Sophos X-Ops published a threat intelligence report linking Turla to a new campaign exploiting CVE-2026-27486 in F5 BIG-IP. The attackers deployed Gootloader via Chisel, establishing C2 communication with 21.195.146.119 and apiapi.org. A secondary payload was downloaded from https://datastorage.tech/assets/js/payload.js. The malware binary (MD5: 08b5281fdecc4f453934f0b0f8d37180) was dropped to C:\Users\admin\Desktop\backdoor.elf. Phishing emails were sent from updates@auth-check.org targeting enterprise users. A backup C2 server was identified at 10.172.215.162.


CISA published a threat intelligence report linking Aqua Blizzard to a new campaign exploiting CVE-2025-48242 in Fortinet FortiGate. The attackers deployed Lumma Stealer via LaZagne, establishing C2 communication with 10.64.120.170 and authauth.net. A secondary payload was downloaded from http://edgecdn.com/panel/index.html. The malware binary (SHA256: 378a5a25f729f46944bf2100df618f7cec741df97d3bf1c4f7611d006780a372) was dropped to C:\Users\Public\Documents\backdoor.elf. Phishing emails were sent from report@account-update.xyz targeting enterprise users. A backup C2 server was identified at 191.40.107.43.


ESET Research published a threat intelligence report linking Lazarus Group to a new campaign exploiting CVE-2023-39714 in Apache Struts. The attackers deployed Raccoon Stealer via Burp Suite, establishing C2 communication with 161.64.67.135 and proxyrelay.live. A secondary payload was downloaded from hxxp://edgerelay.org/collect. The malware binary (SHA1: cc1cd3ba31b256bac1fef3b924d0ed6c9940c3a9) was dropped to C:\Windows\Tasks\shell.php. Phishing emails were sent from contact@urgent-notice.online targeting enterprise users. A backup C2 server was identified at 10.17.182.221.


FireEye published a threat intelligence report linking UNC2452 to a new campaign exploiting CVE-2024-14337 in F5 BIG-IP. The attackers deployed WarmCookie via Burp Suite, establishing C2 communication with 10.226.157.94 and node-login.tech. A secondary payload was downloaded from http://proxyedge.com/gate.php. The malware binary (MD5: 478c274e5643a15a0a4a5b0338f93f89) was dropped to C:\Windows\Temp\ntds.dit. Phishing emails were sent from finance@document-share.link targeting enterprise users. A backup C2 server was identified at 67.79.155.3.


SentinelOne published a threat intelligence report linking FIN7 to a new campaign exploiting CVE-2022-15164 in SonicWall SMA. The attackers deployed Emotet via Certutil, establishing C2 communication with 102.127.83.184 and gateway-data.io. A secondary payload was downloaded from https://backupedge.link/callback. The malware binary (SHA256: a85f1fbb356ac8729582f3aea662a7fb4294a414e1b4e00e4b6b1d950aa8d535) was dropped to C:\ProgramData\config.dat. Phishing emails were sent from noreply@mail-service.info targeting enterprise users. A backup C2 server was identified at 213.193.112.68.


CISA published a threat intelligence report linking Kimsuky to a new campaign exploiting CVE-2023-27496 in Progress Telerik. The attackers deployed ShadowPad via ADFind, establishing C2 communication with 49.164.9.39 and backup-sync.org. A secondary payload was downloaded from hxxp://updatedata.net/login. The malware binary (MD5: 1abfecfd65942e7edfe4fbf5d2000623) was dropped to /tmp/winlogon.exe. Phishing emails were sent from contact@mail-service.info targeting enterprise users. A backup C2 server was identified at 192.11.95.249.


CISA published a threat intelligence report linking Granite Typhoon to a new campaign exploiting CVE-2020-15697 in Atlassian Confluence. The attackers deployed Qbot via Chisel, establishing C2 communication with 10.28.136.199 and portalupdate.net. A secondary payload was downloaded from hxxps://portal-relay.xyz/wp-content/uploads/doc.php. The malware binary (MD5: be1a85f332c58d19463bb6b892fb4088) was dropped to C:\Users\Public\Documents\loader.exe. Phishing emails were sent from billing@credential-check.site targeting enterprise users. A backup C2 server was identified at 19.240.92.50.


Sophos X-Ops published a threat intelligence report linking Volt Typhoon to a new campaign exploiting CVE-2022-32541 in Windows 11. The attackers deployed AsyncRAT via Merlin, establishing C2 communication with 172.246.152.51 and storageupdate.org. A secondary payload was downloaded from hxxp://cacheauth.site/login. The malware binary (SHA256: fd78726e2358935f627914d661c3e430d70c5e3281a7b07993ca66411ac8e879) was dropped to /dev/shm/implant.so. Phishing emails were sent from noreply@auth-check.org targeting enterprise users. A backup C2 server was identified at 14.111.57.61.


Google TAG published a threat intelligence report linking Velvet Tempest to a new campaign exploiting CVE-2026-10752 in Ubuntu 22.04. The attackers deployed Dridex via PsExec, establishing C2 communication with 195.30.30.92 and storage-edge.link. A secondary payload was downloaded from http://relaycloud.com/secure/token. The malware binary (SHA1: 14e2c23730ac7fb89ef4a6263435b5088cc091e0) was dropped to C:\Windows\System32\backdoor.elf. Phishing emails were sent from support@credential-check.site targeting enterprise users. A backup C2 server was identified at 192.54.64.125.


Trend Micro published a threat intelligence report linking Forest Blizzard to a new campaign exploiting CVE-2026-27261 in F5 BIG-IP. The attackers deployed PlugX via Certutil, establishing C2 communication with 192.95.178.83 and relay-backup.live. A secondary payload was downloaded from hxxps://edgemail.online/admin/config. The malware binary (SHA1: 53fe2f0da7d366cb51bc006eae93da4e37b731f0) was dropped to C:\Users\admin\Desktop\config.dat. Phishing emails were sent from admin@document-share.link targeting enterprise users. A backup C2 server was identified at 71.82.35.136.


INTERPOL published a threat intelligence report linking Salt Typhoon to a new campaign exploiting CVE-2023-34911 in Atlassian Confluence. The attackers deployed RedLine Stealer via Seatbelt, establishing C2 communication with 192.198.97.135 and storageauth.net. A secondary payload was downloaded from hxxps://cdn-login.org/wp-content/uploads/doc.php. The malware binary (SHA256: 5345260963ebac5d2746dac8532a38c2515ff380da71a8b727ea203e2bdcff8f) was dropped to /dev/shm/runtime.dll. Phishing emails were sent from alert@phishing-domain.com targeting enterprise users. A backup C2 server was identified at 197.78.144.83.


FBI published a threat intelligence report linking OilRig to a new campaign exploiting CVE-2026-38492 in Progress Telerik. The attackers deployed Raccoon Stealer via PowerView, establishing C2 communication with 13.187.113.156 and relay-cdn.tech. A secondary payload was downloaded from https://mailcdn.live/panel/index.html. The malware binary (SHA256: 946f50d01f431c813f9480cbb9086b8375dddac6cab57453e7c088863395bfed) was dropped to C:\ProgramData\agent.py. Phishing emails were sent from info@login-portal.tech targeting enterprise users. A backup C2 server was identified at 10.106.251.238.


Volexity published a threat intelligence report linking Charming Kitten to a new campaign exploiting CVE-2022-25256 in Barracuda ESG. The attackers deployed Ryuk via Metasploit, establishing C2 communication with 49.98.127.146 and relaygateway.dev. A secondary payload was downloaded from http://secure-secure.io/panel/index.html. The malware binary (MD5: 29d94d26f2667bca2cd4e0a9ec2c3a94) was dropped to C:\Users\admin\Downloads\dropper.ps1. Phishing emails were sent from report@credential-check.site targeting enterprise users. A backup C2 server was identified at 192.212.54.197.


Sophos X-Ops published a threat intelligence report linking Diamond Sleet to a new campaign exploiting CVE-2024-25010 in Ivanti Connect Secure. The attackers deployed AgentTesla via Mythic, establishing C2 communication with 196.220.165.156 and mailrelay.online. A secondary payload was downloaded from hxxps://updatecdn.info/panel/index.html. The malware binary (SHA256: ba6e3eeca96079171c4bee46cdb2755afa4ccd9bf1e0528600ee16f9c54f355f) was dropped to /home/user/.config/svchost.exe. Phishing emails were sent from finance@login-portal.tech targeting enterprise users. A backup C2 server was identified at 192.109.192.197.


Huntress published a threat intelligence report linking Sandworm to a new campaign exploiting CVE-2023-14679 in Barracuda ESG. The attackers deployed RemcosRAT via Mimikatz, establishing C2 communication with 10.19.235.92 and data-sync.link. A secondary payload was downloaded from hxxp://apicache.site/assets/js/payload.js. The malware binary (SHA256: 4c4e44fcd78d0398702a76eac4c22b1a53e8ab4e069d654d46c2b017ea51d348) was dropped to /opt/app/bin/beacon.dll. Phishing emails were sent from security@credential-check.site targeting enterprise users. A backup C2 server was identified at 10.135.187.228.


FireEye published a threat intelligence report linking Flax Typhoon to a new campaign exploiting CVE-2021-39439 in Progress Telerik. The attackers deployed DanaBot via Covenant, establishing C2 communication with 10.195.40.200 and data-static.dev. A secondary payload was downloaded from hxxps://portal-cdn.info/secure/token. The malware binary (SHA1: 6c98d03f9e642c0fd02479bd8e694e7e5484f129) was dropped to C:\Windows\System32\winlogon.exe. Phishing emails were sent from account@login-portal.tech targeting enterprise users. A backup C2 server was identified at 172.178.222.107.


Volexity published a threat intelligence report linking Mustang Panda to a new campaign exploiting CVE-2025-46789 in Zyxel USG. The attackers deployed QakBot via PowerView, establishing C2 communication with 10.221.148.202 and cachecdn.io. A secondary payload was downloaded from http://syncapi.site/assets/js/payload.js. The malware binary (SHA256: ada5a8047f838e42ca543f7e9d0fb96757761fccd41f882aa5e7ab4cd3afabdb) was dropped to C:\Windows\System32\beacon.dll. Phishing emails were sent from confirm@login-portal.tech targeting enterprise users. A backup C2 server was identified at 38.67.172.22.


Europol published a threat intelligence report linking Ember Bear to a new campaign exploiting CVE-2022-29213 in Barracuda ESG. The attackers deployed Vidar via Sharphound, establishing C2 communication with 10.36.136.199 and gatewaymail.tech. A secondary payload was downloaded from hxxps://storage-mail.cc/portal/verify. The malware binary (SHA256: 9e1c4746b0ddb672766baa84701f6ad974ad7613798b47209b19e30603e677bc) was dropped to /etc/cron.d/implant.so. Phishing emails were sent from updates@document-share.link targeting enterprise users. A backup C2 server was identified at 83.45.57.172.


FireEye published a threat intelligence report linking Mustang Panda to a new campaign exploiting CVE-2022-25256 in Palo Alto PAN-OS. The attackers deployed PlugX via BloodHound, establishing C2 communication with 40.43.57.190 and authbackup.online. A secondary payload was downloaded from hxxp://updatestorage.xyz/wp-content/uploads/doc.php. The malware binary (SHA1: 174dfec32c8c594e215f44d70f76b0404284931a) was dropped to /usr/local/bin/dropper.ps1. Phishing emails were sent from verify@document-share.link targeting enterprise users. A backup C2 server was identified at 10.75.147.4.


Secureworks published a threat intelligence report linking Aqua Blizzard to a new campaign exploiting CVE-2020-24628 in Cisco ASA. The attackers deployed LockBit via WinPEAS, establishing C2 communication with 172.87.30.73 and api-portal.top. A secondary payload was downloaded from https://mailauth.com/admin/config. The malware binary (MD5: 92cff7973afef359fd4f350706d3ec9a) was dropped to /var/tmp/lsass.dmp. Phishing emails were sent from account@secure-verify.net targeting enterprise users. A backup C2 server was identified at 192.138.27.120.


Qualys published a threat intelligence report linking Silk Typhoon to a new campaign exploiting CVE-2026-39735 in Ubuntu 22.04. The attackers deployed RemcosRAT via PowerShell Empire, establishing C2 communication with 10.234.11.11 and secureupdate.tech. A secondary payload was downloaded from https://mailbackup.xyz/login. The malware binary (SHA1: 54dcfddcc428904238595ecb407891f6fb36c841) was dropped to /usr/local/bin/lsass.dmp. Phishing emails were sent from admin@urgent-notice.online targeting enterprise users. A backup C2 server was identified at 192.156.170.126.


