Indicator Database

CVE-2025-20333 CVE-2025-20362 CVE-2026-20182

Adform Script Compromise Shows Why Third-Party Tags Need Supply-Chain Controls 7 indicators · Aug 1, 2026

IPv4 (1)

84[.]32[.]102[.]230

Domains (2)

pastebin[.]coms2[.]adform[.]net

URLs (3)

hxxp://84[.]32[.]102[.]230:7744/p?h=example[.]com&u=/testhxxps://pastebin[.]com/mc7psaNFhxxps://s2[.]adform[.]net/banners/scripts/st/trackpoint-async[.]js

sha256 (1)

02ff86c7f9fe609a753ff15bda90baa3c3e0d4a2e559ec4fcf8a3de0954b7c55

CaptiveCrunch Shows Why Travel Wi-Fi Is Now an Identity Attack Surface 30 indicators · Jul 31, 2026

IPv4 (6)

104[.]194[.]159[.]150107[.]189[.]26[.]194213[.]145[.]86[.]11231[.]57[.]243[.]15438[.]146[.]28[.]13238[.]146[.]28[.]75

Domains (14)

cloudflarecp[.]comcloudflareok[.]comcloudflareportal[.]comconnectivity[.]cloudflareclient[.]comdetectportal[.]brave-hxxp-only[.]comdetectportal[.]firefox[.]comm365-owa[.]comms365-device[.]comms365-live[.]commsftconnecttest[.]commsftncsi[.]comnmcheck[.]gnome[.]orgowa-ms365[.]comwww[.]volexity[.]com

URLs (8)

hxxps://213[.]145[.]86[.]112/cdn/chunks/polyfill-7e2b[.]min[.]jshxxps://213[.]145[.]86[.]112/t/eventhxxps://213[.]145[.]86[.]112/t/pixel[.]gifhxxps://www[.]volexity[.]com/blog/2025/02/13/multiple-russian-threat-actors-targeting-microsoft-device-code-authenticationm365-owa[.]comms365-device[.]comms365-live[.]comowa-ms365[.]com

sha256 (2)

918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c

XCSSET v40 Shows Why Developer Macs Are Supply-Chain Infrastructure 149 indicators · Jul 31, 2026

IPv4 (7)

151[.]243[.]109[.]188178[.]208[.]92[.]129178[.]208[.]92[.]16891[.]108[.]106[.]22995[.]142[.]35[.]20695[.]142[.]35[.]3495[.]142[.]37[.]159

Domains (66)

Settings[.]appTelegram[.]appaccapple[.]ruadschecks[.]ruadsmobi[.]ruadsmorein[.]inadsmoreme[.]inamdcdn[.]ruamzndev[.]inamzndev[.]ruamznprod[.]inapplecdn[.]ruappledisk[.]ruappledns[.]ruapplehosts[.]ruappletime[.]inbulksec[.]rucdnamz[.]incdnamz[.]rucdnapple[.]incdnatapple[.]rucdnroute[.]rucheckcdn[.]ruchromeads[.]rucnmag[.]rudevnetaps[.]rudnsapple[.]rudnsrelays[.]ruexplorecdn[.]rufiddlejoy[.]rufigmacat[.]rufigmanets[.]infunchats[.]rugironetcdn[.]rugoalmate[.]rugooglenets[.]rugreencn[.]ruicloudsnet[.]ruimails[.]rulegalads[.]inlittleads[.]inlittledns[.]rumaganet[.]rumindelgate[.]runetapsdev[.]runetcdnads[.]innetcdnamz[.]runetcdndev[.]innetcorps[.]runetsprot[.]innetsproto[.]innetworkads[.]inp[.]apprigacdn[.]inrigmajoys[.]inrigmanet[.]rurigmanets[.]insahusuzuki[.]instuffdns[.]intestjoys[.]rutimewebnet[.]invigmanet[.]ruwhitead[.]inwhiteads[.]ruwincdn[.]ruwindsecure[.]ru

URLs (75)

accapple[.]ruadschecks[.]ruadsmobi[.]ruadsmorein[.]inadsmoreme[.]inamdcdn[.]ruamzndev[.]inamzndev[.]in/d/zw_sfp64amzndev[.]ruamzndev[.]ru/d/zw_sfp64amznprod[.]inapplecdn[.]ruappledisk[.]ruappledns[.]ruapplehosts[.]ruappletime[.]inbulksec[.]rucdnamz[.]incdnamz[.]rucdnapple[.]incdnatapple[.]rucdnroute[.]rucheckcdn[.]ruchromeads[.]rucnmag[.]rudevnetaps[.]rudnsapple[.]rudnsrelays[.]ruexplorecdn[.]rufiddlejoy[.]rufigmacat[.]rufigmanets[.]infunchats[.]rugironetcdn[.]rugoalmate[.]rugooglenets[.]rugooglenets[.]ru/d/zw_sfp64greencn[.]ruhxxps://amzndev[.]in/d/zw_sfp64hxxps://amzndev[.]ru/d/zw_sfp64hxxps://googlenets[.]ru/d/zw_sfp64hxxps://netcdndev[.]in/d/zw_sfp64hxxps://whitead[.]in/d/zw_sfp64hxxps://whiteads[.]ru/d/zw_sfp64icloudsnet[.]ruimails[.]rulegalads[.]inlittleads[.]inlittledns[.]rumaganet[.]rumindelgate[.]runetapsdev[.]runetcdnads[.]innetcdnamz[.]runetcdndev[.]innetcdndev[.]in/d/zw_sfp64netcorps[.]runetsprot[.]innetsproto[.]innetworkads[.]inrigacdn[.]inrigmajoys[.]inrigmanet[.]rurigmanets[.]insahusuzuki[.]instuffdns[.]intestjoys[.]rutimewebnet[.]invigmanet[.]ruwhitead[.]inwhitead[.]in/d/zw_sfp64whiteads[.]ruwhiteads[.]ru/d/zw_sfp64wincdn[.]ruwindsecure[.]ru

sha1 (1)

6e480d648fa1b70612f5d198a66875e28847547d

84 4G/5G Core Flaws Show Why Telecom Trust Zones Need Zero Trust 3 indicators · Jul 31, 2026

Domains (2)

doi[.]orgscite[.]ai

URLs (1)

hxxps://doi[.]org/10[.]48550/arXiv[.]2607[.]10315

Astaroth WhatsApp Web Spambot Shows Browser Sessions Are Distribution Infrastructure 18 indicators · Jul 30, 2026

Domains (6)

developer[.]chrome[.]comdocsmoonstudioclayworks[.]onlineg[.]usimpostosrapido[.]topplansonval[.]impostosrapido[.]topvaregjopeaks[.]com

URLs (7)

developer[.]chrome[.]com/docs/chromedriver/capabilitiesdocsmoonstudioclayworks[.]online/arquivoatualizado/gera[.]phphxxps://developer[.]chrome[.]com/docs/chromedriver/capabilitieshxxps://docsmoonstudioclayworks[.]online/arquivoatualizado/gera[.]phphxxps://varegjopeaks[.]com/api/plansonval[.]impostosrapido[.]topvaregjopeaks[.]com/api/

sha256 (5)

6168d63fad22a4e5e45547ca6116ef68bb5173e17e25fd1714f7cc1e4f7b41e1a1aa786e02fb9a37a71e0f76b052ab284ba877f2aaa2fb28f05d60487389976ac7c62303ee1a37fd7a6e2db9c590ba75c647bc4d22d7dca50cfa8879222ac9e1d89105c4d567a95f674ed6eac538e32e288b658a4222a3d52e284a77782af4d5ec43a17685e3a555c2eb5f0a2802e9e45d5a2a5d49a0803155acbd74d9ecdbd7

TA488 Turns Outlook Web Access Into a Stealthy Persistence Layer 14 indicators · Jul 30, 2026

Domains (8)

Weserv[.]nlacocdn[.]comasecdns[.]comdnsrecursive[.]eui3[.]wp[.]comimages[.]weserv[.]nlslack-imgs[.]comtdndns[.]com

