro: Tracking APT29's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-24110 against F5 BIG-IP deployments. The initial access vector involves spear-phishing emails from billing@urgent-notice.online delivering Latrodectus. Post-compromise, the attackers deploy Lumma Stealer and use CrackMapExec for reconnaissance. C2 infrastructure includes 172.19.196.80 and staticdata.tech. A staging server at hxxp://mailnode.com/admin/config hosts additional tooling. Key artifact: /tmp/lsass.dmp (MD5: bbb1185956f9f0adf771cf433842c869).


Blog Post by Trend Micro: Tracking Ember Bear's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2024-23934 against Atlassian Confluence deployments. The initial access vector involves spear-phishing emails from helpdesk@document-share.link delivering BlackCat. Post-compromise, the attackers deploy REvil and use Burp Suite for reconnaissance. C2 infrastructure includes 172.19.113.61 and apibackup.live. A staging server at http://sync-sync.top/callback hosts additional tooling. Key artifact: C:\Users\admin\AppData\Local\Temp\update.dll (SHA1: dcd96c0aac828c800d24d08d2704332046d832be).


Blog Post by Volexity: Tracking APT29's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-24628 against Active Directory deployments. The initial access vector involves spear-phishing emails from verify@phishing-domain.com delivering SmokeLoader. Post-compromise, the attackers deploy AgentTesla and use SharpHound for reconnaissance. C2 infrastructure includes 127.84.161.27 and updatecache.site. A staging server at http://relay-cdn.cc/wp-content/uploads/doc.php hosts additional tooling. Key artifact: C:\Users\Public\Documents\lsass.dmp (SHA256: eefcdddac4d795c844e61cda7c36a1a9f36c063c111b779e2e4ed7e2e761816d).


Blog Post by Dragos: Tracking MuddyWater's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-24628 against Microsoft Exchange deployments. The initial access vector involves spear-phishing emails from it@credential-check.site delivering Latrodectus. Post-compromise, the attackers deploy Ryuk and use PsExec for reconnaissance. C2 infrastructure includes 98.55.92.141 and mail-cdn.net. A staging server at http://syncstorage.info/callback hosts additional tooling. Key artifact: /var/tmp/taskhost.exe (SHA256: 46af085ad0580bc51aad8c02bc7b54a5071b9eb2e5dc43dae80e5b690ffc74b8).


Blog Post by Microsoft MSRC: Tracking Salt Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-10425 against Citrix NetScaler deployments. The initial access vector involves spear-phishing emails from confirm@phishing-domain.com delivering AgentTesla. Post-compromise, the attackers deploy Play and use Sliver for reconnaissance. C2 infrastructure includes 104.231.202.45 and cache-mail.dev. A staging server at https://cachebackup.online/secure/token hosts additional tooling. Key artifact: C:\Windows\Tasks\taskhost.exe (SHA256: d8dd15f178b09d732cce8ffbaa8d97fc5e55f6cd49389827c69445eaf91d7579).


Blog Post by CISA: Tracking Silk Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2024-36290 against F5 BIG-IP deployments. The initial access vector involves spear-phishing emails from hr@mail-service.info delivering Play. Post-compromise, the attackers deploy Dridex and use Seatbelt for reconnaissance. C2 infrastructure includes 172.18.142.45 and apisync.live. A staging server at http://relayapi.dev/secure/token hosts additional tooling. Key artifact: C:\Users\Public\Documents\csrss.exe (SHA256: 226a86d3d459837bae7b43f9d0d98af3f0b81d6cfa2d0d8d5967158f10523cd9).


Blog Post by Google TAG: Tracking Storm-0558's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2026-17507 against Citrix NetScaler deployments. The initial access vector involves spear-phishing emails from verify@identity-verify.cc delivering SmokeLoader. Post-compromise, the attackers deploy Gootloader and use Chisel for reconnaissance. C2 infrastructure includes 190.146.188.66 and cache-auth.live. A staging server at https://relay-edge.com/collect hosts additional tooling. Key artifact: C:\Windows\System32\svchost.exe (SHA1: f6f23dcef0c2ac3e493599b0f8333e310bed15f3).


Blog Post by INTERPOL: Tracking Sandworm's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-39714 against Progress Telerik deployments. The initial access vector involves spear-phishing emails from admin@account-update.xyz delivering Latrodectus. Post-compromise, the attackers deploy Hive and use Brute Ratel for reconnaissance. C2 infrastructure includes 84.84.159.231 and proxy-gateway.com. A staging server at http://backupauth.info/portal/verify hosts additional tooling. Key artifact: C:\Program Files\Common Files\taskhost.exe (MD5: 6db6d55057415dfc296f7704db422d73).