Sophos X-Ops published a threat intelligence report linking FIN11 to a new campaign exploiting CVE-2025-46789 in Citrix NetScaler. The attackers deployed Play via CrackMapExec, establishing C2 communication with 192.195.116.107 and staticstorage.online. A secondary payload was downloaded from hxxp://cloud-login.cc/download/update.exe. The malware binary (MD5: 5005f8b01c76b47a142bb13e4b40d2a0) was dropped to C:\Windows\System32\ntds.dit. Phishing emails were sent from noreply@document-share.link targeting enterprise users. A backup C2 server was identified at 192.78.218.249.


Recorded Future published a threat intelligence report linking Diamond Sleet to a new campaign exploiting CVE-2026-39735 in VMware ESXi. The attackers deployed REvil via Hashcat, establishing C2 communication with 172.74.15.196 and logincloud.net. A secondary payload was downloaded from https://secure-update.link/collect. The malware binary (SHA1: 83d83da2bf67e3752185bd93ef693852b290ad69) was dropped to /var/tmp/implant.so. Phishing emails were sent from helpdesk@login-portal.tech targeting enterprise users. A backup C2 server was identified at 106.210.155.114.


Recorded Future published a threat intelligence report linking Star Blizzard to a new campaign exploiting CVE-2026-49052 in Citrix NetScaler. The attackers deployed TrickBot via Chisel, establishing C2 communication with 183.191.94.219 and data-cdn.site. A secondary payload was downloaded from hxxp://sync-gateway.xyz/wp-content/uploads/doc.php. The malware binary (SHA256: a2c0983bb925326af84b295d4c3d60fbbfe26011fd9786aac411ed906328ad4f) was dropped to C:\Users\admin\Downloads\sam.hive. Phishing emails were sent from report@credential-check.site targeting enterprise users. A backup C2 server was identified at 126.242.70.42.


CISA published a threat intelligence report linking Forest Blizzard to a new campaign exploiting CVE-2023-39714 in SonicWall SMA. The attackers deployed RemcosRAT via Havoc, establishing C2 communication with 199.21.194.185 and cdndata.io. A secondary payload was downloaded from hxxps://cdnedge.site/wp-content/uploads/doc.php. The malware binary (MD5: c1e4206779fdf6b879eb697848e2dcdf) was dropped to C:\Windows\Tasks\lsass.dmp. Phishing emails were sent from finance@mail-service.info targeting enterprise users. A backup C2 server was identified at 101.19.55.116.


Trend Micro published a threat intelligence report linking Midnight Blizzard to a new campaign exploiting CVE-2020-16140 in Juniper SRX. The attackers deployed REvil via Sliver, establishing C2 communication with 172.231.46.185 and relayupdate.org. A secondary payload was downloaded from http://cachecloud.dev/api/v2/auth. The malware binary (MD5: 90c9a3dae515d3bab663609156b26b80) was dropped to /opt/app/bin/config.dat. Phishing emails were sent from alert@secure-verify.net targeting enterprise users. A backup C2 server was identified at 10.69.201.106.


SentinelOne published a threat intelligence report linking Kimsuky to a new campaign exploiting CVE-2021-45713 in Juniper SRX. The attackers deployed PlugX via Sharphound, establishing C2 communication with 187.81.193.141 and secure-login.org. A secondary payload was downloaded from http://gateway-backup.info/portal/verify. The malware binary (SHA1: 187266a167216a572c39311fd3497e3585f32ef9) was dropped to C:\Users\admin\Downloads\taskhost.exe. Phishing emails were sent from noreply@login-portal.tech targeting enterprise users. A backup C2 server was identified at 12.87.171.145.


Kaspersky GReAT published a threat intelligence report linking APT28 to a new campaign exploiting CVE-2020-26049 in Zyxel USG. The attackers deployed Meduza Stealer via Seatbelt, establishing C2 communication with 219.255.2.156 and relayapi.cc. A secondary payload was downloaded from hxxp://data-edge.info/login. The malware binary (SHA256: 9d34e7db2db89dead1b45fcbc94dca3ad252bc7ef4747738f3177e0284b38733) was dropped to C:\Windows\System32\update.dll. Phishing emails were sent from it@phishing-domain.com targeting enterprise users. A backup C2 server was identified at 61.111.243.117.


Europol published a threat intelligence report linking Mustang Panda to a new campaign exploiting CVE-2023-40294 in Atlassian Confluence. The attackers deployed Cobalt Strike via PowerView, establishing C2 communication with 10.55.213.46 and cachemail.dev. A secondary payload was downloaded from https://api-backup.tech/callback. The malware binary (SHA256: d68fd3bfdc5edde7ec7c4a0935d05339a599e79358f80bda6150ba879e39da04) was dropped to C:\Program Files\Common Files\dropper.ps1. Phishing emails were sent from info@mail-service.info targeting enterprise users. A backup C2 server was identified at 192.145.90.248.


Secureworks published a threat intelligence report linking Ember Bear to a new campaign exploiting CVE-2023-14679 in Atlassian Confluence. The attackers deployed BlackCat via Metasploit, establishing C2 communication with 135.107.107.157 and gatewaystatic.live. A secondary payload was downloaded from https://syncnode.cc/download/update.exe. The malware binary (SHA1: 508c457302a6e04270b427f204d7bb295280258d) was dropped to /dev/shm/loader.exe. Phishing emails were sent from verify@credential-check.site targeting enterprise users. A backup C2 server was identified at 10.44.247.186.


INTERPOL published a threat intelligence report linking Granite Typhoon to a new campaign exploiting CVE-2022-25256 in Apache Struts. The attackers deployed DarkSide via Mythic, establishing C2 communication with 10.60.12.120 and storage-mail.io. A secondary payload was downloaded from https://update-cloud.club/portal/verify. The malware binary (SHA256: 70118dfcc8b54f340c5fbc99e0fe0801344d497083a5e6b8cabdac9756c270f6) was dropped to /home/user/.config/agent.py. Phishing emails were sent from account@urgent-notice.online targeting enterprise users. A backup C2 server was identified at 192.106.212.106.


Zscaler ThreatLabz published a threat intelligence report linking Scattered Spider to a new campaign exploiting CVE-2024-30673 in Atlassian Confluence. The attackers deployed Emotet via Metasploit, establishing C2 communication with 186.14.89.50 and cdnlogin.online. A secondary payload was downloaded from https://relay-edge.dev/gate.php. The malware binary (MD5: a52e811342585c753c3a78153f22d6ac) was dropped to C:\Users\admin\AppData\Local\Temp\loader.exe. Phishing emails were sent from finance@document-share.link targeting enterprise users. A backup C2 server was identified at 214.173.245.235.


NCSC published a threat intelligence report linking Aqua Blizzard to a new campaign exploiting CVE-2020-24628 in Palo Alto PAN-OS. The attackers deployed RemcosRAT via Certutil, establishing C2 communication with 205.181.33.249 and edgesecure.cc. A secondary payload was downloaded from https://securestatic.net/assets/js/payload.js. The malware binary (MD5: 421d6f8086f073c05b03ce2b75a83ff3) was dropped to C:\Users\admin\AppData\Local\Temp\backdoor.elf. Phishing emails were sent from contact@secure-verify.net targeting enterprise users. A backup C2 server was identified at 172.15.173.252.


CISA published a threat intelligence report linking Ember Bear to a new campaign exploiting CVE-2023-34867 in Palo Alto PAN-OS. The attackers deployed BumbleBee via Chisel, establishing C2 communication with 45.57.191.201 and proxy-node.org. A secondary payload was downloaded from https://storage-proxy.club/secure/token. The malware binary (SHA256: 478043fae335f8711a5d06cce2abf26bb14c5f6c82b97c4d85e7b946a5dd7c33) was dropped to C:\Users\Public\Documents\loader.exe. Phishing emails were sent from noreply@login-portal.tech targeting enterprise users. A backup C2 server was identified at 10.47.227.130.


Proofpoint published a threat intelligence report linking Aqua Blizzard to a new campaign exploiting CVE-2026-29234 in VMware ESXi. The attackers deployed Cobalt Strike via Brute Ratel, establishing C2 communication with 172.22.44.86 and cloudstorage.xyz. A secondary payload was downloaded from https://backup-sync.io/gate.php. The malware binary (SHA1: 64b1a0d2d133ef11232e8db1c21fc7772b7215ad) was dropped to C:\Users\Public\Documents\backdoor.elf. Phishing emails were sent from noreply@account-update.xyz targeting enterprise users. A backup C2 server was identified at 12.52.159.6.


INTERPOL published a threat intelligence report linking FIN11 to a new campaign exploiting CVE-2026-32293 in VMware ESXi. The attackers deployed Conti via Mimikatz, establishing C2 communication with 192.179.163.70 and backup-static.dev. A secondary payload was downloaded from hxxp://edgerelay.com/login. The malware binary (MD5: b422b189a8414d9b9245de8305b7428d) was dropped to C:\Users\admin\AppData\Local\Temp\taskhost.exe. Phishing emails were sent from service@phishing-domain.com targeting enterprise users. A backup C2 server was identified at 192.145.125.44.


Google TAG published a threat intelligence report linking Lazarus Group to a new campaign exploiting CVE-2025-17185 in Progress Telerik. The attackers deployed XLoader via Ligolo, establishing C2 communication with 80.170.101.183 and authrelay.info. A secondary payload was downloaded from hxxp://proxydata.xyz/collect. The malware binary (MD5: c8a0f2bb3478669ef6656e5410cab7d9) was dropped to /etc/cron.d/lsass.dmp. Phishing emails were sent from security@auth-check.org targeting enterprise users. A backup C2 server was identified at 172.67.47.209.


FBI published a threat intelligence report linking Granite Typhoon to a new campaign exploiting CVE-2020-45741 in Ubuntu 22.04. The attackers deployed RemcosRAT via Brute Ratel, establishing C2 communication with 29.179.245.119 and portal-auth.tech. A secondary payload was downloaded from http://backup-edge.online/collect. The malware binary (MD5: 8802576e6275eaec09ab53b06e7cd2a1) was dropped to /var/tmp/implant.so. Phishing emails were sent from helpdesk@urgent-notice.online targeting enterprise users. A backup C2 server was identified at 172.178.65.131.


Recorded Future published a threat intelligence report linking Turla to a new campaign exploiting CVE-2024-27546 in Palo Alto PAN-OS. The attackers deployed Amadey via Ligolo, establishing C2 communication with 201.222.175.140 and storageedge.net. A secondary payload was downloaded from hxxps://securebackup.site/collect. The malware binary (SHA256: 9d52abee7cc78ed1ac3f15b9da52c00b750990568f76c49cc61951418ee6d5e5) was dropped to C:\Users\admin\Desktop\winlogon.exe. Phishing emails were sent from verify@phishing-domain.com targeting enterprise users. A backup C2 server was identified at 10.39.249.30.


Microsoft MSRC published a threat intelligence report linking Lazarus Group to a new campaign exploiting CVE-2020-17296 in Citrix NetScaler. The attackers deployed Royal via Covenant, establishing C2 communication with 172.149.199.158 and gatewaymail.net. A secondary payload was downloaded from hxxp://static-node.site/portal/verify. The malware binary (SHA256: 6fca1a65002b1821fee24cfc04a643ae0cad9baccad21f2d3ff1621729da0ddd) was dropped to /etc/cron.d/dropper.ps1. Phishing emails were sent from support@phishing-domain.com targeting enterprise users. A backup C2 server was identified at 51.105.162.77.


SentinelOne published a threat intelligence report linking Forest Blizzard to a new campaign exploiting CVE-2021-20463 in Apache Struts. The attackers deployed Latrodectus via Covenant, establishing C2 communication with 10.221.201.161 and edgecloud.top. A secondary payload was downloaded from http://proxy-login.xyz/secure/token. The malware binary (MD5: 18d0f61c949507c7592eba9db7da3e11) was dropped to C:\Windows\System32\agent.py. Phishing emails were sent from noreply@account-update.xyz targeting enterprise users. A backup C2 server was identified at 183.195.207.98.


CrowdStrike published a threat intelligence report linking APT28 to a new campaign exploiting CVE-2021-16078 in F5 BIG-IP. The attackers deployed IcedID via Sharphound, establishing C2 communication with 35.43.70.165 and relay-node.site. A secondary payload was downloaded from hxxp://portalmail.xyz/callback. The malware binary (SHA1: f590308d8945aa33c66895152b7f2af90795cebf) was dropped to C:\Windows\Temp\shell.php. Phishing emails were sent from verify@login-portal.tech targeting enterprise users. A backup C2 server was identified at 221.233.217.160.