URLs (4)

acocdn[.]comasecdns[.]comdnsrecursive[.]eutdndns[.]com

sha256 (1)

6897b649f29e54d8910459963bbf94ed5c7a4fe66a56bc5962540b226b8e48c4

CVEs (1)

CVE-2026-42897

Open Source Supply Chain Compromise Needs Build-Pipeline Defense, Not Just Dependency Scanning 1 indicators · Jul 30, 2026

Domains (1)

OSV[.]dev

CosmosEscape Shows Why Managed Cloud Databases Still Need Customer-Side Defense 1 indicators · Jul 30, 2026

CVEs (1)

CVE-2026-50522

Autonomous AI Agent Espionage Shows Why Post-Compromise Speed Matters 31 indicators · Jul 29, 2026

IPv4 (5)

103[.]97[.]0[.]57118[.]107[.]222[.]232131[.]0[.]0[.]0202[.]181[.]27[.]11543[.]246[.]208[.]207

Domains (5)

Hunt[.]iocdn[.]jsdelivr[.]netjava[.]iomail4[.]plredhatupdating432[.]dnsrd[.]com

URLs (1)

dnsrd[.]com

sha256 (12)

0f8c905aa25c86f85454acb7e77bf5c50220c2a82e5b69a33741e55c8a85f2fc2A4CB412EFA93FED7C3B3B3E49D6247B11A95CE9FDDF71D9FE9DB8E5F0068E0D5633BC0033FDE3AAD929D6CBD47C554E264180360B017AAE04687C2D6D83F753576C70E12BE8B2E8E7C35A5FEB082E90621989ADCE8E64400126918D37F13E4958338A93FEE4E008EA28E459C4D1598313D1524763AB13894AB63BF2BEC4302A9FF4B6D3B7DBB023BAD65D2538ADE745D46B763E5A12116C9C83AA2F6F5D96AADBBB8A11A239DA11CBAF99F847A2D032F34D3B522E13B0FD4EF7B2649DA7123BFF662B60F6A142F99292FBDD65DD1CCD79DC9628686DDF5935C92F7FB1B62A81a9447ae174f4aa54f760b7d7cc985c1a970f31e151d3ff66fac247f99ba1b509b65b7ede835ebba36294d52d7780065523340ee09bb8b209ef2dc495e53dfd53d252ee7b348b7e43e432d8fb154465838f5cd5fb564905323460e6f0a0c7d1e2ec7e9ab43a0cc65d29f0b84a93ba88c43d01fed3dec5c968525dc73c03cbfda2

JA4+ (1)

d5dbb3783b4_7d5dbb3783b4_e1926048963f

CVEs (7)

CVE-2017-7269CVE-2021-3156CVE-2021-4034 CVE-2026-31431 CVE-2026-43284 CVE-2026-43500CVE-2026-43503

SharePoint KEV Listing Turns Collaboration Servers Into Incident-Response Priorities 6 indicators · Jul 17, 2026

CVEs (6)

CVE-2026-25089CVE-2026-32201CVE-2026-39808CVE-2026-45659CVE-2026-56164CVE-2026-58644

Bad Epoll Shows Linux Kernel LPEs Belong in the Patch Priority Queue 2 indicators · Jul 8, 2026

CVEs (2)

CVE-2026-43074CVE-2026-46242

Fake Payment SDKs Show Why Dependency Risk Is Credential Risk 62 indicators · Jul 8, 2026

Domains (4)

api[.]paysafe[.]comapi[.]test[.]paysafe[.]comcaliber-spinner-finishing[.]ngrok-free[.]devngrok-free[.]dev

URLs (2)

caliber-spinner-finishing[.]ngrok-free[.]devhxxps://caliber-spinner-finishing[.]ngrok-free[.]dev:443/

sha256 (56)

1314fc888ca5b3ea91a04e1f5b63039ffc7fc3832b8d809a28ad549c6f9d4f231bae9f2fb9866422f07345501fa2cb4c3a99f2652c8c9decdc27ffbf9714e7bc1bfa32548676d32b7639d3171e2f9feefba5026dc336968c91f4ae2b152c54101d567795a366b9edcfef7f1fa2d398b7cb41890dd3b2f3f1f9803de0cdba0c891df8c579ffcbf5527b1856bd1774601a5188b380e442c5a0fbd400bd86a4501b2303a74a5fac917279f1078e03a4bfd6afbb89462f97d7344ed10e6e9e9e92b72b7696575278e6e223cc44553c687e45afd04df7eb32efbf49b39da64b7959822bc8af4bd2f539630f7800f3491b64c7e2bffe12e955d0d4f03a4f6a4b0018bd2cbfc4e4b1de5e68ab81fba7e1b0c711b4d26197b48ea4db6819c9cea223b0ed2edb3f162f9676196e818d9b795d599ba119a961ffe98c4866351735980d213d313853a82bce61052c00e6a6af85b5069e007a76122c727f31661bc636b12f14390bca9d70efa42cb792f7f677189821a24527cd4298ab2acb954df0abb5c1c339371ac7061168dd3d890061267b3875bc4b30dca5e28d40dbc27a4396439ff13a0dd3479eaf85b65e5abd63d6451f98506faddee47cf4bebd9f91296abb29f0447484c76a06918d7f6f6c6f95ee2bced6dd2e9b282c6f5b92b2b7c0976381d54a4b5c1bc1e948c853cb0978c07c7b8d1540c7b1ded95f8d5ad25c126cb6c7b050cb7550224d8d227a0625e7f53be86924d8e057e403b6b91b83ea20df8340485242c5086d75a492d14e474de7c8f34b18ec0a8a9ce6d77eec8675a9572d9d2352a57c502e40b3f9897d0ca32bba6f844b4113f5c017627ea9eba660eb47f4055c4faef80c83c7ec0925a4aacb4bddabe82b91066ac41305907ba277cd7b3b855cd62e708ae4393c99579ec1433571998299bf7e2fde9bafeb9a79f8bdf065e9615805652b2f006e69512b90d0d63883d7ae1ede69d86384fd77bd46235b2369616b41657e9afaa9354fc1a106393373dcbf8aac8455b7d2cbbb44463434528e61b61dd25cd8dcc43cd78418f3e3eb3fd9002d9e49961eefb12c1022ce4c3b6367e4d6a4f53098e48bfa6ecceeaa754592bc249b83404bcfb8542977ae36dac467eb3bd505ebfffbd73fc3ef0b2976c375df732f0bd0496ed6653c3e2be5a0e56dc672e3bab8bcf80c66b2f95150067fb47429d4cf65eb95215e5f3abc7cade56e251c3d2bde8fff0487c1eecd359c4a544a09fd708755020e4b1c53ad6b8dd1727fe9c1dfa39d6590012e0593c9837c628fc2cd22aa0f4e486b7ed1aec026978a58e3ed713c1c70f421ab56a18cfb6a120c960d227e495b511c2552f25f188b8a70a5c1075f2dea4db94633ddc64b0d03d0385fdeda7c226acc944331febf439727c804c4354e481d2ff9d4934bd1b2518293a9ca34a14f5c7ae9d0cd30ce949e9655f54bfac8a937d78ac506722bae1468ead4cc9ee95b35e0f8ef17ee13d99fd06d823d54183cc91625fdc6decffe8db2863f6499a955656ebdcc089792cfa0313822513f9b89479f666888a4784a3fc99b4cc4566213dcda66b03b47120ca677c02e545941e43f8b21a5761b035e911b53e2c065fea219e0f3462f282fd8af66bc2b516d1ef71af9b6ee9f8f5af0a99fed562b34809cd55071b94c2d1304b04daeacd1d1c9020cce2a97fa7af83dbedf4e6d17dd12c0f337f32240399785b157a66826d27512c3618817fee924e53d14cabb2c4c7f454affde37350f55f0b29973eda4d0c090608c15a976688cad0b2114fdc0dcb89ad37515287ba13aadb2ea8d69f6792a87327ffde2ee4551bb6b99617f53e1ba71bf9a70f45dbc57eac2a361a7d8feb95be97c957fc7652d348f4fa9a987bde5f09883f46b65c460f1c2a69a33b086364ca51b030b6b15e99be46ce8255ddf62839a4fc7f2b34023dec2e4483abea830ba8b8230540ace51788d0712bed9006697ddddb9cbf133c151c51c0b6c7817443b021aff44d4416c09fd039849db81860b9b5144e789fa3987c6af37a6739f0d919ab7049caf3a85831cab44bdbea27e0d9de7adec80334e2bc8b4d17c1f0aa7c50f2fa23d7c328482a4ad2c4da4d600f358ebdf200cbefd83cd7255730b6a7a3895d622d37d0e8f984d2d280689acef56ff195d663e7723adce09810adca70ebec87bc455380ef629ceaa2a0d926149d9115604060167682cd1889d81cfa99d52017732da9dc52127d03893037874c8671943cede4b8d1bb2d4ed2d87942fbefa5d7b7f19fb6f2e9bc293c96bf577bb97ed3ca56185abcf25dabb47d75f2efa6a5540661484efa989ccb338f24938b23152f14f3e424b0cb5e076e13a7e112d364f03bd1ead7abaa83249d544491621254860ab0a73adc9b9eae055c5736366811d2a4b1f78ff206486e7f7445040122efbe023ecd2d20bccf43cb68850a2506805d60ff466f54eba331e1cc2a513b329f5121e0c39104418f7d9865ea3874d2b135eeee0aa0d12fc108d89e1dd706e4e40eb7605b76d35ca