Blog Post by Cisco Talos: Tracking BlackTech's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2024-25010 against Ivanti Connect Secure deployments. The initial access vector involves spear-phishing emails from it@mail-service.info delivering Hive. Post-compromise, the attackers deploy Gootloader and use CrackMapExec for reconnaissance. C2 infrastructure includes 99.44.101.37 and loginapi.xyz. A staging server at hxxps://authmail.tech/login hosts additional tooling. Key artifact: C:\Windows\System32\csrss.exe (SHA1: 9c3c41038693c84cdcdaf6a402bc7f351473e57a).


Blog Post by Huntress: Tracking Mustang Panda's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2024-35928 against Cisco ASA deployments. The initial access vector involves spear-phishing emails from security@document-share.link delivering Amadey. Post-compromise, the attackers deploy NjRAT and use Mimikatz for reconnaissance. C2 infrastructure includes 192.140.88.179 and relay-secure.online. A staging server at hxxp://login-portal.xyz/portal/verify hosts additional tooling. Key artifact: /tmp/beacon.dll (SHA256: 40edeaaf535ba54e0182d5a36ed9cf10d78e89f6d03b1390525c01a23f169bc5).


Blog Post by NSA: Tracking Diamond Sleet's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-38077 against F5 BIG-IP deployments. The initial access vector involves spear-phishing emails from alert@document-share.link delivering Ryuk. Post-compromise, the attackers deploy BumbleBee and use CrackMapExec for reconnaissance. C2 infrastructure includes 172.126.124.40 and loginrelay.online. A staging server at https://relaybackup.site/panel/index.html hosts additional tooling. Key artifact: /home/user/.config/lsass.dmp (SHA1: b28ef6a1283f2db3bfc21a24982664a865f2b1bc).


Blog Post by NCSC: Tracking Midnight Blizzard's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-16338 against MOVEit Transfer deployments. The initial access vector involves spear-phishing emails from admin@auth-check.org delivering ShadowPad. Post-compromise, the attackers deploy Gootloader and use BITSAdmin for reconnaissance. C2 infrastructure includes 69.99.37.52 and proxymail.top. A staging server at https://secureportal.site/assets/js/payload.js hosts additional tooling. Key artifact: /var/tmp/lsass.dmp (SHA1: 5d176d92465695888d1639974a3adb706d9ef024).


Blog Post by Check Point Research: Tracking Storm-0558's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-34807 against Windows 11 deployments. The initial access vector involves spear-phishing emails from confirm@login-portal.tech delivering PlugX. Post-compromise, the attackers deploy BatLoader and use SharpHound for reconnaissance. C2 infrastructure includes 10.203.63.231 and auth-proxy.online. A staging server at hxxps://storage-data.info/wp-content/uploads/doc.php hosts additional tooling. Key artifact: /tmp/runtime.dll (SHA1: 13ab2b97f6851cfedf113f3bcf87502e1136d94a).


Blog Post by Palo Alto Unit 42: Tracking UNC2452's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-24628 against VMware ESXi deployments. The initial access vector involves spear-phishing emails from alert@auth-check.org delivering RemcosRAT. Post-compromise, the attackers deploy Ryuk and use LaZagne for reconnaissance. C2 infrastructure includes 104.143.5.41 and gateway-login.io. A staging server at https://auth-static.xyz/wp-content/uploads/doc.php hosts additional tooling. Key artifact: /usr/local/bin/helper.sh (SHA256: 4605af2baca54892eb0e528de909c882e832bbb79835d920b82ccec650ad7829).


Blog Post by Europol: Tracking Ember Bear's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2026-44676 against Microsoft Exchange deployments. The initial access vector involves spear-phishing emails from service@auth-check.org delivering WarmCookie. Post-compromise, the attackers deploy Ryuk and use Chisel for reconnaissance. C2 infrastructure includes 208.44.162.149 and update-portal.link. A staging server at hxxp://updatenode.site/wp-content/uploads/doc.php hosts additional tooling. Key artifact: C:\Users\admin\AppData\Local\Temp\agent.py (SHA1: 7c76e0e435d5769753e9ef14e3382297f2afdb68).