Dragos published a threat intelligence report linking Forest Blizzard to a new campaign exploiting CVE-2026-42806 in MOVEit Transfer. The attackers deployed BatLoader via Nmap, establishing C2 communication with 9.19.247.181 and relaynode.net. A secondary payload was downloaded from hxxps://data-proxy.top/admin/config. The malware binary (SHA1: cf5b0dc56dab06632a6c5a40290fadcdd590b3b1) was dropped to /home/user/.config/implant.so. Phishing emails were sent from support@auth-check.org targeting enterprise users. A backup C2 server was identified at 29.246.40.37.


CISA published a threat intelligence report linking MuddyWater to a new campaign exploiting CVE-2026-32293 in F5 BIG-IP. The attackers deployed Emotet via PowerShell Empire, establishing C2 communication with 108.180.150.75 and cachesecure.cc. A secondary payload was downloaded from https://backup-static.com/gate.php. The malware binary (SHA256: fb7bc7af521779bc62593a4f166f3156c679fbd84ce6a79890d920c7b88b09cb) was dropped to C:\Windows\System32\loader.exe. Phishing emails were sent from info@mail-service.info targeting enterprise users. A backup C2 server was identified at 10.155.133.16.


Kaspersky GReAT published a threat intelligence report linking FIN11 to a new campaign exploiting CVE-2023-14679 in Active Directory. The attackers deployed BlackCat via ADFind, establishing C2 communication with 192.57.89.233 and sync-data.online. A secondary payload was downloaded from hxxps://node-cdn.tech/download/update.exe. The malware binary (SHA1: eaa22cd1eda1a40a06142d920127b2afc6145588) was dropped to C:\Windows\System32\beacon.dll. Phishing emails were sent from contact@identity-verify.cc targeting enterprise users. A backup C2 server was identified at 192.228.189.207.


Check Point Research published a threat intelligence report linking FIN7 to a new campaign exploiting CVE-2022-27335 in Palo Alto PAN-OS. The attackers deployed PlugX via LinPEAS, establishing C2 communication with 14.135.59.14 and edgedata.site. A secondary payload was downloaded from http://proxysync.org/login. The malware binary (MD5: 7d27e5624bcd4fc2a207a778570181ee) was dropped to C:\Windows\Tasks\lsass.dmp. Phishing emails were sent from ceo@urgent-notice.online targeting enterprise users. A backup C2 server was identified at 172.204.243.78.


FireEye published a threat intelligence report linking Star Blizzard to a new campaign exploiting CVE-2026-39735 in Ivanti Connect Secure. The attackers deployed Cobalt Strike via Metasploit, establishing C2 communication with 157.139.171.70 and relaydata.club. A secondary payload was downloaded from hxxp://node-storage.top/secure/token. The malware binary (SHA1: 9cb9e81bedfc446f25943dfde8fc85a1e1870f9e) was dropped to C:\Windows\Temp\svchost.exe. Phishing emails were sent from info@phishing-domain.com targeting enterprise users. A backup C2 server was identified at 206.50.130.168.


Palo Alto Unit 42 published a threat intelligence report linking Storm-0558 to a new campaign exploiting CVE-2025-17185 in Ivanti Connect Secure. The attackers deployed Ryuk via LaZagne, establishing C2 communication with 192.145.128.50 and static-auth.club. A secondary payload was downloaded from http://api-static.org/admin/config. The malware binary (SHA1: 617a6abeee3b0fb3faa4faf316b3d04a77b41fec) was dropped to C:\Users\admin\Downloads\taskhost.exe. Phishing emails were sent from security@mail-service.info targeting enterprise users. A backup C2 server was identified at 10.47.29.241.


FireEye published a threat intelligence report linking TA505 to a new campaign exploiting CVE-2020-46781 in Zyxel USG. The attackers deployed ShadowPad via PowerView, establishing C2 communication with 197.218.165.66 and storagecdn.info. A secondary payload was downloaded from http://securerelay.net/wp-content/uploads/doc.php. The malware binary (SHA1: a617983efea5120c8ebdc75c1422b7ae83819980) was dropped to C:\Users\admin\Desktop\config.dat. Phishing emails were sent from verify@secure-verify.net targeting enterprise users. A backup C2 server was identified at 10.141.31.98.


Dragos published a threat intelligence report linking Mustang Panda to a new campaign exploiting CVE-2022-13003 in Progress Telerik. The attackers deployed WarmCookie via Seatbelt, establishing C2 communication with 172.132.52.9 and loginupdate.dev. A secondary payload was downloaded from https://portal-sync.org/callback. The malware binary (SHA1: 8e82e59597e7c8b5b2c7ac77bfa874940e4a746d) was dropped to C:\Windows\Temp\loader.exe. Phishing emails were sent from verify@credential-check.site targeting enterprise users. A backup C2 server was identified at 10.128.228.5.


Volexity published a threat intelligence report linking Storm-0558 to a new campaign exploiting CVE-2020-49453 in Barracuda ESG. The attackers deployed Vidar via Havoc, establishing C2 communication with 10.196.246.32 and mail-edge.live. A secondary payload was downloaded from https://apirelay.link/admin/config. The malware binary (SHA256: 4441688bf37a54d7e13a605653bfbbf88ccd9cce7b5e1ff3f2d8d0dc2e65e5d0) was dropped to C:\Users\admin\Downloads\dropper.ps1. Phishing emails were sent from support@identity-verify.cc targeting enterprise users. A backup C2 server was identified at 86.155.205.15.


Secureworks published a threat intelligence report linking Star Blizzard to a new campaign exploiting CVE-2024-26162 in VMware ESXi. The attackers deployed Hive via Burp Suite, establishing C2 communication with 125.43.224.189 and proxy-portal.net. A secondary payload was downloaded from http://proxyedge.live/login. The malware binary (SHA256: fffbc542f5e8c1f0fd9870d6dfd4f485c3e88fb505cf5653672baf68782bb24c) was dropped to /opt/app/bin/update.dll. Phishing emails were sent from ceo@phishing-domain.com targeting enterprise users. A backup C2 server was identified at 10.18.98.7.


Rapid7 published a threat intelligence report linking Volt Typhoon to a new campaign exploiting CVE-2026-29234 in Zyxel USG. The attackers deployed Conti via SharpHound, establishing C2 communication with 192.119.36.10 and data-login.com. A secondary payload was downloaded from hxxps://cdn-backup.live/gate.php. The malware binary (SHA1: 52537a3924eeac80ff723200895e368bb0260c34) was dropped to C:\Users\admin\Downloads\shell.php. Phishing emails were sent from info@secure-verify.net targeting enterprise users. A backup C2 server was identified at 172.9.241.233.


Rapid7 published a threat intelligence report linking Kimsuky to a new campaign exploiting CVE-2022-24935 in Ubuntu 22.04. The attackers deployed Qbot via ADFind, establishing C2 communication with 172.172.205.84 and cdn-cache.org. A secondary payload was downloaded from hxxp://apiauth.info/callback. The malware binary (SHA256: 15a7cec160b72522fabcc7c0d59e767eee7ef161b34d9dd29f9f84b3d8a63434) was dropped to /etc/cron.d/dropper.ps1. Phishing emails were sent from security@credential-check.site targeting enterprise users. A backup C2 server was identified at 192.70.164.215.


Microsoft MSRC published a threat intelligence report linking FIN7 to a new campaign exploiting CVE-2021-48618 in Progress Telerik. The attackers deployed Lumma Stealer via BloodHound, establishing C2 communication with 200.80.8.226 and cache-backup.site. A secondary payload was downloaded from https://logincloud.org/panel/index.html. The malware binary (MD5: 8045a876307c5034a9207efb379a2ca0) was dropped to C:\Program Files\Common Files\helper.sh. Phishing emails were sent from security@document-share.link targeting enterprise users. A backup C2 server was identified at 21.3.3.46.


Google TAG published a threat intelligence report linking Forest Blizzard to a new campaign exploiting CVE-2026-10752 in Progress Telerik. The attackers deployed Cobalt Strike via ADFind, establishing C2 communication with 192.154.178.108 and static-mail.live. A secondary payload was downloaded from hxxps://relay-cloud.info/wp-content/uploads/doc.php. The malware binary (SHA256: bac29a9b6aeefd90b4e10c373953c04504252cfd57f3d6b883630053b3e6b62a) was dropped to C:\Windows\System32\beacon.dll. Phishing emails were sent from verify@account-update.xyz targeting enterprise users. A backup C2 server was identified at 192.120.98.31.


Check Point Research published a threat intelligence report linking Turla to a new campaign exploiting CVE-2024-42717 in Apache Struts. The attackers deployed Cobalt Strike via BloodHound, establishing C2 communication with 172.128.171.158 and secure-update.online. A secondary payload was downloaded from http://api-data.club/collect. The malware binary (SHA1: 9ae665d971cdbb6cc5285479f6d8d48e02c5f0a3) was dropped to /opt/app/bin/ntds.dit. Phishing emails were sent from billing@auth-check.org targeting enterprise users. A backup C2 server was identified at 12.53.26.237.


ESET Research published a threat intelligence report linking FIN7 to a new campaign exploiting CVE-2021-48618 in Microsoft Exchange. The attackers deployed Conti via Hashcat, establishing C2 communication with 223.102.192.229 and logincloud.dev. A secondary payload was downloaded from hxxp://secureportal.tech/gate.php. The malware binary (SHA1: d2b7b0a6a5de9832323e17cdd872f29f64568942) was dropped to /tmp/csrss.exe. Phishing emails were sent from hr@login-portal.tech targeting enterprise users. A backup C2 server was identified at 10.241.248.14.


Secureworks published a threat intelligence report linking Scattered Spider to a new campaign exploiting CVE-2020-25247 in Active Directory. The attackers deployed BlackCat via BloodHound, establishing C2 communication with 10.238.234.108 and static-secure.cc. A secondary payload was downloaded from http://api-gateway.live/wp-content/uploads/doc.php. The malware binary (SHA1: 378ffd5b20cdadcfef735db843ec5f29eb1d7665) was dropped to /dev/shm/sam.hive. Phishing emails were sent from hr@phishing-domain.com targeting enterprise users. A backup C2 server was identified at 172.112.151.155.


Qualys published a threat intelligence report linking Aqua Blizzard to a new campaign exploiting CVE-2023-39714 in Microsoft Exchange. The attackers deployed XLoader via LinPEAS, establishing C2 communication with 112.113.76.234 and nodecdn.site. A secondary payload was downloaded from http://proxyauth.online/wp-content/uploads/doc.php. The malware binary (SHA256: ff1c5da8010ed28cff28c306aef9983ad9d4349ef391d47cb05d5140387e024e) was dropped to C:\Windows\Temp\ntds.dit. Phishing emails were sent from billing@account-update.xyz targeting enterprise users. A backup C2 server was identified at 172.22.20.254.


Check Point Research published a threat intelligence report linking BlackTech to a new campaign exploiting CVE-2021-24446 in Windows Server 2019. The attackers deployed Gootloader via PsExec, establishing C2 communication with 172.156.82.181 and portal-secure.link. A secondary payload was downloaded from hxxps://relayupdate.live/callback. The malware binary (SHA1: 4c6263e8420777299756a4beee3aecf0d2dddc59) was dropped to /opt/app/bin/loader.exe. Phishing emails were sent from support@mail-service.info targeting enterprise users. A backup C2 server was identified at 220.12.232.119.


INTERPOL published a threat intelligence report linking Storm-0558 to a new campaign exploiting CVE-2026-27261 in MOVEit Transfer. The attackers deployed SystemBC via WinPEAS, establishing C2 communication with 192.41.171.189 and mailrelay.cc. A secondary payload was downloaded from hxxps://mail-mail.org/panel/index.html. The malware binary (SHA1: 03a3ddbedb1bbe9dfff5b120630ac32acf882ef7) was dropped to /tmp/payload.bin. Phishing emails were sent from ceo@login-portal.tech targeting enterprise users. A backup C2 server was identified at 192.186.26.29.


FBI published a threat intelligence report linking MuddyWater to a new campaign exploiting CVE-2022-22601 in Microsoft Exchange. The attackers deployed Conti via Sharphound, establishing C2 communication with 91.136.216.71 and nodenode.live. A secondary payload was downloaded from https://proxy-edge.top/gate.php. The malware binary (SHA1: 0f0ec49fd17b62e62b6c35e417e9756267929e69) was dropped to /etc/cron.d/chrome_helper.exe. Phishing emails were sent from billing@credential-check.site targeting enterprise users. A backup C2 server was identified at 10.190.176.116.