Critical UniFi Flaws Put Network Control Planes Back in the Patch Queue 10 indicators · Jul 8, 2026

CVEs (10)

CVE-2026-34908CVE-2026-34909CVE-2026-34910CVE-2026-50746CVE-2026-50747CVE-2026-50748CVE-2026-54400CVE-2026-54402CVE-2026-55115CVE-2026-55116

Vidar Stealer Campaign Shows Why File Size and Fake Signatures Still Beat Weak Controls 119 indicators · Jul 7, 2026

IPv4 (4)

116[.]203[.]243[.]208136[.]243[.]203[.]109136[.]243[.]203[.]111138[.]199[.]246[.]13

Domains (4)

BleacherReport[.]comip-api[.]comjustwatch[.]compool[.]supportxmr[.]com

URLs (5)

BleacherReport[.]combleacherreport[.]comip-api[.]com/jsonjustwatch[.]comsupportxmr[.]com

md5 (4)

1aae8bf580c846f39c71c05898e57e88c10333c92889b65c3590ef2b3819b420d42595b695fc008ef2c56aabd8efd68ed8b31f8c03e0c76ff245ed05a15ffe6c

sha1 (1)

ab92f731ab20774dfdb95664ee41a2fbafe2a284

sha256 (100)

03e6f4f49cec3af38bbec9ed64c195c7a85a630ec989efb3669f04a2993c1dd7097a87cfa4a5186aba3bba096866692951bde59c6f0c2e8c1c4a599246d14da80a6a67a2fc4d79ec1cd8afc5b8b7a5e69a406e53d57a7334e097c5d0644de5f615489bcd6e4602b41c9a787ec8d7ab027d5e45d400938048bb1c702ad5937980169a330353e53a409e0109c914404354741ff1e1c64e501738dc05e58ea92abc201594c9d173bba6cb509407ecba378c19b93da0a81a2182a913c480e6dbb54e20bf39e1e67152039e70a01ad9e7b23c08d23d2a724ef9c44903f3d4353a22752a02ec4af5ed591afdf1236a443e3b68642ee133f38a2857d1eada51246ab4982b7297a5f502a2e9a59066f0a370bc5a8b28addd0e27975db3d770f801c153972c0b344af415b787b396c8e23bbeb112bd471a1ca1d12cf357c48e2ee1ae068c2c6e8f86c05781af12b323311e83e011f1a603928e2086c48e2ca59e33d90dbe2e11a16f94484e0f43eb4572f800f26f0b4a1314cbdae3c44c1ae35f376906d82f1400a91c853d61622f4d21ed97d96ea1093c0fa1586669bea6f6baa331251f314ce675c040c63b825f213965f5c76a3bd09bf70e138708367e2a84e9e84b3032172e4d8d2ab9fb29b36c9b279117be6ff611b5b91ff7b1c42501a5ec969f2b330efeebba3782994612fdfe20ff96c930af33a83b88a342b6622461511921b235b51bbe42edd15918b015eaa1b4f0e6b5c94f186d71d887e39f1da69a4dec3f35dde1b2482b12582820a861e7c46f10721af6b75052fc872c05d2230a4e8ca13c3f12531045b7eedfe25e0f291d4792b0d8c8366f8de043e2fa8ecf34ccb9133db33b0423bb9278db267a7adb036ecbd6aeebd7909d06d824919708b1e12e1b3e906ae47e9836a591f44d4b743e961d634a404fa8fd8bfae64f1d54c853be2b43920ef7d2742d140a1ab2a1ef172c716903474c73561377dc4f1534d2c5f58147d6d1a38534ba897a5a1e293e3d5df303bbd8e0526e756ad08887ffc1417bef488d941b7b4428b0f4a0e5495e3857b9b96215fb3e7f164b06640d59096425e64bf770a59d367b532dec32668f86003b17d93918dba5ef5fd2b19c53942524364f456142caf590d98fb11ca247800bb417766714527e5a4707ac2f5d0154262653d263b292be387843fadb7131c2d538b4262c81f5b95cfacafacf2d5446c06e5494909e0f5221db75e933b28981b2d0e118f227b7d8a5980d88b500b76dfc2e54dc05ab56244444f86d69b8274a6075906f7ba2307b08e08d3884abde255495559f46ceb801a3540eace594476718e1486b5b4423cfb4ff64530ff8fb4a38155838ae6c748dcbdfa13c6529c654cb821897d29835d3e7e05ca23fb2f3794f0259b9153c4c9e155c976db1a2fd4d1b28fa10bb9c4dcafdc4758b352c037e3d865b6a466b65d479b77a03b15a95ac097b45e23ff7ae5ef6282985b2a503deb6915d7324d8b5a25f862ef8223c6766d0e80af3ad168e17312b265e13a3a68e0ded613e5314a7ded3155cdec49fd34e852e181f4651d78bd8bf3adad2f4dbf22b0d62877a5096828c4bc2fca7cbee7d38b11a0c90fd0d3fc8c37981581e9988c919634e89d8592d7c9e2bc1c098217a813947b44a4f80bc569e9a15c1e8b0864b9167569adec99fd38b114ae07e2e549e6c16f75368f3c5373022c84934ed1c8e8468ced9d7c1b1ff8ffb5f56c7d3f849d4fd16a1b95324426811424b40043d6d2569946018ddda1058ce5c2a556c78a747838865c47074dcb165effb0840cb1cf56b7ff061eebeb9ead8812c410247768a7ba90786aeeb1bafa6412cc5b08237b56d49233b1fca22f3823e856e4c16749e9c45f384ea57055fead16df35b21722671c79e8bf71ed257435ea9b8b91e118ba03ec681860651190f7d7457804313ee739cdedb20de39aeb1f15dc8c2dbbf15fa993250fd879bf87443ff9aeaf4997b74df77b6a83d89fa137fd285a2efde36b1d62c00b3be81cc93df7d1e6e94837b7720e83c02a027d70ae201c393c1956aa2fa8199879a3a4c4fd1d20b03022cfd77469615c5f548063922b469a8c0a4116511395d013e5a798e123e9c119acc4b7828e17e674507ab13dfd84b31b361fa19b9cb27ee130620