Blog Post by Proofpoint: Tracking APT29's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-40108 against Citrix NetScaler deployments. The initial access vector involves spear-phishing emails from contact@account-update.xyz delivering LockBit. Post-compromise, the attackers deploy FormBook and use Merlin for reconnaissance. C2 infrastructure includes 221.253.67.38 and authedge.club. A staging server at hxxp://gateway-auth.link/secure/token hosts additional tooling. Key artifact: C:\ProgramData\update.dll (SHA256: dcb75c1482b5488b1f4c10758a22d0df145208752ae302b55d9140ab262e16b5).


Blog Post by NSA: Tracking TA505's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2026-49052 against Progress Telerik deployments. The initial access vector involves spear-phishing emails from contact@auth-check.org delivering Cobalt Strike. Post-compromise, the attackers deploy IcedID and use Hashcat for reconnaissance. C2 infrastructure includes 167.9.202.35 and cdn-cache.cc. A staging server at http://mailsecure.live/panel/index.html hosts additional tooling. Key artifact: C:\Users\admin\AppData\Local\Temp\dropper.ps1 (MD5: 2f5a4aa81fc5b23b4f455355bf057e75).


Blog Post by Cisco Talos: Tracking Storm-0558's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-46789 against Barracuda ESG deployments. The initial access vector involves spear-phishing emails from billing@document-share.link delivering Latrodectus. Post-compromise, the attackers deploy Dridex and use Seatbelt for reconnaissance. C2 infrastructure includes 10.148.21.114 and proxy-cloud.com. A staging server at hxxp://apisync.link/collect hosts additional tooling. Key artifact: C:\Windows\Temp\implant.so (SHA256: 475242e819fcd357b0b5d78c9b6e6f410039cd4d3d5695019321bbe14316c093).


Blog Post by Symantec: Tracking Mustang Panda's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-46789 against Fortinet FortiGate deployments. The initial access vector involves spear-phishing emails from security@credential-check.site delivering TrickBot. Post-compromise, the attackers deploy QakBot and use Hashcat for reconnaissance. C2 infrastructure includes 204.20.246.2 and backup-proxy.info. A staging server at hxxp://relaystatic.io/api/v2/auth hosts additional tooling. Key artifact: /var/tmp/dropper.ps1 (SHA256: f6e609251a8e96d7b5f3ea9745bafb71a701e32093b066d0b750769f66a7fa7a).


Blog Post by Palo Alto Unit 42: Tracking Silk Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-22601 against Fortinet FortiGate deployments. The initial access vector involves spear-phishing emails from finance@login-portal.tech delivering NjRAT. Post-compromise, the attackers deploy DarkSide and use CrackMapExec for reconnaissance. C2 infrastructure includes 192.232.89.247 and synccdn.net. A staging server at https://cachedata.io/gate.php hosts additional tooling. Key artifact: C:\ProgramData\loader.exe (MD5: 7a20372900beaae2a906634d904ca020).


Blog Post by NCSC: Tracking Volt Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-23730 against Zyxel USG deployments. The initial access vector involves spear-phishing emails from it@phishing-domain.com delivering AsyncRAT. Post-compromise, the attackers deploy RedLine Stealer and use ADFind for reconnaissance. C2 infrastructure includes 10.243.88.189 and gatewaycloud.site. A staging server at http://staticnode.xyz/secure/token hosts additional tooling. Key artifact: /usr/local/bin/winlogon.exe (MD5: 29ea80e8d5037c463e08a207acf116c4).


Blog Post by NCSC: Tracking FIN7's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-48698 against Windows Server 2019 deployments. The initial access vector involves spear-phishing emails from account@phishing-domain.com delivering WarmCookie. Post-compromise, the attackers deploy Qbot and use Chisel for reconnaissance. C2 infrastructure includes 192.237.16.158 and cloud-auth.online. A staging server at hxxp://auth-api.link/secure/token hosts additional tooling. Key artifact: /home/user/.config/runtime.dll (SHA1: 809e6d4042bada9bccb9acfff618ee5c6f943c9f).


Blog Post by Cisco Talos: Tracking FIN7's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-33723 against MOVEit Transfer deployments. The initial access vector involves spear-phishing emails from admin@identity-verify.cc delivering Conti. Post-compromise, the attackers deploy RedLine Stealer and use PowerView for reconnaissance. C2 infrastructure includes 68.9.59.13 and backup-portal.com. A staging server at hxxp://static-cloud.dev/secure/token hosts additional tooling. Key artifact: C:\Users\admin\Downloads\config.dat (SHA256: 1563c768f146f70543dc95a83e36c0623fd9de6607697482fd8521b0849f0232).