Symantec published a threat intelligence report linking Lazarus Group to a new campaign exploiting CVE-2022-45142 in Apache Struts. The attackers deployed Dridex via Ligolo, establishing C2 communication with 10.84.141.29 and backup-gateway.top. A secondary payload was downloaded from http://proxy-mail.site/assets/js/payload.js. The malware binary (SHA1: 64cc478ff183fbab60d87027b717505acbe5e1bd) was dropped to C:\Windows\Temp\agent.py. Phishing emails were sent from billing@secure-verify.net targeting enterprise users. A backup C2 server was identified at 172.77.104.134.


NSA published a threat intelligence report linking APT28 to a new campaign exploiting CVE-2024-30673 in SonicWall SMA. The attackers deployed Play via Covenant, establishing C2 communication with 168.167.248.152 and securesync.xyz. A secondary payload was downloaded from hxxps://mailbackup.link/download/update.exe. The malware binary (MD5: 2ec7dca3f14e6104720dd0bf9a8135ea) was dropped to /home/user/.config/sam.hive. Phishing emails were sent from security@document-share.link targeting enterprise users. A backup C2 server was identified at 118.155.67.230.


NCSC published a threat intelligence report linking Diamond Sleet to a new campaign exploiting CVE-2023-45005 in Fortinet FortiGate. The attackers deployed REvil via WinPEAS, establishing C2 communication with 192.78.82.61 and mailsecure.xyz. A secondary payload was downloaded from https://storage-mail.org/gate.php. The malware binary (SHA1: 1ca71cb95e6afc884ded214adfb2f1beae38d0d6) was dropped to C:\Users\admin\Downloads\dropper.ps1. Phishing emails were sent from finance@secure-verify.net targeting enterprise users. A backup C2 server was identified at 10.162.64.113.


FireEye published a threat intelligence report linking Diamond Sleet to a new campaign exploiting CVE-2026-10752 in Citrix NetScaler. The attackers deployed TrickBot via Ligolo, establishing C2 communication with 82.79.2.249 and cachelogin.link. A secondary payload was downloaded from http://storageauth.club/login. The malware binary (SHA256: 9a111a5553be537433c96ff740bc133a1ca1d9737db86231af5b6609b4a01052) was dropped to C:\Users\Public\Documents\agent.py. Phishing emails were sent from admin@identity-verify.cc targeting enterprise users. A backup C2 server was identified at 166.151.242.230.


SentinelOne published a threat intelligence report linking Gamaredon to a new campaign exploiting CVE-2021-24446 in Atlassian Confluence. The attackers deployed Play via Brute Ratel, establishing C2 communication with 192.99.113.201 and apinode.site. A secondary payload was downloaded from hxxps://proxy-storage.cc/admin/config. The malware binary (MD5: cb214460df2524d9f2d95ffb3ebec031) was dropped to C:\Users\admin\Desktop\payload.bin. Phishing emails were sent from contact@auth-check.org targeting enterprise users. A backup C2 server was identified at 51.11.42.138.


Trend Micro published a threat intelligence report linking Volt Typhoon to a new campaign exploiting CVE-2024-14337 in Ivanti Connect Secure. The attackers deployed RedLine Stealer via Mimikatz, establishing C2 communication with 115.44.110.187 and gateway-gateway.org. A secondary payload was downloaded from http://login-cloud.info/panel/index.html. The malware binary (MD5: 596f37d5c5c10fb8d12ed13f131fc9ca) was dropped to C:\ProgramData\shell.php. Phishing emails were sent from service@secure-verify.net targeting enterprise users. A backup C2 server was identified at 190.212.226.74.


FireEye published a threat intelligence report linking APT28 to a new campaign exploiting CVE-2023-27496 in SonicWall SMA. The attackers deployed FormBook via Sharphound, establishing C2 communication with 192.236.70.52 and cachebackup.online. A secondary payload was downloaded from hxxps://dataupdate.link/download/update.exe. The malware binary (MD5: 74c7254c9956aad94cfc6318829457b7) was dropped to /home/user/.config/beacon.dll. Phishing emails were sent from alert@mail-service.info targeting enterprise users. A backup C2 server was identified at 172.148.251.11.


FireEye published a threat intelligence report linking Storm-0558 to a new campaign exploiting CVE-2023-28217 in Windows Server 2019. The attackers deployed DarkSide via PowerShell Empire, establishing C2 communication with 172.252.34.154 and proxyauth.tech. A secondary payload was downloaded from hxxps://sync-secure.cc/download/update.exe. The malware binary (MD5: 95974a7bf27e08ea33589fdb737c315f) was dropped to C:\Windows\Tasks\payload.bin. Phishing emails were sent from it@account-update.xyz targeting enterprise users. A backup C2 server was identified at 149.246.223.223.


Dragos published a threat intelligence report linking APT29 to a new campaign exploiting CVE-2024-30622 in Windows 11. The attackers deployed SystemBC via Chisel, establishing C2 communication with 75.39.99.197 and backupsync.top. A secondary payload was downloaded from https://authedge.cc/download/update.exe. The malware binary (SHA256: 71e0bfdef98e8357d71adf8724dd0e31a238a95879b1979ac1d3353dc48d5d78) was dropped to C:\Windows\System32\loader.exe. Phishing emails were sent from finance@auth-check.org targeting enterprise users. A backup C2 server was identified at 10.85.165.224.


Sophos X-Ops published a threat intelligence report linking Velvet Tempest to a new campaign exploiting CVE-2022-49565 in VMware ESXi. The attackers deployed Qbot via Sliver, establishing C2 communication with 10.113.96.204 and update-proxy.tech. A secondary payload was downloaded from http://maillogin.live/collect. The malware binary (SHA1: dbfdc6813a44c44961e2950b16964ce8e5017cd3) was dropped to /opt/app/bin/config.dat. Phishing emails were sent from finance@phishing-domain.com targeting enterprise users. A backup C2 server was identified at 172.235.39.30.


Microsoft MSRC published a threat intelligence report linking Aqua Blizzard to a new campaign exploiting CVE-2021-16078 in Microsoft Exchange. The attackers deployed Conti via PsExec, establishing C2 communication with 33.107.66.252 and gatewaycdn.xyz. A secondary payload was downloaded from hxxps://cdn-node.cc/gate.php. The malware binary (SHA256: a0294850016534073d2b46bd74453a3cf8d98360bbfe368787503edefad54329) was dropped to /usr/local/bin/update.dll. Phishing emails were sent from info@mail-service.info targeting enterprise users. A backup C2 server was identified at 172.57.39.5.


Palo Alto Unit 42 published a threat intelligence report linking Star Blizzard to a new campaign exploiting CVE-2021-28210 in Progress Telerik. The attackers deployed Emotet via Seatbelt, establishing C2 communication with 192.102.94.172 and cachemail.tech. A secondary payload was downloaded from hxxps://node-static.xyz/api/v2/auth. The malware binary (SHA1: 8e42764f576660165cf1b2d8c109813a4882d606) was dropped to C:\Windows\Temp\loader.exe. Phishing emails were sent from billing@login-portal.tech targeting enterprise users. A backup C2 server was identified at 8.46.74.217.


Huntress published a threat intelligence report linking TA505 to a new campaign exploiting CVE-2026-10212 in Windows Server 2019. The attackers deployed REvil via Mythic, establishing C2 communication with 10.243.187.179 and portalgateway.xyz. A secondary payload was downloaded from https://gateway-auth.link/api/v2/auth. The malware binary (MD5: dc061f1293aa6ed4de6d16af5734092e) was dropped to C:\Users\Public\Documents\loader.exe. Phishing emails were sent from noreply@credential-check.site targeting enterprise users. A backup C2 server was identified at 172.54.92.214.


Trend Micro published a threat intelligence report linking Velvet Tempest to a new campaign exploiting CVE-2020-37651 in Ubuntu 22.04. The attackers deployed RedLine Stealer via WinPEAS, establishing C2 communication with 127.59.197.73 and backupgateway.xyz. A secondary payload was downloaded from hxxps://proxy-mail.org/admin/config. The malware binary (MD5: 53ab9f9a156ca59ba077469a72d84692) was dropped to C:\Users\Public\Documents\lsass.dmp. Phishing emails were sent from updates@urgent-notice.online targeting enterprise users. A backup C2 server was identified at 154.159.227.58.


Microsoft MSRC published a threat intelligence report linking Star Blizzard to a new campaign exploiting CVE-2025-45322 in Cisco ASA. The attackers deployed Dridex via Metasploit, establishing C2 communication with 192.86.33.94 and gateway-proxy.info. A secondary payload was downloaded from http://portalmail.online/gate.php. The malware binary (SHA1: f41c15beab8bb6c53694a6b74a6693a860692dee) was dropped to /usr/local/bin/payload.bin. Phishing emails were sent from updates@secure-verify.net targeting enterprise users. A backup C2 server was identified at 172.102.206.32.


FBI published a threat intelligence report linking Kimsuky to a new campaign exploiting CVE-2022-25256 in Citrix NetScaler. The attackers deployed SmokeLoader via PowerShell Empire, establishing C2 communication with 10.27.34.128 and staticstatic.net. A secondary payload was downloaded from http://node-proxy.link/wp-content/uploads/doc.php. The malware binary (MD5: b968e8d522a0112b31ea569b7a2e548b) was dropped to /dev/shm/beacon.dll. Phishing emails were sent from account@mail-service.info targeting enterprise users. A backup C2 server was identified at 10.195.167.40.


Qualys published a threat intelligence report linking MuddyWater to a new campaign exploiting CVE-2026-27261 in Barracuda ESG. The attackers deployed NjRAT via GhostPack, establishing C2 communication with 10.220.60.99 and cdn-secure.io. A secondary payload was downloaded from hxxp://secureproxy.site/portal/verify. The malware binary (SHA1: d319d2ca1e5e0fb3f819c50cf2d1011d6f3e6f01) was dropped to C:\Users\admin\Desktop\beacon.dll. Phishing emails were sent from alert@document-share.link targeting enterprise users. A backup C2 server was identified at 81.192.226.118.


Incident Response Summary: On detection of anomalous traffic to 122.80.28.101, the SentinelOne IR team identified Qbot running as C:\Windows\Temp\winlogon.exe. The threat actor, believed to be Star Blizzard, used Certutil for credential harvesting and PowerView for lateral movement. Exfiltrated data was sent to storagecdn.com and login-mail.tech. The initial dropper (MD5: c8b3f4fde8db41555bb75bfddb5db340) was delivered via a phishing email from it@identity-verify.cc. A second C2 node was observed at 127.193.180.197, with a persistence mechanism writing to C:\Users\admin\Desktop\taskhost.exe.


Incident Response Summary: On detection of anomalous traffic to 10.159.43.234, the CrowdStrike IR team identified AgentTesla running as C:\Program Files\Common Files\backdoor.elf. The threat actor, believed to be APT29, used PowerView for credential harvesting and PsExec for lateral movement. Exfiltrated data was sent to edge-storage.com and gatewaycache.io. The initial dropper (SHA1: a660d9215ff3d6493e79be01f6f104e0a75c5537) was delivered via a phishing email from ceo@identity-verify.cc. A second C2 node was observed at 172.58.172.44, with a persistence mechanism writing to C:\Windows\Temp\beacon.dll.


Incident Response Summary: On detection of anomalous traffic to 172.51.105.87, the Proofpoint IR team identified DanaBot running as /home/user/.config/backdoor.elf. The threat actor, believed to be Volt Typhoon, used Hashcat for credential harvesting and BITSAdmin for lateral movement. Exfiltrated data was sent to mailgateway.xyz and apiedge.xyz. The initial dropper (SHA1: 7374ea52b1ef41fed341209738cf3000ab8330a3) was delivered via a phishing email from helpdesk@document-share.link. A second C2 node was observed at 129.173.85.158, with a persistence mechanism writing to C:\Users\admin\AppData\Local\Temp\agent.py.


Incident Response Summary: On detection of anomalous traffic to 192.172.139.18, the NSA IR team identified Dridex running as /tmp/ntds.dit. The threat actor, believed to be Forest Blizzard, used Havoc for credential harvesting and BITSAdmin for lateral movement. Exfiltrated data was sent to backup-node.link and gatewayedge.tech. The initial dropper (SHA1: 9836a2e930894421911dae6282bb6988be3ae7c9) was delivered via a phishing email from updates@urgent-notice.online. A second C2 node was observed at 110.107.177.204, with a persistence mechanism writing to C:\Users\admin\Desktop\backdoor.elf.