ba9211feef746d317e49da0ae2f81e14841f356b4d69f0480c2d9ce3fab5a3fa91b0036d9a36fa0f7ed4a256e1d281cb4f194d13ff554fd4fb280dafde0a67a18115ea038ea6c87d8b40cc7d173efd27fb60f3d260acef28f58d67d1f39597e1d611db311a305f628dbcde2a28a0b3de201214d7e3bd43acc97561924daa247c05c4b0536d42be85901a43b42f997710147295a0625e20c935207f8c531daf5311449ec119a37dcc914c18a04a2727bba9cecab78a1d516ec3c7a3f667e0e5a6081aa0e9206a69fe94db6fa14b4e487dffba709b87e8a7e25483300ed409de243b19fff7cf2f097895cd48130247525d8a7e966bd3fa07e9d6c39ebbe3058ecccb336f66bb8e3d1e9656d3301f63ef6114289739a1c44082206298f787238fc6c190ad87eab2475196bb418128deeb2b9d2e4b66b98cae07b238b326b6456cc9b86802e67c504a0398cce1e69873de25e5139aa848f469bef2af345a8a49d15000b5b5e72b5828969b3df1b6c1b98c201de09a7719066f7bcae6b66a3173b703a617f53fddf67d51a1039de7ec690d64db9d7d91f3d777d308e49e958de4154aa0b62ded7820f1fea17a972a05afe387ed32aa2986d5be8bca2f22619d0aedfa834c6963abfab3bfa4f979b4a5d7bc8bc455dd4c09b44e51a389576fccce35a2c8da3ce680237565a64843ebfbc39e96ec7613003b1b5c3a9b878874ea15a05e1d34ce91781ebfb6a785fc61fc4ff7cff0ddb540bf7ff12111ed0d6031f78f48387a6c16cb3c5451aa0083f662f055e8d911c5de3a8f3a31b3c84cacc7dccc30c98f2be14dba4102aaa2bc1128d8b8b2da76262bf87ede19bac053cca6576efba6aaa71c9438c304b58814fb3ce5a085014ee6e8d89f7cc1380b234b97170fd5f3398031281c6a77b6912c23cccc4b0964d55608916297f6978f0b38c80a4beac472004a786fcef7b830f043076a12748b6a2dc0810ece85439ee77434d991ae7d84201b09ead756b8b5f6991a3a61083461d5269245bebf28b90934c328848ba8c1e084a5a6216cb927d265fa29e471c1ae0d31516e480c09c0fb17f480ad08ea8d5b73e84b7a1bb9b6893fa6b04ee8daa29e515c08239ac5204af1a1fa2bc10006eede1b41329bbb30cc2b302d9a6963109b201b78d4163bb6c2d7bc8bf5a66e9a744b62fc2717bd3230e4ceaf32ad2248ab069b164bd2144401967ac69de0a4cd1734fe429d9cc25799facb3e788830bcf614f33411d3bcfc0edd4a2200e160b5eb4ce700039fc328b78c21060e2203ac517833fce41572b91878e187f85fa434cd6914659834c39fedb662259bd76b11616966c41ff1fbda58d9b129b9c1bd818700eea92b29c7a4a547eb7f6b0b4b75bb6dd8955244bb2618ba234ae740cdedd7c2d30e3465c7c37a973b14edd5b6b2da4a1497c593e43640735ff54aecc9a3288fa5e548e3ca8a00c9d36c64e5dcf562c7ae2b8df4bd6455fe0b41b32ee3a2a528ddc2d155ce379de03e35e0ea2c88744c29b9e2678165214065f9b957177002c6bbe69084d18369be4487d7cd0e4bd3dd0da720672e56e13ca43627305e26767e26925551d2148a458da46e81702136aa915312d360805f083d1f37ff5531db9fbdb8ad6dd384c403c084967d8c967501ee6332b050af04ef424f13a3f5a88d155389d98cd6446f2803444bd2200d48a01a9ad7d487e67e8e831c9cd13f89cbfec17fd4e2d7745513034af14617436ad6b3fc125fd0343218411d0c79bda56b0dadc86b2bd78082dc33c6dca98316e865efa9829c6eb5a97c2ca3cd4ea6c2123a5f6ae45bd7b56818c829960b692de9ad5a14e52669d953e9f074f7218c3fe34ede4a11a0d7c9c9469c513c05aa431fae34f414f91fcf3f794d3e76b6e4d0b92c4cd3ff2ed8ac0c08e4c698017558e532974cf749135d3d49757f05001e6127dc6e07cf17d8c1f96107a3349e62b3ab9afc60f62af9c89b6961b637a26b71e1230f2b3b8adb2a872f712fbdb1e347d06e29a9ed8278d86710ffc14ff04422be76e47124f4dccf9f008b42a04f7e69d3bbf7b5ce81e71308545d6176cc4763920a424e5ac1e5341edb7c039c456d46c39f194be86ce4b41725d7ad12d297d18aa99cddd675e88c41a6f769cd760e323b4f7c01835433cd4059cd59630cb1a9eb1181b350ede9e5e748ec5c0b811c8e60b0e55059edb4d2df86ff3ca45969e57d5fecb11a38f0dcb7e407de85d8de8e2221df8dddecac8aec88af8975c9f07e14100f6edb88f13f9cef5cc020bf673c7f4e19c93c312a043867f46796a8f01927a9a14c2533f760bc16a585325ba9d74917f9e0994d3a4164c1141158c799b619d2c823e818

Bitcoin Addresses (1)

1aae8bf580c846f39c71c05898e57e88

UAT-7810 Shows Edge Devices Are Becoming China-Nexus Relay Infrastructure 96 indicators · Jul 7, 2026

IPv4 (4)

194[.]233[.]92[.]26217[.]15[.]160[.]247217[.]15[.]164[.]14795[.]182[.]100[.]231

URLs (9)

hxxp://194[.]233[.]92[.]26:2222/hxxp://194[.]233[.]92[.]26:8088/hxxp://217[.]15[.]160[.]247:2222/hxxp://217[.]15[.]160[.]247:8088/hxxp://217[.]15[.]160[.]247:99/hxxp://217[.]15[.]164[.]147:2222/hxxp://217[.]15[.]164[.]147:8088/hxxp://217[.]15[.]164[.]147:99/hxxp://95[.]182[.]100[.]231:2222/

sha256 (77)