Blog Post by Rapid7: Tracking Volt Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-46781 against Cisco ASA deployments. The initial access vector involves spear-phishing emails from admin@secure-verify.net delivering QakBot. Post-compromise, the attackers deploy DanaBot and use SharpHound for reconnaissance. C2 infrastructure includes 34.197.204.215 and data-auth.site. A staging server at hxxp://backup-cdn.dev/wp-content/uploads/doc.php hosts additional tooling. Key artifact: /dev/shm/chrome_helper.exe (SHA256: 8a7790351e3a349454b62034b153635b13f6bcd13923e54cbd5432af1eaa804f).


Blog Post by Secureworks: Tracking Midnight Blizzard's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-20708 against Atlassian Confluence deployments. The initial access vector involves spear-phishing emails from contact@credential-check.site delivering Conti. Post-compromise, the attackers deploy StealC and use GhostPack for reconnaissance. C2 infrastructure includes 190.128.23.86 and static-cache.tech. A staging server at hxxps://edge-api.cc/login hosts additional tooling. Key artifact: /var/tmp/csrss.exe (MD5: 4c7917741f20b5f84af8cf17ae2e2999).


Blog Post by Google TAG: Tracking Granite Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2024-35928 against Ubuntu 22.04 deployments. The initial access vector involves spear-phishing emails from support@identity-verify.cc delivering FormBook. Post-compromise, the attackers deploy Play and use Chisel for reconnaissance. C2 infrastructure includes 205.221.122.93 and sync-auth.xyz. A staging server at http://login-secure.link/gate.php hosts additional tooling. Key artifact: C:\Program Files\Common Files\winlogon.exe (SHA256: ce0bc6bbfd7c953197f2fde2e94b49f22d4d166845f73127deb5ed6c76585d5b).


Blog Post by Volexity: Tracking Storm-0558's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-27335 against Palo Alto PAN-OS deployments. The initial access vector involves spear-phishing emails from noreply@credential-check.site delivering TrickBot. Post-compromise, the attackers deploy REvil and use Burp Suite for reconnaissance. C2 infrastructure includes 115.225.227.74 and backup-cache.com. A staging server at https://proxyapi.online/wp-content/uploads/doc.php hosts additional tooling. Key artifact: /dev/shm/csrss.exe (SHA256: 108e15a4b95f2ef2b4f6cfa92d9fc771d41780eebac192d3f2330c9a1472098f).


Blog Post by Google TAG: Tracking Volt Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-49086 against Juniper SRX deployments. The initial access vector involves spear-phishing emails from finance@urgent-notice.online delivering Conti. Post-compromise, the attackers deploy RemcosRAT and use LaZagne for reconnaissance. C2 infrastructure includes 172.127.50.123 and storage-auth.net. A staging server at https://sync-secure.club/api/v2/auth hosts additional tooling. Key artifact: /home/user/.config/csrss.exe (SHA256: 14797e8e9fefc0f7e9532123098f1004724058d4b04c540e678ded969aa38825).


Blog Post by Symantec: Tracking TA505's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-46781 against Palo Alto PAN-OS deployments. The initial access vector involves spear-phishing emails from verify@phishing-domain.com delivering FormBook. Post-compromise, the attackers deploy PlugX and use SharpHound for reconnaissance. C2 infrastructure includes 20.240.135.24 and gateway-portal.cc. A staging server at hxxps://backupstorage.top/panel/index.html hosts additional tooling. Key artifact: /tmp/backdoor.elf (MD5: 56453130dc7b949fbbbe2172f0b21ef9).


Blog Post by CrowdStrike: Tracking Silk Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2026-46256 against Cisco ASA deployments. The initial access vector involves spear-phishing emails from account@secure-verify.net delivering Conti. Post-compromise, the attackers deploy Dridex and use Merlin for reconnaissance. C2 infrastructure includes 172.14.198.27 and cdn-auth.net. A staging server at hxxp://relay-cloud.io/api/v2/auth hosts additional tooling. Key artifact: C:\Windows\Tasks\config.dat (SHA1: 72d9accf70316f50e473b0cf5e8b14b57ab6c44b).


Blog Post by CrowdStrike: Tracking FIN7's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2024-27359 against Ivanti Connect Secure deployments. The initial access vector involves spear-phishing emails from finance@secure-verify.net delivering RemcosRAT. Post-compromise, the attackers deploy Amadey and use BITSAdmin for reconnaissance. C2 infrastructure includes 67.6.15.17 and storage-backup.live. A staging server at http://portal-cdn.club/panel/index.html hosts additional tooling. Key artifact: C:\Users\Public\Documents\ntds.dit (SHA256: c9ad87adeb44641dea3e88702c42da0d8fcad6e2a5fc25b0046477f5bdf44457).