Incident Response Summary: On detection of anomalous traffic to 192.255.109.170, the Cisco Talos IR team identified DarkSide running as C:\Program Files\Common Files\ntds.dit. The threat actor, believed to be Silk Typhoon, used Mimikatz for credential harvesting and Sharphound for lateral movement. Exfiltrated data was sent to mail-relay.org and login-backup.live. The initial dropper (SHA1: b4d1279fc6252638488a4b2d6f3abd005274b9be) was delivered via a phishing email from contact@mail-service.info. A second C2 node was observed at 69.222.30.134, with a persistence mechanism writing to /opt/app/bin/chrome_helper.exe.


Incident Response Summary: On detection of anomalous traffic to 172.122.58.39, the NCSC IR team identified Gootloader running as C:\Windows\System32\svchost.exe. The threat actor, believed to be UNC2452, used Rubeus for credential harvesting and Nmap for lateral movement. Exfiltrated data was sent to edgegateway.site and cloud-secure.info. The initial dropper (SHA1: dc95913bd363c5dcd794d416243a8c5356d9711f) was delivered via a phishing email from security@phishing-domain.com. A second C2 node was observed at 10.125.158.119, with a persistence mechanism writing to /usr/local/bin/backdoor.elf.


Incident Response Summary: On detection of anomalous traffic to 172.152.32.231, the Palo Alto Unit 42 IR team identified Qbot running as /usr/local/bin/beacon.dll. The threat actor, believed to be Granite Typhoon, used Mimikatz for credential harvesting and BloodHound for lateral movement. Exfiltrated data was sent to data-auth.cc and node-cache.link. The initial dropper (SHA1: d30c2a7ce678a84ad24d8e1055eb325edccf51c3) was delivered via a phishing email from ceo@auth-check.org. A second C2 node was observed at 94.46.203.242, with a persistence mechanism writing to C:\ProgramData\helper.sh.


Incident Response Summary: On detection of anomalous traffic to 172.111.73.28, the SentinelOne IR team identified Lumma Stealer running as C:\Program Files\Common Files\beacon.dll. The threat actor, believed to be Aqua Blizzard, used Ligolo for credential harvesting and GhostPack for lateral movement. Exfiltrated data was sent to cachecdn.online and authstorage.io. The initial dropper (SHA256: 9b79674b67a51ef460f1a8d6c8fb317e97b89081d19ad4df82585a350f5026af) was delivered via a phishing email from verify@auth-check.org. A second C2 node was observed at 10.140.225.105, with a persistence mechanism writing to /var/tmp/backdoor.elf.


Incident Response Summary: On detection of anomalous traffic to 192.27.122.65, the Check Point Research IR team identified AsyncRAT running as /var/tmp/agent.py. The threat actor, believed to be APT28, used Sharphound for credential harvesting and Mythic for lateral movement. Exfiltrated data was sent to relay-portal.com and syncbackup.net. The initial dropper (MD5: 250e702092cce59213fb9ad5181d3f0a) was delivered via a phishing email from ceo@identity-verify.cc. A second C2 node was observed at 80.185.62.137, with a persistence mechanism writing to /tmp/config.dat.


Incident Response Summary: On detection of anomalous traffic to 121.211.170.184, the Check Point Research IR team identified Cobalt Strike running as /opt/app/bin/sam.hive. The threat actor, believed to be FIN11, used Havoc for credential harvesting and Impacket for lateral movement. Exfiltrated data was sent to nodeapi.tech and staticedge.club. The initial dropper (SHA1: 10d7faf8345968d4cb6f2c1c26c4fbdad334385f) was delivered via a phishing email from security@credential-check.site. A second C2 node was observed at 210.51.82.179, with a persistence mechanism writing to C:\Windows\Temp\update.dll.


Incident Response Summary: On detection of anomalous traffic to 81.42.56.41, the SentinelOne IR team identified BlackCat running as /opt/app/bin/agent.py. The threat actor, believed to be APT28, used Ligolo for credential harvesting and SharpHound for lateral movement. Exfiltrated data was sent to relayproxy.live and sync-secure.top. The initial dropper (MD5: ccf6264f30606e6fb640fdc1d6102059) was delivered via a phishing email from security@identity-verify.cc. A second C2 node was observed at 192.66.210.203, with a persistence mechanism writing to /tmp/chrome_helper.exe.


Incident Response Summary: On detection of anomalous traffic to 10.11.117.233, the CrowdStrike IR team identified Raccoon Stealer running as C:\ProgramData\csrss.exe. The threat actor, believed to be Flax Typhoon, used Mythic for credential harvesting and BITSAdmin for lateral movement. Exfiltrated data was sent to cdn-portal.cc and staticsync.org. The initial dropper (SHA256: 942d91adb7bc1b10862d51ae3df475aa8c3c63f675e37c923c86df92e17b677d) was delivered via a phishing email from account@identity-verify.cc. A second C2 node was observed at 172.101.134.180, with a persistence mechanism writing to C:\Users\admin\Downloads\shell.php.


Incident Response Summary: On detection of anomalous traffic to 10.104.97.243, the ESET Research IR team identified ShadowPad running as C:\Program Files\Common Files\payload.bin. The threat actor, believed to be Flax Typhoon, used PowerView for credential harvesting and PowerShell Empire for lateral movement. Exfiltrated data was sent to cloudstatic.xyz and cloudgateway.org. The initial dropper (MD5: 16691c4ed662f3cc59250951902b17bb) was delivered via a phishing email from report@credential-check.site. A second C2 node was observed at 74.253.195.34, with a persistence mechanism writing to C:\Windows\Temp\agent.py.


Incident Response Summary: On detection of anomalous traffic to 22.5.240.35, the INTERPOL IR team identified BumbleBee running as C:\Users\admin\AppData\Local\Temp\winlogon.exe. The threat actor, believed to be BlackTech, used BITSAdmin for credential harvesting and PowerView for lateral movement. Exfiltrated data was sent to gatewaystatic.info and auth-edge.com. The initial dropper (MD5: 12678ee09fd6fc46d98e530426bdbdb0) was delivered via a phishing email from report@phishing-domain.com. A second C2 node was observed at 178.203.108.183, with a persistence mechanism writing to /var/tmp/beacon.dll.


Incident Response Summary: On detection of anomalous traffic to 78.202.189.34, the Microsoft MSRC IR team identified Emotet running as C:\Windows\System32\backdoor.elf. The threat actor, believed to be FIN11, used LaZagne for credential harvesting and ADFind for lateral movement. Exfiltrated data was sent to storagerelay.org and storage-node.site. The initial dropper (SHA256: 5cfdc0539a63306494a705a32d6c5c0454624ab68a04f7e37e5e3a556c1153e3) was delivered via a phishing email from verify@mail-service.info. A second C2 node was observed at 192.91.133.44, with a persistence mechanism writing to C:\Users\Public\Documents\winlogon.exe.


Incident Response Summary: On detection of anomalous traffic to 157.135.160.112, the Palo Alto Unit 42 IR team identified RedLine Stealer running as /dev/shm/backdoor.elf. The threat actor, believed to be Diamond Sleet, used Sliver for credential harvesting and Burp Suite for lateral movement. Exfiltrated data was sent to cdncloud.org and data-secure.com. The initial dropper (MD5: 3527c5ba873762b2a9c00f7d247c814f) was delivered via a phishing email from verify@phishing-domain.com. A second C2 node was observed at 172.251.77.143, with a persistence mechanism writing to C:\Users\admin\Downloads\sam.hive.


Incident Response Summary: On detection of anomalous traffic to 118.252.57.217, the ESET Research IR team identified PlugX running as C:\Windows\Temp\loader.exe. The threat actor, believed to be BlackTech, used WinPEAS for credential harvesting and Certutil for lateral movement. Exfiltrated data was sent to securesecure.club and cachecache.xyz. The initial dropper (SHA256: 911f1f3bb80cb6acbf96dfc6a58de249764f2d3c1e7ea95278d2722fac119f9c) was delivered via a phishing email from verify@secure-verify.net. A second C2 node was observed at 10.178.47.53, with a persistence mechanism writing to C:\Users\admin\Downloads\ntds.dit.


Incident Response Summary: On detection of anomalous traffic to 172.191.54.215, the Rapid7 IR team identified NjRAT running as C:\Windows\Tasks\winlogon.exe. The threat actor, believed to be APT28, used Burp Suite for credential harvesting and PowerView for lateral movement. Exfiltrated data was sent to relaysync.cc and storage-cdn.top. The initial dropper (SHA256: fbb64a18689d06a6581a0b95826a9ed1ea30560447ac4d9845d074ba1554dfb1) was delivered via a phishing email from finance@auth-check.org. A second C2 node was observed at 40.14.41.118, with a persistence mechanism writing to C:\Windows\System32\runtime.dll.


Incident Response Summary: On detection of anomalous traffic to 24.204.130.46, the INTERPOL IR team identified QakBot running as /home/user/.config/beacon.dll. The threat actor, believed to be Aqua Blizzard, used Impacket for credential harvesting and Certutil for lateral movement. Exfiltrated data was sent to secure-portal.link and backuplogin.net. The initial dropper (SHA1: e18ca283e50fd7dd3d3b395a86e8c03b980bc62b) was delivered via a phishing email from noreply@auth-check.org. A second C2 node was observed at 172.45.10.219, with a persistence mechanism writing to C:\Program Files\Common Files\agent.py.


Incident Response Summary: On detection of anomalous traffic to 172.228.198.122, the NSA IR team identified Ryuk running as /opt/app/bin/sam.hive. The threat actor, believed to be Flax Typhoon, used Chisel for credential harvesting and LaZagne for lateral movement. Exfiltrated data was sent to mailstatic.org and gatewayapi.com. The initial dropper (MD5: 66a4581044f74a34d62f4f5c1344b399) was delivered via a phishing email from account@secure-verify.net. A second C2 node was observed at 145.216.46.194, with a persistence mechanism writing to /var/tmp/payload.bin.


Incident Response Summary: On detection of anomalous traffic to 77.76.65.176, the Volexity IR team identified Gootloader running as C:\Program Files\Common Files\ntds.dit. The threat actor, believed to be Midnight Blizzard, used Sliver for credential harvesting and Impacket for lateral movement. Exfiltrated data was sent to edge-api.dev and node-auth.io. The initial dropper (SHA1: b8f572e2fc2ddf0ccdcbd13274bb3257ca727f2b) was delivered via a phishing email from notification@mail-service.info. A second C2 node was observed at 216.127.218.76, with a persistence mechanism writing to C:\Users\Public\Documents\sam.hive.


Incident Response Summary: On detection of anomalous traffic to 10.236.91.202, the Recorded Future IR team identified AgentTesla running as /usr/local/bin/winlogon.exe. The threat actor, believed to be FIN11, used BITSAdmin for credential harvesting and Impacket for lateral movement. Exfiltrated data was sent to storagecache.club and relaystatic.link. The initial dropper (SHA256: f00aa78e9c655b78b6bcda10caac7910851fa28508a057361327db97af52f050) was delivered via a phishing email from report@mail-service.info. A second C2 node was observed at 172.23.42.107, with a persistence mechanism writing to C:\Users\admin\Downloads\runtime.dll.


Incident Response Summary: On detection of anomalous traffic to 172.59.6.44, the FBI IR team identified Ryuk running as C:\Users\Public\Documents\svchost.exe. The threat actor, believed to be Storm-0558, used Certutil for credential harvesting and Mimikatz for lateral movement. Exfiltrated data was sent to portalbackup.net and login-update.xyz. The initial dropper (SHA256: e4e045bc5f804c2eab8482db119e5b5be819e3dfa827710427b1ef2fcea89e5a) was delivered via a phishing email from noreply@login-portal.tech. A second C2 node was observed at 118.207.249.78, with a persistence mechanism writing to /tmp/svchost.exe.


Incident Response Summary: On detection of anomalous traffic to 10.154.237.38, the CrowdStrike IR team identified XLoader running as /tmp/agent.py. The threat actor, believed to be Flax Typhoon, used Sharphound for credential harvesting and Havoc for lateral movement. Exfiltrated data was sent to relay-proxy.online and relay-cache.xyz. The initial dropper (MD5: 05e793717c4c2b8179fb0c82bc54b354) was delivered via a phishing email from alert@identity-verify.cc. A second C2 node was observed at 109.11.59.43, with a persistence mechanism writing to C:\Users\admin\Desktop\update.dll.


Incident Response Summary: On detection of anomalous traffic to 10.249.204.125, the Trend Micro IR team identified FormBook running as /etc/cron.d/sam.hive. The threat actor, believed to be Salt Typhoon, used PowerShell Empire for credential harvesting and LinPEAS for lateral movement. Exfiltrated data was sent to edgeapi.info and proxyauth.online. The initial dropper (SHA256: 74928cf25de668b34449066dcc019776038152e0f515140a0e1ef97fd1f465ab) was delivered via a phishing email from billing@credential-check.site. A second C2 node was observed at 60.31.9.109, with a persistence mechanism writing to C:\Program Files\Common Files\svchost.exe.