0352f3e338261d98895df4c7b7a76b296485b2290c72bce56603351d167d060103926e3da998f32ad898b640bd15cf145768f9e849e6f18d81350234254c424e08701ed7975bf4f5688c2724d27ab497764200ad6f4dc53d3cc03b170378ced00a8555a71868749be8c905ed53296ce335af50a9262772b5e154ad3f9c35c2e40a8cae96e25e85c612b0736fe886f9b124ad70ec425bc2ec1a8a4135b25436ba0af4c52a1d13e4132a1843ce7727abcf0ddd4d1ca6a4b17cdf599ec3f355c24113acadb3541e75af50e02d5be56c2238b93d8f154ce5514be1558e6ee59a14321660536f448b8b9f086ce9ea3ce4e9deefc59a76711ea53ee6d8f08fc8c1bb9916971f9706d70ac4925651c7c8719b9d77aff63e4c0a618129efc32c2c46b9891b5649b479fd625de5c8120873644b5eb669cc89cd504582c18e0ae350fd882320fcba222f74dd68aaeb1f0ad30cdf702a828ee164a182b30d05d600c35b72d929686c933cec1e274467e2dae264625ae6f754824bb7f550bc9c3131f625562c29c7fccc6ef8cbfe4da9a169c7c74bacaea1fb515a1fddef91ab1b1522f76e4c2e0e43776e2e1a37d882a1b2ebb7d337ee88950177e43831dae645a367824feb2ebc1b6cf543e2cb3f22d9a5b54b6676bb71dde98df7532f8791297734e44fdd3169a6dbcce684e2c5a2f166996b58ffa673df6e58b8edf2bdf3e66271c8c69e323c3a91be60ebc3e06e942bad04899a15911cea23269e43d07829164b2ce5d4324d95024fc8da5c92b5a1f4825aed5a2a91c9ca8fb6aa52abb332a4c9cf425733c10b77e1da9f0679023d55fb3057879d15609db9c1d46ee5c3ff1240a3d0523878dd5c8eba1e5b53ab2e07e7b5482e95a3fd3e98268bcd7861318bc99023763b89d183eb014e29d9d0d4e45fc2b784a7fcfcf31dd48fd3bde30f8d956383d13d296af7f29c0425655bd1cc0be48fe4aba52ee6760a89e805ca2589f4ef4d773fcaa3038e365b6ab0b121e2cd319c56b74e37381943a0da0e8dce407087cdb84130f49fa81a699a667cafdbd6d1f6e781edd686c947eb8ae27134f6dc2c43d7425bf771c8c9f740b1ae9803dcb4fd45af4d6a6f171fcc72fc7d511095ca82ce52b871429833e1dee348263844efb531f6a3fcd321f88dc8a876caaee912cedd534a4a5bff2609a2d6e088cb87465c08c2d69c6aaa7d2ffcbcd491274b8505f153ac2b231c23d41234e55b1f7ed89f86234f785adbbe820959655d7b019d7df957bdab2ba4b05ec0338c06632599393d5b14227f31a43fe950ea8fdd474287155c3f190571645c4641dcff2c07a4c3ab9acad06aa9607350a385729d8d6139f15db2ce9acd50f96d566e8d139f6490abf2bbf7a9293b876eeb4598fd2c37c5155dbfa033676b5caacfae902734ce462cd871181eefbe299250ca8ac7e139719e5e225ea2648a8cba0fd94ec7fd8ce5315f5d0cc2922bafc9db3c8c41280e917c5eab4c61baa67ae2838a36c2e6ff0476a8f2117b96a7027b830c8cb46ce78efc5faea1650cac0f3ffd2dc1fb220182095a46e34158967d37c2a942e85e2ca97b604b53f87d6c070bf387e80c70a6df8d272fa3fc143148d41f13e59d52ab1f1362d4ec87ed21f0d15cb769b0b2a5577cab41fc2cdb1e7e796c5bdff09264dd9a6366d59b573d50fd23ff650923c4a8c1c918518a02d0a56f12c23533c45f439d65feba2c971c214e71303ad2e0fbf62b45ebcaa784cbf3d0dab62786cb4c046968445a37a9943a267a8b2100fba2678353d6ec88844505ccbba659e586c7a1056917c0f9eafefe42e33e791b75a7e503ff8b081bc10a98449e4076787dfc6c166cda1e81667f869940401f05a55c8dea94dbdf3ceffb93b5f320a6462cfea44d6dbd507ca7cecea861f9cf704b3c5c37f5bd5392886a8c2562088892b7703fa5745538dea8ed9aec4466e67a9d0aecf9e7026ff16a792d1d6f306e8b67d3f34c755fcee1337a252203002ecfdf673a08cfadeda8d738bef2d518a08e0626aa4f76d9e2a2ff313f5b91cc67aab1127122baee1c3efbae1087e58a25bc5f1eb0658459ff264a2c81c68a34c4ee6bc109d141ad28b96037d34ff112322a4c853739880425fee707e9f42e0b8d60119ed639b1ad506ea29877d126bdebce379cd22989f0a67bc595ab8bce02c2f95f9292ad06e1868207e809c76bd16f0cab800c068c104da0e66ef6384663309aaf8fb49f549f2785d835eec620b265f8aa11d9f0912adea5339c73cb4a777a3e9f98bf3cb08da6622c9dd3b4cc9b083cb03d10a29a927c37a31b80975c5c5467f112b61478c9493c046281046443525358a5acb09b9e0e5a1eb469b8d20dc23351e08ff5d5731e1cedce0ddee9bbd00a76217f139d52cb4febf3342c34dcc8198dcaf453458be3699ab47dc08616aa7f18daa7faac8eae94d27122f4751bc96d9ea52d30000b7ca37569a2291b2710824ca3396fb5969636eec376ad6c3ece2202b1722219955638e09b6f96d4cfc0598d3b1890b8d247fd1fb85d24a17afeec3815906dfbcdc5359647910b4a153900ec999a0fb9fe48bda9a6c8787981a24f8bbc723a6f6aa80cab5fa53481937382f3c6ce85bafba443170e54ef7fd431ce7f1b5e202719f3fd022e4ef70788904f574d2cdfbf70c6f3a8e913f526ec57eeec50e1306f7b34b037915b7a1cf2968cc46acc58c2ab9adaba93ff094b8f3fc37d906014d870582039d276b7bd03e6fd583d8a15c494c878e28284539419612616d964ab9224cbe27e57f42293d91d02d684e3dbc7c9bfa9ffcd8fb6a2afe656f510c406ddc58ebff48ce1d0fd3fad951b46a36ec92541f273eeb576d39235d0a5c6f18f2574b132a1022598edfa38065783ab98d1f963b88672f3676a7da1580262ba0d4f367cc57a94b551754c20f77a670c43d4861088161fc72b9922abf933b4ea664a807105ec1eab4a173253aa60bfe6d7d5cf7315186a78ab6a7475c338bdf101bc6461930aaa7a012a02cf93f347c207d81201d0fc19977e51104438a5b9cba861f4da20cea3ae9183edf16ab11d98f8d871d76171504597bbda387689e12e7a5e354c360ff135f4df231cec68c761afd973ad5a80c3d7468a9c392db4166857ed32b5d61cd6755766ba8922156dada3dc4f25b2247cfdd6fc96848db30a178baa4419a4c854e86e315b465836102d14dd0fc1a88180fde8367bec7086f99294f36b8332f12994293139ed532d2ebbace5d2de8ae98579bfb940290f60e59a502b3065345aaf765456387989c0488b20e799d72929d7ccc7f6b6109742b8cc482838303207efc989543b6e1ca6d16e9cf235d2e044c2f7814e6bbcd835b9fd9f10f227dacfb9396185ec2013e7df4db4f3fbf4481f30fd840f35568746f54be49eb92b2c9ac95597a7760abb171cb54bf5a57dfae488d9dfe260b32460a1d947fb5af58ceaf2fb0139bc08b4bb79a966

CVEs (6)

CVE-2020-22653CVE-2020-22658CVE-2023-25717CVE-2025-20333 CVE-2025-20362CVE-2025-2492

Vect and TeamPCP Show Supply-Chain Credentials Are Ransomware Fuel 1 indicators · Jul 2, 2026

CVEs (1)

CVE-2025-55182

Ousaban Shows Banking Trojans Are Learning to Hide From Sandboxes 36 indicators · Jul 1, 2026

IPv4 (4)

162[.]33[.]179[.]46213[.]159[.]64[.]19178[.]40[.]209[.]3291[.]92[.]240[.]140

Domains (7)

controlfacturas[.]siteduckdns[.]orgfacture-arsys[.]duckdns[.]orgfacture-in[.]pages[.]devfaturanova[.]duckdns[.]orgfaturanova[.]xyzpages[.]dev

URLs (5)

controlfacturas[.]sitefacture-arsys[.]duckdns[.]orgfacture-in[.]pages[.]devfaturanova[.]duckdns[.]orgfaturanova[.]xyz

sha256 (20)