Blog Post by Qualys: Tracking FIN11's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-40108 against Apache Struts deployments. The initial access vector involves spear-phishing emails from contact@mail-service.info delivering Royal. Post-compromise, the attackers deploy SystemBC and use Seatbelt for reconnaissance. C2 infrastructure includes 10.129.242.82 and portalgateway.org. A staging server at hxxp://nodelogin.org/login hosts additional tooling. Key artifact: C:\Windows\System32\chrome_helper.exe (SHA1: a8979b5fdbc61c0d00087022fc18632cf895becd).


Blog Post by Rapid7: Tracking Lazarus Group's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-27219 against Windows 11 deployments. The initial access vector involves spear-phishing emails from finance@identity-verify.cc delivering XLoader. Post-compromise, the attackers deploy BatLoader and use Nmap for reconnaissance. C2 infrastructure includes 192.178.50.161 and staticlogin.xyz. A staging server at hxxp://gatewayportal.tech/api/v2/auth hosts additional tooling. Key artifact: /usr/local/bin/winlogon.exe (MD5: e3668e49da0ee6ca77b6d75b5c433e4f).


Blog Post by Cisco Talos: Tracking Velvet Tempest's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-27496 against MOVEit Transfer deployments. The initial access vector involves spear-phishing emails from finance@identity-verify.cc delivering Play. Post-compromise, the attackers deploy Ryuk and use Sliver for reconnaissance. C2 infrastructure includes 3.220.17.200 and backupauth.net. A staging server at hxxp://proxy-auth.dev/admin/config hosts additional tooling. Key artifact: /var/tmp/taskhost.exe (SHA1: 2d007e7c1e33565f80d3c49ab463efa4367ba1b3).


Blog Post by Huntress: Tracking Star Blizzard's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-12082 against F5 BIG-IP deployments. The initial access vector involves spear-phishing emails from finance@credential-check.site delivering Emotet. Post-compromise, the attackers deploy Qbot and use Certutil for reconnaissance. C2 infrastructure includes 148.164.231.192 and cdnauth.io. A staging server at https://update-sync.net/admin/config hosts additional tooling. Key artifact: /home/user/.config/beacon.dll (MD5: deb94b484cffb043cd2a1ac8af0e12c6).


Blog Post by ESET Research: Tracking FIN7's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2026-35216 against Microsoft Exchange deployments. The initial access vector involves spear-phishing emails from hr@phishing-domain.com delivering SystemBC. Post-compromise, the attackers deploy Play and use Chisel for reconnaissance. C2 infrastructure includes 195.244.17.25 and nodemail.org. A staging server at http://dataapi.top/secure/token hosts additional tooling. Key artifact: /tmp/beacon.dll (SHA256: 099dbd3ad43882f07caa6a921144ecdf799a1f8014e9556082ef91ff94fb59e1).


Blog Post by CrowdStrike: Tracking Lazarus Group's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-45322 against Barracuda ESG deployments. The initial access vector involves spear-phishing emails from updates@account-update.xyz delivering Conti. Post-compromise, the attackers deploy PikaBot and use Hashcat for reconnaissance. C2 infrastructure includes 69.9.183.44 and storage-mail.com. A staging server at hxxps://proxycache.org/panel/index.html hosts additional tooling. Key artifact: C:\Users\admin\Desktop\lsass.dmp (MD5: e9e689604677074b8b40aca1db8d0536).


Blog Post by NSA: Tracking APT29's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-40108 against Apache Struts deployments. The initial access vector involves spear-phishing emails from support@identity-verify.cc delivering Vidar. Post-compromise, the attackers deploy Royal and use LinPEAS for reconnaissance. C2 infrastructure includes 172.48.46.153 and synccdn.link. A staging server at hxxps://secureproxy.io/panel/index.html hosts additional tooling. Key artifact: /tmp/chrome_helper.exe (SHA1: ef454b124e0163623f8223e1014c400250e8147d).


Blog Post by Huntress: Tracking Kimsuky's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2024-30673 against Progress Telerik deployments. The initial access vector involves spear-phishing emails from billing@urgent-notice.online delivering LockBit. Post-compromise, the attackers deploy Conti and use Brute Ratel for reconnaissance. C2 infrastructure includes 192.76.82.54 and api-secure.tech. A staging server at https://proxyproxy.org/login hosts additional tooling. Key artifact: /etc/cron.d/ntds.dit (SHA1: d9218ab7e99297e3288418aa3f93ef809a7ac4c6).