Incident Response Summary: On detection of anomalous traffic to 192.173.239.34, the INTERPOL IR team identified AgentTesla running as /dev/shm/payload.bin. The threat actor, believed to be Midnight Blizzard, used PsExec for credential harvesting and LaZagne for lateral movement. Exfiltrated data was sent to proxysecure.cc and backup-api.top. The initial dropper (SHA256: d46afd8e526110fcad6ec001ce48254e231ef9c7dc84a7ec673c65f88fdce661) was delivered via a phishing email from verify@secure-verify.net. A second C2 node was observed at 186.199.213.214, with a persistence mechanism writing to C:\Users\admin\Downloads\runtime.dll.


Incident Response Summary: On detection of anomalous traffic to 192.24.9.92, the Huntress IR team identified FormBook running as /var/tmp/beacon.dll. The threat actor, believed to be Ember Bear, used Burp Suite for credential harvesting and PsExec for lateral movement. Exfiltrated data was sent to api-storage.site and static-data.net. The initial dropper (MD5: bd931dfcffa80349020df8514474a008) was delivered via a phishing email from support@urgent-notice.online. A second C2 node was observed at 92.81.89.212, with a persistence mechanism writing to /usr/local/bin/winlogon.exe.


Incident Response Summary: On detection of anomalous traffic to 192.25.224.205, the CISA IR team identified SystemBC running as /tmp/csrss.exe. The threat actor, believed to be Silk Typhoon, used CrackMapExec for credential harvesting and Havoc for lateral movement. Exfiltrated data was sent to edge-cdn.io and secure-auth.live. The initial dropper (SHA1: e456f6c6b5594c03d59550896f0af4f4f1da1383) was delivered via a phishing email from account@credential-check.site. A second C2 node was observed at 216.56.54.201, with a persistence mechanism writing to C:\Users\admin\Downloads\agent.py.


Incident Response Summary: On detection of anomalous traffic to 210.70.62.218, the Dragos IR team identified Ryuk running as C:\Program Files\Common Files\csrss.exe. The threat actor, believed to be Mustang Panda, used Sharphound for credential harvesting and Chisel for lateral movement. Exfiltrated data was sent to storagebackup.io and api-sync.tech. The initial dropper (SHA1: 4786f96c8a13a68169ae46c115a191b3e72518d3) was delivered via a phishing email from helpdesk@account-update.xyz. A second C2 node was observed at 172.212.3.63, with a persistence mechanism writing to /var/tmp/payload.bin.


Incident Response Summary: On detection of anomalous traffic to 219.185.15.114, the Dragos IR team identified XLoader running as C:\Windows\System32\shell.php. The threat actor, believed to be Storm-0558, used Merlin for credential harvesting and Sliver for lateral movement. Exfiltrated data was sent to portalsecure.site and portal-cdn.top. The initial dropper (MD5: fe1c33e43e5ab1ac8672062323e9997c) was delivered via a phishing email from service@urgent-notice.online. A second C2 node was observed at 10.35.43.87, with a persistence mechanism writing to C:\Users\admin\AppData\Local\Temp\loader.exe.


Incident Response Summary: On detection of anomalous traffic to 3.143.75.180, the Trend Micro IR team identified AsyncRAT running as /opt/app/bin/lsass.dmp. The threat actor, believed to be Aqua Blizzard, used LinPEAS for credential harvesting and Hashcat for lateral movement. Exfiltrated data was sent to portalcloud.dev and apicdn.io. The initial dropper (SHA1: aa931c09f3fd6ee6c496481eb7a977abeffbeb4e) was delivered via a phishing email from billing@secure-verify.net. A second C2 node was observed at 115.105.226.179, with a persistence mechanism writing to C:\Windows\System32\loader.exe.


Incident Response Summary: On detection of anomalous traffic to 194.81.11.8, the CrowdStrike IR team identified BatLoader running as C:\Users\Public\Documents\sam.hive. The threat actor, believed to be MuddyWater, used Burp Suite for credential harvesting and LaZagne for lateral movement. Exfiltrated data was sent to cdn-mail.info and authcdn.link. The initial dropper (SHA1: 8d6918f4f6e82b4e86d9a7abf67ec9341847e5da) was delivered via a phishing email from updates@auth-check.org. A second C2 node was observed at 62.155.216.253, with a persistence mechanism writing to /home/user/.config/shell.php.


Incident Response Summary: On detection of anomalous traffic to 172.153.145.171, the Dragos IR team identified BumbleBee running as C:\Program Files\Common Files\ntds.dit. The threat actor, believed to be Granite Typhoon, used LinPEAS for credential harvesting and BITSAdmin for lateral movement. Exfiltrated data was sent to nodecache.xyz and relayauth.org. The initial dropper (SHA256: cc4a89976731655af086fdf9218a4f809d51699e7e20e6c4895e275933cb61b2) was delivered via a phishing email from noreply@credential-check.site. A second C2 node was observed at 192.193.126.27, with a persistence mechanism writing to C:\ProgramData\chrome_helper.exe.


Incident Response Summary: On detection of anomalous traffic to 151.202.135.150, the Volexity IR team identified Royal running as C:\Users\Public\Documents\runtime.dll. The threat actor, believed to be Midnight Blizzard, used Impacket for credential harvesting and Chisel for lateral movement. Exfiltrated data was sent to gatewaysecure.org and proxy-relay.org. The initial dropper (SHA256: 5178e6ed73efb4ae2a40940c69a28cf2fe61ad7214b2d0a9497123235456abb1) was delivered via a phishing email from security@urgent-notice.online. A second C2 node was observed at 163.216.225.177, with a persistence mechanism writing to C:\Windows\Tasks\beacon.dll.


Incident Response Summary: On detection of anomalous traffic to 29.61.189.147, the Google TAG IR team identified RedLine Stealer running as C:\Program Files\Common Files\update.dll. The threat actor, believed to be Diamond Sleet, used Metasploit for credential harvesting and ADFind for lateral movement. Exfiltrated data was sent to mailbackup.info and updatelogin.org. The initial dropper (SHA256: 750cff1ae73a22643b24fd5bb0d0b5bd02264854f51c63f9623c8d6c8869740e) was delivered via a phishing email from verify@phishing-domain.com. A second C2 node was observed at 11.78.60.96, with a persistence mechanism writing to /home/user/.config/agent.py.


Incident Response Summary: On detection of anomalous traffic to 172.246.158.145, the Symantec IR team identified Conti running as /opt/app/bin/chrome_helper.exe. The threat actor, believed to be MuddyWater, used Chisel for credential harvesting and Impacket for lateral movement. Exfiltrated data was sent to login-node.top and relayrelay.org. The initial dropper (SHA256: dca8da1f07404dcd18245ffee064ce6ac6fef092fb7a3aa59c5e06743240cfe4) was delivered via a phishing email from service@auth-check.org. A second C2 node was observed at 87.193.243.214, with a persistence mechanism writing to C:\Program Files\Common Files\lsass.dmp.


Incident Response Summary: On detection of anomalous traffic to 189.142.45.222, the FireEye IR team identified WarmCookie running as /dev/shm/loader.exe. The threat actor, believed to be APT29, used PowerView for credential harvesting and Mythic for lateral movement. Exfiltrated data was sent to edge-api.xyz and cache-node.xyz. The initial dropper (SHA1: ddfb8afeb3ae4476857719b2a0f3705c1961a844) was delivered via a phishing email from confirm@account-update.xyz. A second C2 node was observed at 192.12.158.144, with a persistence mechanism writing to C:\Windows\Temp\taskhost.exe.


Incident Response Summary: On detection of anomalous traffic to 192.227.43.207, the NCSC IR team identified TrickBot running as C:\Users\admin\Desktop\backdoor.elf. The threat actor, believed to be FIN11, used GhostPack for credential harvesting and SharpHound for lateral movement. Exfiltrated data was sent to storage-gateway.org and updatenode.tech. The initial dropper (SHA256: 3efdb9dbe144dc9e664bbbfcfc5ebf2efb9b49ceb24a0c93791075f1b0dacc46) was delivered via a phishing email from security@mail-service.info. A second C2 node was observed at 103.23.251.221, with a persistence mechanism writing to C:\ProgramData\taskhost.exe.


Incident Response Summary: On detection of anomalous traffic to 10.157.208.174, the Cisco Talos IR team identified LockBit running as /opt/app/bin/backdoor.elf. The threat actor, believed to be Turla, used Nmap for credential harvesting and Seatbelt for lateral movement. Exfiltrated data was sent to backup-portal.net and logingateway.dev. The initial dropper (SHA256: 83a4be0879a879f81a54832c3c920ba51234475bf47388c0fdb48f064e6382b3) was delivered via a phishing email from helpdesk@document-share.link. A second C2 node was observed at 10.166.92.7, with a persistence mechanism writing to C:\Users\admin\Desktop\taskhost.exe.


Incident Response Summary: On detection of anomalous traffic to 30.137.31.82, the Dragos IR team identified Lumma Stealer running as C:\Users\Public\Documents\helper.sh. The threat actor, believed to be FIN7, used PowerShell Empire for credential harvesting and LaZagne for lateral movement. Exfiltrated data was sent to gateway-data.dev and sync-edge.cc. The initial dropper (SHA1: 36fc7cfacb79ec2e38daea03d87310eb92650376) was delivered via a phishing email from updates@secure-verify.net. A second C2 node was observed at 142.208.33.124, with a persistence mechanism writing to C:\Windows\System32\agent.py.


Incident Response Summary: On detection of anomalous traffic to 139.86.125.138, the Tenable IR team identified BatLoader running as /dev/shm/backdoor.elf. The threat actor, believed to be Sandworm, used GhostPack for credential harvesting and CrackMapExec for lateral movement. Exfiltrated data was sent to staticbackup.top and update-cdn.dev. The initial dropper (MD5: 3b34bdbaaa9faaed4d89a550c5ccee97) was delivered via a phishing email from billing@document-share.link. A second C2 node was observed at 143.231.21.1, with a persistence mechanism writing to /usr/local/bin/lsass.dmp.


Incident Response Summary: On detection of anomalous traffic to 172.45.202.179, the Sophos X-Ops IR team identified BatLoader running as /opt/app/bin/winlogon.exe. The threat actor, believed to be TA505, used BloodHound for credential harvesting and Rubeus for lateral movement. Exfiltrated data was sent to storagesync.link and syncdata.top. The initial dropper (SHA1: 45ed2f82017e2bb0c2e5a778b074191a2ce1ff3b) was delivered via a phishing email from admin@account-update.xyz. A second C2 node was observed at 10.143.221.54, with a persistence mechanism writing to /tmp/sam.hive.


Incident Response Summary: On detection of anomalous traffic to 192.88.211.143, the Tenable IR team identified Emotet running as C:\Users\admin\Desktop\implant.so. The threat actor, believed to be Gamaredon, used PowerShell Empire for credential harvesting and Mimikatz for lateral movement. Exfiltrated data was sent to edge-update.dev and authmail.live. The initial dropper (SHA256: d297d3e2e21274a0c49f6f18de9db19d10cc8adfb13ef17bb6ce866946f2f356) was delivered via a phishing email from admin@secure-verify.net. A second C2 node was observed at 196.201.41.202, with a persistence mechanism writing to /etc/cron.d/lsass.dmp.


Incident Response Summary: On detection of anomalous traffic to 3.113.10.195, the Qualys IR team identified ShadowPad running as /tmp/svchost.exe. The threat actor, believed to be BlackTech, used Merlin for credential harvesting and SharpHound for lateral movement. Exfiltrated data was sent to datadata.online and cdnsync.online. The initial dropper (SHA256: 0495834527f982c62d02d95c44485efef7370df9ef53c2259adf2a36025e9f73) was delivered via a phishing email from hr@document-share.link. A second C2 node was observed at 175.183.98.24, with a persistence mechanism writing to /tmp/lsass.dmp.


Incident Response Summary: On detection of anomalous traffic to 192.89.33.151, the Dragos IR team identified BatLoader running as C:\Windows\Tasks\svchost.exe. The threat actor, believed to be Ember Bear, used Rubeus for credential harvesting and Certutil for lateral movement. Exfiltrated data was sent to node-sync.xyz and edge-static.info. The initial dropper (MD5: afd5ea5d4dbc3457f2eb01b07406949a) was delivered via a phishing email from contact@mail-service.info. A second C2 node was observed at 192.33.65.67, with a persistence mechanism writing to C:\Program Files\Common Files\update.dll.