18fd38988d58dd930f5992d448cc09a9400c1eafba76b820b9a83239ac48cf4e19ac18a50abb48dc0ea9524850acfaec49359e6b3bcc67c6193c2d56da812c711e77992666acbbfa0d01fcefa9cc8fbdac291e0681b35745be27c6dfb159a37521b24f7ee1f6bdbbb670f0394d66009ee0daa8ced57048298da715e88f7a7cdd48723a33bab89f174750576f9a62da35b3b9e5ac31a5a8f1ce9859a1b35bf8b84c9fdc2823da505ef339d43c6ad38499b7e3447736733e42b5ab6b1afcfd42aa4ca2c863d740bb7022776dccabd8ae34bb9998768928042d76ebcf08984eefcb540ee1936e61d2344b5ebc93485589a351ec2f113a9b4940ae16f3baa48073925837e47198a20877e1b04b270c36d9194206ee38d4f32fe3151b3c3b396c4f0d5a2ed557c357ba8f96f2d55a8a00695987806b5df766cd1dfdab0cbed111774a5e06af187b45476ade0d953e834fced6197d0a33ac60c2575877660e26ab15e865c1a998bac48e02b52b1c850cd500e9fb87521e21755c3a4a491243f5f9a7006bc2e11b0917f47d0557288c4f0cb20bd7589185943b989a969fdc6d3704ee739d07a83cf89685651ea8992047ae694c24f6ddef193044357debd15ce07a64fe9e81ade09cc18f0fc09d73e72d2e0bffad02f52fdcc26553e473cee8cabc1567d4eb4ff02df659fdeec17d36b77084627469623bb3c7d16383d257404b52d1c3e2f0c2d4c1552cd81fa012043e4a5ac832582b639b7b6b7eccc0c4802d7a8ad8e6e78eb2e9bd41a4bc62f7ad54d095ea9813864bebe37172ae30a1afa631fe14fadbb8061715128bebecf7bc59132b6bb04fe8cc39b965aa5b8722dffe28d7e7ffb9eb47cc0cb2f43e04a10dc84df13d04bca1ebacbe47fad0b669728de2f59c

NUT upsmon Command Injection Shows UPS Monitoring Belongs in the Patch Queue 1 indicators · Jul 1, 2026

CVEs (1)

CVE-2026-54161

ARToken Shows Microsoft 365 Tokens Are the New BEC Control Plane 15 indicators · Jul 1, 2026

Domains (6)

clear90489058903-document[.]workers[.]devdashboard-bl[.]pamconj[.]commononapfp[.]sharepoint[.]commononapfpcom[.]sharepoint[.]comsharepoint[.]comspx[.]pamconj[.]com

URLs (6)

hxxps://mononapfp[.]sharepoint[.]com/:f:/document/INV-IgCx1X50pgUjR7iAjZL2fuQaAW4GfKVs6wHT3BYv9sgwW7g”hxxps://mononapfpcom[.]sharepoint[.]com/:f:/g/IgAdH_aaBPMcQbtINZzC1TsLARj3dHj63MnKjvnY-QJrKEcpamconj[.]comsharepoint[.]com/:f:/document/INV-IgCx1X50pgUjR7iAjZL2fuQaAW4GfKVs6wHT3BYv9sgwW7g”sharepoint[.]com/:f:/g/IgAdH_aaBPMcQbtINZzC1TsLARj3dHj63MnKjvnY-QJrKEcworkers[.]dev

CVEs (3)

CitrixBleed Keeps Returning: NetScaler SAML IdP Memory Leaks Need Edge-Control Discipline 2 indicators · Jun 30, 2026

CVEs (2)

CVE-2026-3055CVE-2026-8451

SimpleHelp Exploitation Shows RMM Is a Credential Control Plane 8 indicators · Jun 30, 2026

Domains (3)

blackpointcyber[.]comhorizon3[.]aisimple-help[.]com

URLs (4)

hxxps://blackpointcyber[.]com/blog/a-djinn-in-the-machine-taskweavers-node-js-intrusion-chain/hxxps://horizon3[.]ai/attack-research/disclosures/cve-2026-48558-simplehelp-authentication-bypass-iocs/hxxps://simple-help[.]com/release-newshxxps://simple-help[.]com/security/simplehelp-security-update-2026-05

CVEs (1)

CVE-2026-48558

Bing SEO Poisoning Shows IT Admin Downloads Are Ransomware Initial Access 75 indicators · Jun 29, 2026

IPv4 (11)

109[.]205[.]195[.]211170[.]130[.]55[.]223171[.]22[.]183[.]43172[.]96[.]137[.]160185[.]174[.]100[.]203188[.]40[.]187[.]145192[.]121[.]22[.]94193[.]242[.]184[.]150194[.]127[.]178[.]214[.]239[.]95[.]184[.]32[.]84[.]32

Domains (29)

2rxyt8yrhq0bgj[.]org2rxyt9urhq0bgj[.]org5ka8rxp6t6eup2[.]org6cimu4mc085em8[.]org8doj8uvx604eck[.]orgTria[.]gecertgraveyard[.]orgd1hmxkpwby0d4s[.]orgdelete[.]medownload-center[.]onlinedownload-server[.]onlineev2sirbd269o5j[.]orgewujsfb1dp5ran[.]orgip-scanner[.]orgks501oz9nm3v05[.]orgkwywztxoo2xdot[.]orgky1d1p1daahe5t[.]orgnetml[.]shopopmanager[.]proovh1kn1tcqw5kp[.]orgshopping5[.]shopsigmasearchengine[.]comsoft-hub[.]prosoft-server[.]onlinetria[.]geurlscan[.]iov5rjsdqogstopr[.]orgyj6jurm5qqkye5[.]orgzenmap[.]pro

URLs (25)

2rxyt8yrhq0bgj[.]org2rxyt9urhq0bgj[.]org5ka8rxp6t6eup2[.]org6cimu4mc085em8[.]org8doj8uvx604eck[.]orgd1hmxkpwby0d4s[.]orgdownload-center[.]onlinedownload-server[.]onlineev2sirbd269o5j[.]orgewujsfb1dp5ran[.]orghxxps://tria[.]ge/250530-ttmjhayzhwhxxps://tria[.]ge/250812-zw4tfszpy4ip-scanner[.]orgks501oz9nm3v05[.]orgkwywztxoo2xdot[.]orgky1d1p1daahe5t[.]orgnetml[.]shopopmanager[.]proovh1kn1tcqw5kp[.]orgshopping5[.]shopsoft-hub[.]prosoft-server[.]onlinev5rjsdqogstopr[.]orgyj6jurm5qqkye5[.]orgzenmap[.]pro

md5 (3)

124a48b78060fa851e1cc077ca35713c8c113b3aa82c81eee7c6b4ed0ba9a90fca8646dfc88423bb9fffda811160cebe

sha1 (3)

ab82bf27132323861810c0efcac6d5dd01600dd4d66944e1a57daf04d3e809f22cd01946d593acaffebbaf5f08a8e0782ffcce8beef1f2b4e249a52b

sha256 (3)

186b26df63df3b7334043b47659cba4185c948629d857d47452cc1936f0aa5daa6df0b49a5ef9ffd6513bfe061fb60f6d2941a440038e2de8a7aeb1914945331de730d969854c3697fd0e0803826b4222f3a14efe47e4c60ed749fff6edce19d

Bitcoin Addresses (1)

124a48b78060fa851e1cc077ca35713c

Fluentd Vulnerabilities Show Logging Pipelines Need Production-Grade Segmentation 6 indicators · Jun 29, 2026

CVEs (6)

CVE-2026-44024CVE-2026-44025CVE-2026-44160CVE-2026-44161CVE-2026-44162CVE-2026-44163

Shai Hulud Shows CI/CD Identity Is Production Cloud Identity 4 indicators · Jun 28, 2026

IPv4 (2)

185[.]204[.]1[.]22589[.]22[.]231[.]63

CIDR (1)

0[.]0[.]0[.]0/0

Domains (1)

1[.]0[.]0[.]dev

Clean Repos Can Still Burn Developer Machines When AI Agents Trust Runtime Setup 1 indicators · Jun 27, 2026

Domains (1)

0din[.]ai

Splunk Enterprise RCE Shows SIEM Servers Are Tier-Zero Infrastructure 5 indicators · Jun 26, 2026

Domains (1)

attacker-db[.]com

CVEs (4)

CVE-2025-50165CVE-2025-55182 CVE-2026-20131CVE-2026-20253

NAIC Breach Shows Why PeopleSoft Internet Exposure Needs Immediate Review 1 indicators · Jun 26, 2026

CVEs (1)

CVE-2026-35273

Hospitality Photo-ZIP Campaign Shows Front Desk Workflows Are Initial Access Paths 157 indicators · Jun 26, 2026

IPv4 (6)

172[.]67[.]161[.]215178[.]16[.]54[.]27178[.]16[.]55[.]179193[.]202[.]84[.]32208[.]95[.]112[.]195[.]217[.]97[.]121

Domains (64)

aluminiostramuntana[.]combookreservphoto[.]prodancamp[.]infodashgamein[.]infodeeprace[.]infoderbyoni[.]infodoc-imagehub[.]infodocshub-01[.]infodocshub-secure[.]comdocstore-safe[.]infoexpedla-getphoto[.]cloudfairyspells[.]infofinallyrain[.]infohakeiwjs727wj[.]comhaobbao[.]comheliosup[.]infohigoksbupwou[.]comimage-vlt[.]infoimagestore-hub[.]infoimagevault-safe[.]infoip-api[.]comjoincroud[.]infokellystreets[.]infokelopins[.]infokentjerk[.]infokeypmenu[.]infokinghoruswe[.]infokiptownim[.]infolestresot[.]infolookinlip[.]infoministrew[.]infomontagelips[.]infophoto-21473[.]xyzphoto-box[.]infophoto-dekor[.]xyzphoto-hub-io[.]infophotobook-reserv[.]prophotobookadm[.]prophotodoc-secure[.]infophotosafe-hub[.]infoprejointl[.]inforacestrech[.]inforecallnine[.]inforecepyman[.]inforecstrace[.]inforeservebookphot[.]prosafe-picvault[.]infosafedoc-storage[.]infosafedoc-vault[.]infosafedocphoto[.]infosafephoto-vault[.]infosafevault-hub[.]infosec-safe-dc[.]infosecure-imagehub[.]infosnapkeep[.]infotripadvisor-photo-view[.]comvertualstreak[.]infovisa-safedocs[.]infovisa-vault[.]infovisaimage-storage[.]icuvisaimages[.]infovisaphoto-secure[.]infovisaphoto-vault[.]infowidjssij728dj[.]com

URLs (64)

aluminiostramuntana[.]combookreservphoto[.]prodancamp[.]infodashgamein[.]infodeeprace[.]infoderbyoni[.]infodoc-imagehub[.]infodocshub-01[.]infodocshub-secure[.]comdocstore-safe[.]infoexpedla-getphoto[.]cloudfairyspells[.]infofinallyrain[.]infohakeiwjs727wj[.]comhaobbao[.]comheliosup[.]infohigoksbupwou[.]comimage-vlt[.]infoimagestore-hub[.]infoimagevault-safe[.]infoip-api[.]comjoincroud[.]infokellystreets[.]infokelopins[.]infokentjerk[.]infokeypmenu[.]infokinghoruswe[.]infokiptownim[.]infolestresot[.]infolookinlip[.]infoministrew[.]infomontagelips[.]infophoto-21473[.]xyzphoto-box[.]infophoto-dekor[.]xyzphoto-hub-io[.]infophotobook-reserv[.]prophotobookadm[.]prophotodoc-secure[.]infophotosafe-hub[.]infoprejointl[.]inforacestrech[.]inforecallnine[.]inforecepyman[.]inforecstrace[.]inforeservebookphot[.]prosafe-picvault[.]infosafedoc-storage[.]infosafedoc-vault[.]infosafedocphoto[.]infosafephoto-vault[.]infosafevault-hub[.]infosec-safe-dc[.]infosecure-imagehub[.]infosnapkeep[.]infotripadvisor-photo-view[.]comvertualstreak[.]infovisa-safedocs[.]infovisa-vault[.]infovisaimage-storage[.]icuvisaimages[.]infovisaphoto-secure[.]infovisaphoto-vault[.]infowidjssij728dj[.]com

md5 (2)

1708253177576018957611282797243525908558764390958596189327204542

sha256 (20)

04ec44f2618460f5c77c5e56014a512cc03a123c9c5b6b6b1273e2a1681ac2e106a2888c1f07119873ccb051221bd8717281494b33585f4242556e6e5e2279691c693bcdaf1da636eb21c274b21cc2f6c52c62ddd514700783eee83fe13acb0a1f8daffec5945a13a1e9231f4a76655d4c7ef4560d0c64ca3abfe48f38297cbd2e5fd01b7949a45937b853eabcf4b03195614cf84338dcaaa97240d1c5301ddc3f66634f103b80412d1d670b91befab2a74425d2ea76d904c4a7ffae2ae94b4449cc0e0c3ec060fb354cacee244d4f297aaefb6db66e67a21262d6c4d2eae1bd63565f15a99769bbcd527a4d53e5cc259d80e1254463ef9c878c2074685558ae6580de3b74fd635a1d7a887b8f6e5b0c9ac9e90d6e20466ad41489203119cca983e970feb3f10692c164f6889f7a026f135c2433e5bf8e662a6e63a3b81267b789934cb1494cf0327f0ab82fe644c74caf687814379cad116bd7adaca74c102897448688b292bfec6d83b153588076fe59b111c35ac4e42a916238df16a71e2f98825c0c7764f45c891275b2f038ea559e84b340df30b41c2cc77b8d4215c6c89f10e3b6e5745784f26d18c38ce01fba054b19749c17260978ac11472564aee2b7f46b192cd83a1d2487cb048cca645f6e8855b9673d500d50bbdb04eebc6beabd6805782df15e53581096b99bd6bbb81f4d4a5e2d2b30954df63175a4075be9c5baa0c16b0074a1e94b48aa0177e9bfc23746aca8a5b42848a6685da85658b5d14ba95cdce1ef7dc9ad3ac74949ca5db38b27378ee30f30a23cf26f9e875a11da4b72764ae929050353f3da759c839e2a061a8b9a8dd3c3b2e909d4a8a3291cf629311734b7c6e6579f8e1d0e1e3f3bf72c9ac6c301b631ba4df7f393c41b14

Bitcoin Addresses (1)

17082531775760189576112827972435

CL-STA-1062 Shows Critical Infrastructure Intrusions Still Start With Web Shells 17 indicators · Jun 25, 2026

IPv4 (4)

139[.]180[.]134[.]221202[.]182[.]102[.]545[.]32[.]113[.]17245[.]76[.]210[.]43

URLs (7)

hxxp://139[.]180[.]134[.]221/PerfWatson2[.]exehxxp://139[.]180[.]134[.]221/sdksdk608/1[.]ziphxxp://139[.]180[.]134[.]221/sdksdk608/anydesk%5f0117[.]ziphxxp://139[.]180[.]134[.]221/sdksdk608/hamcore[.]se2hxxp://139[.]180[.]134[.]221/sdksdk608/hxxpdfhxxp://139[.]180[.]134[.]221/sdksdk608/vpn%5fbridge[.]confighxxp://139[.]180[.]134[.]221/sdksdk608/win-vpn[.]rar

sha256 (6)

00e09754526d0fe836ba27e3144ae161b0ecd3774abec5560504a16a67f0087c4e1f8888d020decd09799ec946f1bf677cac6612b24582ddbf4d8ede425d83849b481b69cd91b09fa7bae7428f646dd89473a4c03393e43da81fe756cde1c472cbfe8de6ffadbb1d396f61e63eb18e8b11c29527c1528641e3223d4c516cf7c3dce5df29bddff5a4ddaea5c4fec14da91f7b69063a6e1c45ed61e5da4fc6c87bf34bd1d485de437fe18360d1e850c3fd64415e49d691e610711d8d232071a0b1

Turla’s STOCKSTAY Backdoor Shows Why Espionage Defense Needs Egress Visibility 74 indicators · Jun 25, 2026

IPv4 (1)