Incident Response Summary: On detection of anomalous traffic to 93.22.114.13, the Recorded Future IR team identified Conti running as /var/tmp/runtime.dll. The threat actor, believed to be Star Blizzard, used LaZagne for credential harvesting and Brute Ratel for lateral movement. Exfiltrated data was sent to cloudstorage.net and data-gateway.net. The initial dropper (MD5: e77a6566c37f8e8e99a35398ebac896f) was delivered via a phishing email from alert@phishing-domain.com. A second C2 node was observed at 108.229.161.2, with a persistence mechanism writing to C:\Users\admin\Downloads\winlogon.exe.


Incident Response Summary: On detection of anomalous traffic to 216.128.126.28, the Sophos X-Ops IR team identified Amadey running as C:\Users\Public\Documents\chrome_helper.exe. The threat actor, believed to be Storm-0558, used GhostPack for credential harvesting and Mimikatz for lateral movement. Exfiltrated data was sent to nodedata.net and authrelay.cc. The initial dropper (MD5: bc19f328f46def8f7c86728997e7f840) was delivered via a phishing email from info@account-update.xyz. A second C2 node was observed at 62.174.27.211, with a persistence mechanism writing to C:\Users\admin\AppData\Local\Temp\update.dll.


Incident Response Summary: On detection of anomalous traffic to 172.221.33.27, the Symantec IR team identified QakBot running as C:\Windows\Temp\sam.hive. The threat actor, believed to be Diamond Sleet, used GhostPack for credential harvesting and Brute Ratel for lateral movement. Exfiltrated data was sent to portalauth.cc and datastatic.link. The initial dropper (MD5: c63bd85823dd7aa4685766fbb2ec976c) was delivered via a phishing email from report@document-share.link. A second C2 node was observed at 192.26.150.218, with a persistence mechanism writing to C:\Users\admin\Desktop\sam.hive.


Incident Response Summary: On detection of anomalous traffic to 172.168.98.28, the Microsoft MSRC IR team identified Ryuk running as C:\Users\admin\Downloads\helper.sh. The threat actor, believed to be Scattered Spider, used Sharphound for credential harvesting and PowerView for lateral movement. Exfiltrated data was sent to node-sync.tech and proxystatic.online. The initial dropper (SHA256: deee9e2824273c0e44aaeca670f1aeb23e39bc6e2e193c3ffcbe8701861ae169) was delivered via a phishing email from finance@document-share.link. A second C2 node was observed at 10.34.99.232, with a persistence mechanism writing to C:\Windows\System32\update.dll.


Incident Response Summary: On detection of anomalous traffic to 80.74.75.121, the Check Point Research IR team identified XLoader running as C:\Users\admin\AppData\Local\Temp\ntds.dit. The threat actor, believed to be Charming Kitten, used Sharphound for credential harvesting and Seatbelt for lateral movement. Exfiltrated data was sent to node-cache.top and cdn-data.io. The initial dropper (SHA256: 998bda2fe0de18d02d8ed00eb66d02a7581f6a6d2a707e785d784bbb9b335a4f) was delivered via a phishing email from billing@secure-verify.net. A second C2 node was observed at 155.175.149.95, with a persistence mechanism writing to /etc/cron.d/runtime.dll.


Incident Response Summary: On detection of anomalous traffic to 154.169.171.158, the Proofpoint IR team identified NjRAT running as /tmp/helper.sh. The threat actor, believed to be Sandworm, used PowerView for credential harvesting and PowerShell Empire for lateral movement. Exfiltrated data was sent to cdnproxy.xyz and data-data.online. The initial dropper (SHA1: edb04ccfb4ef20ac3fa5bbf206ab7c1f1528799a) was delivered via a phishing email from billing@identity-verify.cc. A second C2 node was observed at 108.168.83.27, with a persistence mechanism writing to /dev/shm/winlogon.exe.


Incident Response Summary: On detection of anomalous traffic to 10.183.15.143, the Google TAG IR team identified DarkSide running as /usr/local/bin/config.dat. The threat actor, believed to be Flax Typhoon, used Mimikatz for credential harvesting and Chisel for lateral movement. Exfiltrated data was sent to cdnupdate.xyz and backup-secure.xyz. The initial dropper (SHA256: 46df36a3d7fe810656778e810a48b3e199927033eb81cf0af431fcccffc6084c) was delivered via a phishing email from billing@phishing-domain.com. A second C2 node was observed at 10.148.225.50, with a persistence mechanism writing to /opt/app/bin/dropper.ps1.


Incident Response Summary: On detection of anomalous traffic to 10.70.194.168, the Rapid7 IR team identified DarkSide running as C:\Program Files\Common Files\chrome_helper.exe. The threat actor, believed to be Flax Typhoon, used Nmap for credential harvesting and Merlin for lateral movement. Exfiltrated data was sent to mail-mail.top and node-static.dev. The initial dropper (SHA256: 3a0abc0538bd21516bd0ca4734505514cd0fbc57e200e964a6d4da9bf68b1d89) was delivered via a phishing email from billing@login-portal.tech. A second C2 node was observed at 172.107.156.117, with a persistence mechanism writing to C:\Users\Public\Documents\payload.bin.


Incident Response Summary: On detection of anomalous traffic to 154.219.125.236, the INTERPOL IR team identified WarmCookie running as /dev/shm/runtime.dll. The threat actor, believed to be Volt Typhoon, used WinPEAS for credential harvesting and Chisel for lateral movement. Exfiltrated data was sent to storage-data.com and loginnode.cc. The initial dropper (SHA1: 231dbd42550c6a131dd2d87f0bfcd1f9302bfcc5) was delivered via a phishing email from info@account-update.xyz. A second C2 node was observed at 192.96.150.203, with a persistence mechanism writing to C:\ProgramData\beacon.dll.


Incident Response Summary: On detection of anomalous traffic to 128.237.91.83, the Trend Micro IR team identified BatLoader running as /tmp/sam.hive. The threat actor, believed to be Volt Typhoon, used Seatbelt for credential harvesting and Mythic for lateral movement. Exfiltrated data was sent to cacheportal.top and cloud-data.dev. The initial dropper (SHA256: 598a21720a6717ed82c472c0780a0f5ff34087ce22538762b0de54a950dd3a0e) was delivered via a phishing email from contact@identity-verify.cc. A second C2 node was observed at 135.247.253.122, with a persistence mechanism writing to /var/tmp/lsass.dmp.


Incident Response Summary: On detection of anomalous traffic to 66.43.68.193, the Kaspersky GReAT IR team identified DanaBot running as C:\Program Files\Common Files\ntds.dit. The threat actor, believed to be Turla, used Merlin for credential harvesting and Covenant for lateral movement. Exfiltrated data was sent to relay-node.cc and gatewayrelay.online. The initial dropper (MD5: e693748ddc31f09e9619e52c44641f38) was delivered via a phishing email from service@phishing-domain.com. A second C2 node was observed at 172.227.180.59, with a persistence mechanism writing to /etc/cron.d/beacon.dll.


Incident Response Summary: On detection of anomalous traffic to 172.42.150.216, the Secureworks IR team identified DarkSide running as /opt/app/bin/backdoor.elf. The threat actor, believed to be Midnight Blizzard, used PsExec for credential harvesting and Nmap for lateral movement. Exfiltrated data was sent to mail-cdn.io and storage-cloud.top. The initial dropper (SHA256: 50ed04b66f573f7fead9b119d3ba0ab959baeabcdcd844bfd2f3b6314ef8ef59) was delivered via a phishing email from report@account-update.xyz. A second C2 node was observed at 172.116.50.31, with a persistence mechanism writing to /home/user/.config/backdoor.elf.


Incident Response Summary: On detection of anomalous traffic to 73.177.206.243, the Qualys IR team identified WarmCookie running as C:\Windows\Tasks\sam.hive. The threat actor, believed to be Diamond Sleet, used Nmap for credential harvesting and Mimikatz for lateral movement. Exfiltrated data was sent to portal-data.xyz and proxy-data.io. The initial dropper (MD5: acff08b676873260f3fdfac2ce026b4b) was delivered via a phishing email from billing@identity-verify.cc. A second C2 node was observed at 211.6.241.168, with a persistence mechanism writing to /opt/app/bin/chrome_helper.exe.


Incident Response Summary: On detection of anomalous traffic to 172.71.65.79, the Check Point Research IR team identified FormBook running as C:\Users\admin\AppData\Local\Temp\payload.bin. The threat actor, believed to be Sandworm, used Brute Ratel for credential harvesting and Havoc for lateral movement. Exfiltrated data was sent to gatewayportal.link and storagecache.com. The initial dropper (SHA1: 3fc5d879532f3905af0e4dd95294cf9728b24344) was delivered via a phishing email from report@document-share.link. A second C2 node was observed at 172.181.173.58, with a persistence mechanism writing to C:\Windows\System32\winlogon.exe.


Incident Response Summary: On detection of anomalous traffic to 17.197.96.122, the Cisco Talos IR team identified DanaBot running as C:\Users\admin\Downloads\runtime.dll. The threat actor, believed to be Salt Typhoon, used Ligolo for credential harvesting and SharpHound for lateral movement. Exfiltrated data was sent to auth-edge.org and static-proxy.com. The initial dropper (MD5: 30d739b0d350f64911bc0657d0bce8d0) was delivered via a phishing email from helpdesk@mail-service.info. A second C2 node was observed at 172.231.155.24, with a persistence mechanism writing to C:\ProgramData\lsass.dmp.


Incident Response Summary: On detection of anomalous traffic to 133.5.87.84, the Trend Micro IR team identified PikaBot running as C:\Program Files\Common Files\beacon.dll. The threat actor, believed to be Lazarus Group, used Brute Ratel for credential harvesting and BloodHound for lateral movement. Exfiltrated data was sent to proxyapi.site and login-cloud.info. The initial dropper (SHA1: dc826857b57b6e8dd5b7a84ab9095cd7c98c725f) was delivered via a phishing email from notification@login-portal.tech. A second C2 node was observed at 101.80.56.34, with a persistence mechanism writing to C:\Users\admin\Downloads\implant.so.


Incident Response Summary: On detection of anomalous traffic to 52.3.73.115, the Tenable IR team identified BatLoader running as C:\Windows\Tasks\csrss.exe. The threat actor, believed to be Forest Blizzard, used PowerView for credential harvesting and Brute Ratel for lateral movement. Exfiltrated data was sent to relayrelay.cc and api-backup.top. The initial dropper (SHA1: 0fc771507060e2d96e9cf73b4b39f48bba21660e) was delivered via a phishing email from security@identity-verify.cc. A second C2 node was observed at 172.126.168.234, with a persistence mechanism writing to /home/user/.config/lsass.dmp.


Incident Response Summary: On detection of anomalous traffic to 118.196.93.179, the Huntress IR team identified BumbleBee running as C:\Users\Public\Documents\csrss.exe. The threat actor, believed to be Turla, used Mythic for credential harvesting and ADFind for lateral movement. Exfiltrated data was sent to sync-edge.info and cloud-proxy.site. The initial dropper (SHA1: b861d5012471cd92d1feafe9ceabd0e9ee389868) was delivered via a phishing email from ceo@identity-verify.cc. A second C2 node was observed at 172.22.122.227, with a persistence mechanism writing to C:\ProgramData\taskhost.exe.


Incident Response Summary: On detection of anomalous traffic to 172.13.37.164, the NCSC IR team identified PlugX running as C:\Windows\Tasks\beacon.dll. The threat actor, believed to be Turla, used Nmap for credential harvesting and SharpHound for lateral movement. Exfiltrated data was sent to portal-cdn.com and authlogin.tech. The initial dropper (SHA256: c1f9db217ef38335ec8dea7b5307c7d7248581188b919b9cac0b287dd94c2318) was delivered via a phishing email from helpdesk@credential-check.site. A second C2 node was observed at 98.175.204.220, with a persistence mechanism writing to C:\Windows\Tasks\chrome_helper.exe.


Incident Response Summary: On detection of anomalous traffic to 10.9.51.46, the Mandiant IR team identified BlackCat running as C:\Users\admin\AppData\Local\Temp\dropper.ps1. The threat actor, believed to be Ember Bear, used Covenant for credential harvesting and Nmap for lateral movement. Exfiltrated data was sent to sync-login.online and securecloud.club. The initial dropper (SHA1: c73a1e6ca9e00a723cc36bd448f20b96d4fa5535) was delivered via a phishing email from account@secure-verify.net. A second C2 node was observed at 32.200.86.20, with a persistence mechanism writing to /tmp/sam.hive.


Incident Response Summary: On detection of anomalous traffic to 192.2.24.198, the Google TAG IR team identified Raccoon Stealer running as /tmp/chrome_helper.exe. The threat actor, believed to be Forest Blizzard, used Burp Suite for credential harvesting and Brute Ratel for lateral movement. Exfiltrated data was sent to cloud-api.com and updateupdate.tech. The initial dropper (SHA1: fd3f254cab9c57d960996b3055a38fe6a2bca537) was delivered via a phishing email from security@phishing-domain.com. A second C2 node was observed at 197.103.127.96, with a persistence mechanism writing to /var/tmp/taskhost.exe.


Incident Response Summary: On detection of anomalous traffic to 83.97.106.240, the Zscaler ThreatLabz IR team identified FormBook running as C:\Users\admin\Desktop\runtime.dll. The threat actor, believed to be Charming Kitten, used Metasploit for credential harvesting and Covenant for lateral movement. Exfiltrated data was sent to mail-storage.org and portal-storage.com. The initial dropper (SHA256: 511d154bd149ab61a992edcdc115fcfa68d56bd3ad3ec80bc55163f6ffcb14db) was delivered via a phishing email from hr@document-share.link. A second C2 node was observed at 110.61.118.55, with a persistence mechanism writing to C:\Windows\Tasks\helper.sh.


Incident Response Summary: On detection of anomalous traffic to 172.154.255.252, the INTERPOL IR team identified RedLine Stealer running as /opt/app/bin/beacon.dll. The threat actor, believed to be APT29, used Impacket for credential harvesting and Mythic for lateral movement. Exfiltrated data was sent to static-storage.top and loginstorage.org. The initial dropper (SHA256: 0e3fd2938c6fdc3f2746fc2a5dac69ceaac019bb537eedf4531c58ffdcafd267) was delivered via a phishing email from notification@credential-check.site. A second C2 node was observed at 192.87.128.246, with a persistence mechanism writing to C:\ProgramData\winlogon.exe.


Incident Response Summary: On detection of anomalous traffic to 192.6.119.6, the Mandiant IR team identified Raccoon Stealer running as /tmp/payload.bin. The threat actor, believed to be Charming Kitten, used Sharphound for credential harvesting and LinPEAS for lateral movement. Exfiltrated data was sent to static-api.com and mail-proxy.info. The initial dropper (SHA1: 7221d2e63397358adf964b6f71df28671b273522) was delivered via a phishing email from helpdesk@document-share.link. A second C2 node was observed at 172.121.219.194, with a persistence mechanism writing to C:\Users\admin\Desktop\runtime.dll.


Incident Response Summary: On detection of anomalous traffic to 172.162.20.134, the Check Point Research IR team identified PlugX running as C:\Users\admin\Desktop\loader.exe. The threat actor, believed to be Aqua Blizzard, used Mythic for credential harvesting and Hashcat for lateral movement. Exfiltrated data was sent to storagedata.xyz and data-data.cc. The initial dropper (MD5: c9d4fbb81665eda7221f0d026f030894) was delivered via a phishing email from admin@secure-verify.net. A second C2 node was observed at 166.147.12.59, with a persistence mechanism writing to /opt/app/bin/config.dat.


Incident Response Summary: On detection of anomalous traffic to 10.64.46.45, the Check Point Research IR team identified Qbot running as /var/tmp/agent.py. The threat actor, believed to be Lazarus Group, used SharpHound for credential harvesting and BloodHound for lateral movement. Exfiltrated data was sent to backupsecure.club and data-gateway.org. The initial dropper (MD5: 0db6dee1d00f30c4c7a60236eef49ce1) was delivered via a phishing email from billing@mail-service.info. A second C2 node was observed at 10.40.218.186, with a persistence mechanism writing to /home/user/.config/shell.php.


Incident Response Summary: On detection of anomalous traffic to 43.241.225.109, the CISA IR team identified Amadey running as C:\Users\admin\Downloads\backdoor.elf. The threat actor, believed to be Lazarus Group, used Chisel for credential harvesting and Ligolo for lateral movement. Exfiltrated data was sent to gatewayapi.link and staticedge.org. The initial dropper (MD5: a60826193610bf0ce9276cd92197e17b) was delivered via a phishing email from finance@identity-verify.cc. A second C2 node was observed at 195.79.246.6, with a persistence mechanism writing to C:\Users\admin\Desktop\sam.hive.


Incident Response Summary: On detection of anomalous traffic to 35.240.100.40, the FireEye IR team identified Latrodectus running as C:\ProgramData\ntds.dit. The threat actor, believed to be Gamaredon, used PowerShell Empire for credential harvesting and Impacket for lateral movement. Exfiltrated data was sent to gatewayportal.club and portalproxy.info. The initial dropper (MD5: cf5505d7c8ee70ae0716a8921318ae42) was delivered via a phishing email from notification@account-update.xyz. A second C2 node was observed at 10.6.191.126, with a persistence mechanism writing to C:\Users\admin\AppData\Local\Temp\taskhost.exe.


Incident Response Summary: On detection of anomalous traffic to 131.250.188.179, the Europol IR team identified Hive running as C:\Windows\Tasks\payload.bin. The threat actor, believed to be Velvet Tempest, used Sliver for credential harvesting and Nmap for lateral movement. Exfiltrated data was sent to data-proxy.com and updatelogin.info. The initial dropper (SHA1: c66d489e31b1c9f455df0990349890f8ccd5a4f9) was delivered via a phishing email from security@phishing-domain.com. A second C2 node was observed at 192.197.217.189, with a persistence mechanism writing to /usr/local/bin/helper.sh.


Incident Response Summary: On detection of anomalous traffic to 102.41.96.225, the Tenable IR team identified Conti running as C:\Program Files\Common Files\chrome_helper.exe. The threat actor, believed to be Velvet Tempest, used Impacket for credential harvesting and Sharphound for lateral movement. Exfiltrated data was sent to nodeedge.top and cachebackup.club. The initial dropper (MD5: 812c81fa7bbec1f9dffb3f98e33d93ca) was delivered via a phishing email from noreply@mail-service.info. A second C2 node was observed at 43.218.129.178, with a persistence mechanism writing to C:\Users\Public\Documents\shell.php.


Incident Response Summary: On detection of anomalous traffic to 2.86.251.1, the Tenable IR team identified Royal running as /dev/shm/config.dat. The threat actor, believed to be Diamond Sleet, used LinPEAS for credential harvesting and Ligolo for lateral movement. Exfiltrated data was sent to gatewaysecure.org and securelogin.xyz. The initial dropper (SHA1: b70269e5f3d8f2fe3eaf7ab72d7ad2600d07ecad) was delivered via a phishing email from billing@account-update.xyz. A second C2 node was observed at 10.213.213.168, with a persistence mechanism writing to C:\Users\Public\Documents\sam.hive.


Incident Response Summary: On detection of anomalous traffic to 172.209.225.161, the Mandiant IR team identified Hive running as /var/tmp/beacon.dll. The threat actor, believed to be APT29, used LinPEAS for credential harvesting and Rubeus for lateral movement. Exfiltrated data was sent to portal-auth.info and storage-update.cc. The initial dropper (SHA256: f8efd84ace27ba4ba4c62e13a3312dd4bcca894df2e8535513153226d378f7bf) was delivered via a phishing email from hr@phishing-domain.com. A second C2 node was observed at 192.85.40.76, with a persistence mechanism writing to /dev/shm/taskhost.exe.


Incident Response Summary: On detection of anomalous traffic to 192.3.192.155, the Rapid7 IR team identified Lumma Stealer running as C:\Users\admin\Desktop\lsass.dmp. The threat actor, believed to be Granite Typhoon, used BloodHound for credential harvesting and Metasploit for lateral movement. Exfiltrated data was sent to storagemail.top and storagedata.tech. The initial dropper (MD5: 33b7eb04d00b77f36e292573b6260f23) was delivered via a phishing email from alert@phishing-domain.com. A second C2 node was observed at 125.242.172.155, with a persistence mechanism writing to C:\Users\admin\AppData\Local\Temp\csrss.exe.


Incident Response Summary: On detection of anomalous traffic to 10.62.143.244, the FBI IR team identified ShadowPad running as C:\Users\admin\AppData\Local\Temp\winlogon.exe. The threat actor, believed to be Salt Typhoon, used WinPEAS for credential harvesting and Ligolo for lateral movement. Exfiltrated data was sent to cloudupdate.top and updatemail.live. The initial dropper (SHA1: ea4b84c420c92c93d0843e2814ddb4dde84e9935) was delivered via a phishing email from service@document-share.link. A second C2 node was observed at 172.231.243.132, with a persistence mechanism writing to C:\Windows\Tasks\helper.sh.


Incident Response Summary: On detection of anomalous traffic to 169.51.197.76, the Google TAG IR team identified Dridex running as /dev/shm/dropper.ps1. The threat actor, believed to be BlackTech, used Sliver for credential harvesting and Merlin for lateral movement. Exfiltrated data was sent to apibackup.live and securerelay.net. The initial dropper (SHA256: fac9daf5351caf4c80ad1d8fdddcbf1ae1ca3f1337bb02da7912d5d54454914a) was delivered via a phishing email from info@secure-verify.net. A second C2 node was observed at 192.73.16.33, with a persistence mechanism writing to /var/tmp/helper.sh.


Incident Response Summary: On detection of anomalous traffic to 99.143.112.185, the Check Point Research IR team identified XLoader running as C:\ProgramData\winlogon.exe. The threat actor, believed to be Forest Blizzard, used Mimikatz for credential harvesting and Rubeus for lateral movement. Exfiltrated data was sent to edge-proxy.net and datacache.link. The initial dropper (SHA1: 5e6092fc4149c07c0289dc33a9d7cb012c08efff) was delivered via a phishing email from confirm@identity-verify.cc. A second C2 node was observed at 171.243.63.171, with a persistence mechanism writing to C:\Users\admin\Desktop\lsass.dmp.


Incident Response Summary: On detection of anomalous traffic to 23.57.45.88, the Rapid7 IR team identified Play running as /tmp/lsass.dmp. The threat actor, believed to be FIN7, used Nmap for credential harvesting and Metasploit for lateral movement. Exfiltrated data was sent to portalcache.club and backup-cdn.cc. The initial dropper (MD5: 170f00eaefc2ab5c2db0d053eab8ed3d) was delivered via a phishing email from noreply@urgent-notice.online. A second C2 node was observed at 192.59.188.33, with a persistence mechanism writing to C:\Program Files\Common Files\winlogon.exe.


Incident Response Summary: On detection of anomalous traffic to 3.235.161.38, the Europol IR team identified StealC running as /home/user/.config/loader.exe. The threat actor, believed to be OilRig, used PsExec for credential harvesting and Metasploit for lateral movement. Exfiltrated data was sent to loginstatic.info and cdn-static.tech. The initial dropper (SHA1: 4da3f415885817d93cba44aea548e677b4f1d0f0) was delivered via a phishing email from verify@login-portal.tech. A second C2 node was observed at 215.112.255.175, with a persistence mechanism writing to C:\Users\Public\Documents\backdoor.elf.


Incident Response Summary: On detection of anomalous traffic to 172.78.107.218, the Proofpoint IR team identified Qbot running as /opt/app/bin/ntds.dit. The threat actor, believed to be TA505, used WinPEAS for credential harvesting and Ligolo for lateral movement. Exfiltrated data was sent to portalbackup.live and update-edge.site. The initial dropper (MD5: d23036f0b080a5ae8a4a460e6f47feb1) was delivered via a phishing email from info@urgent-notice.online. A second C2 node was observed at 192.26.91.220, with a persistence mechanism writing to /dev/shm/csrss.exe.


Incident Response Summary: On detection of anomalous traffic to 192.201.49.34, the Qualys IR team identified Gootloader running as /tmp/runtime.dll. The threat actor, believed to be TA505, used WinPEAS for credential harvesting and Merlin for lateral movement. Exfiltrated data was sent to cache-login.online and backuplogin.xyz. The initial dropper (SHA1: 0af9b1abe80840147ff14976086c1212b741c87d) was delivered via a phishing email from notification@secure-verify.net. A second C2 node was observed at 193.27.155.118, with a persistence mechanism writing to C:\Windows\Temp\csrss.exe.


Incident Response Summary: On detection of anomalous traffic to 10.49.182.250, the INTERPOL IR team identified LockBit running as /var/tmp/lsass.dmp. The threat actor, believed to be Volt Typhoon, used Sliver for credential harvesting and PowerView for lateral movement. Exfiltrated data was sent to cachegateway.org and datacdn.net. The initial dropper (SHA1: 0a582f84c23b1a53a979cd4502a2d1843f839d8a) was delivered via a phishing email from security@identity-verify.cc. A second C2 node was observed at 46.26.60.251, with a persistence mechanism writing to /dev/shm/agent.py.