4[.]4[.]3[.]12

Domains (16)

basecon[.]combasecon[.]com[.]uacanal1zac1a[.]onrender[.]comcircoloesteri[.]elezioni[.]idnet[.]itdriverx86-adobe[.]onrender[.]comgoogle-ai-labs-it[.]onrender[.]comonline[.]zp[.]uastream[.]bybit[.]comukr[.]netweatherdataai[.]theworkpc[.]comwool-basalt-clock[.]glitch[.]mews-api[.]binance[.]comws-feed-public[.]sandbox[.]exchange[.]coinbase[.]comws-feed[.]exchange[.]coinbase[.]comwww[.]circoloesteri[.]itwww[.]drs[.]gov[.]ua

URLs (5)

hxxps://basecon[.]com[.]ua/calculator[.]rarhxxps://circoloesteri[.]elezioni[.]idnet[.]it/admin-election/riepilogo[.]phphxxps://online[.]zp[.]ua/wp-content/uploads/Tools/EditorToolsPdf[.]ziphxxps://www[.]circoloesteri[.]it/hxxps://www[.]drs[.]gov[.]ua/wp-content/themes/twentytwentyfive/docs[.]zip

sha256 (51)

0a545dd1b703cddfb3d582c8c70f65f556bbd580bfa836a387121eb837bda61b0d6b083208097d5b3e189891338540f6c64faaaaf268b0bb0b085dd53d5857b41682e8d82016b3f10434d2ebac995fd3b6aa812f079bfd7888652e94a994d85119e6ed42248f9d03beb343a7c09a864dcd3cd671c29e1e5eac93579225224ac91a2ca8b8e0344fe3d80da7352206a470245443e2349a237bc093df934ddc011f1fc23ec18a94a599a34c74ef5f49a1e27acd37a07d5846661702b5e7e81a6a24249a4c7cacdd8e99a2a089a5c0ce904f2eff22e0e40fcfb10f7824dca6c51ecb2623c6e3c1f5a7b5e735a64813bc0e1382ae45831f5fadffb08c0e7b096627f72af7b513c05e76d7da5f75bb0a223c894a706c99ef2c2ddfe4eae542f95a08e034fcbe7e90fc87a4f3766469c19a64f24672d7adb99e0198f5ba10d58911368b3627f582420ad2782d452fe6d13fae42658d1484296351d3916703e25dcadd14391e51354118fb87dc57650cbbd94258c3f7c0a0d6868040b7a473ad626ff25e40a3b969d81ef1ef35dd9ebcc6774e060b1b8949d3d74f38ca6b7d789c95cdb340b1208dda0cd5dd95c6b57764b2cfe7145b3ed9457f498408b4aaa05bf3ef50447f430b46fad5a3f8e8c5aad1f8f7f79af069489c3d9c29224bb9f14f0c7bf445bb8d1ab2c13bf4354294e13d3c9be15de625d807301905b98462f43f93e8934e3bed10a8eff3e9205c1f37f647512464271d5ac65df7ae4709735621a3832055249f296b63a8bcf911b8bc96de43c1ac2b4a56c150a19d33d892a47e57352c626330d22f77d9cbca9d40cc06568041703f194610c4c5a84bbb05a2e4ee74596298f3150ad94a242e649886d47c59c634a4d04b9af5ee15e3bf335c40b5e58e667a8f568a611f2f3d84a366b7946b360e055bece9699c95aad619637ab72a386cee9e838792ac5e2098362d68ce93a9a2c095d476dc16b289fe8509c99b2b8b6da0b4c1a5d0d3fb6e6a2990a82ba51db1f68a3bba818baa46526a29731e23427615140f78d9a0ce31cc9fe8c54c60028a7439cb32526fd97b10afef7145dd7877417df21b4b4e8d86b8bda4afeef93fd36f355362586b2d1f51121a8224416780f6c010fd260d0bcf18a4b6a8d62505adbed50d2e615ed9522c4bfd61c00661813c78b5b6ef28a9c0ed35f2c6cd88fc50880ab91f8777dfe7aaccb1c24b08d581aabf646619ea5f4a72457cd3aa17c5988003d67e6454f45e7cb33613021bac82707cfdf24dcb762f4615f01e1ba4d3dfdec4abe9cd588558d2634d7e6a5eeb9164054d0bf0b7c8820da4f742860940998984555e65820e4fa8dd07b6bd67ec98ce3c6e4dd05887ea619f2bbfeb2e2c2805ed07e85e119b79b828b7ef8be3979fe944147c15a87963b06baf6473288d64c23655a0ba9369c35566272d8efc73a40bf9c75d1bfa6d66f1179f2321de6589f80d3089d992797a9cb0e84f6196ceb064a3efb04ed77e6c57955089ce639e193d166c8ea2216c98c3e9b701ea2cffb287347a5bff8af360ce0e6500c336b6fe6d97920abc26202c9d843ffebc5f89b55f3b8a7334af049ba3f70a9ad3fe78574b1e180c68baf9a7110d104387a636b728eba4f0d6d16602fbad05a591f14391594262d3584b2e249e97f86e4dcc5ac905cb512018cc55512c6a22677c3d6f389c47afd54d7c85797868fc4fcb90e9d1e54270433a94aa3d45d888e4c62299bee3480eb2cb4a5489c7dda69d476c3ed3fd32f915c239872c9e7ed9408b1f36dfcef03aa68f9a396d05c437667cdb43d8fe8f3fe838d5b1a1043096f6f6bb6f524f5f1b0c9f83a081078a824daa0cf3da8a96bc74e265f945f1cc6992c6dc0f9ea36ed1991f7b8d312db79d9bf78c40dfd5cb91d06b9649d4cab500343af80ad1144a9e46641cc406f43dd169003c22e1d16fb635060d23e889b0617d77f0cf06d00cc19b43a2c8b5ac53ac027ac722e2a0f4440f67998a0215d49be31746ea192bfcb4dc4ee532a218f8cf13605714e316b1e13154dc6115e1e0c023f6fe3d17861cae839d4a4a81779b6aad9a24f8e3364ee21cae6725451e8bc9ab9933df0000fd19814170bd132da68d1906d5ffe6d8192960a89d5480868b94088cccdaa1560f9c8a0b0282ced2b7c1f72341b6e83f274bf9914c6cfc0c6b3cdadf089565f49dace4aca93287c22aba9641c8f3f04f43b6f7c2d86109c495179b497f7fb45fd95816623de1b77900f71b4f99edf964353b9ae4bedbe62de6c0d7eafa9fb8b87897bbaea483aedaa8ae191834da

CVEs (1)

CVE-2025-8088

StrikeShark Shows Loader Malware Is an Edge-Exposure Problem 31 indicators · Jun 25, 2026

Domains (4)

connect-microsoft[.]comms-record[.]comms-record[.]topms-tray[.]top

URLs (4)

connect-microsoft[.]comms-record[.]comms-record[.]topms-tray[.]top

md5 (9)

1F65544978B8EA0E745E573B8EE9684B24FCEBDEECBA65004FDB0923763D74FD9C872A0D5D5A38950E8B9AC9B488BE3F9CBD560F820C95D7C38342CD558CB5C6A514D1BB62D7916475946FE7C07AC0AAAA3086BE652C8B20B0B29B2730D57119B3352B42432DEDC4A519F011DC8B5D5AC559CC68986933200FD5D9E4388E2F58D98F568496512E4F98670C61C97CB07A

CVEs (13)

CVE-2016-4437CVE-2021-26855CVE-2021-27076CVE-2021-36260CVE-2022-27925CVE-2022-40684CVE-2022-41082CVE-2023-20198CVE-2023-32315CVE-2023-46747 CVE-2024-21762CVE-2024-36401CVE-2025-55182

Bitcoin Addresses (1)

1F65544978B8EA0E745E573B8EE9684B

Operation Escaneo Shows Latin America’s Edge Devices Are Prime Intrusion Targets 25 indicators · Jun 20, 2026

IPv4 (8)

135[.]237[.]122[.]202165[.]22[.]184[.]26185[.]65[.]245[.]10200[.]79[.]113[.]136201[.]144[.]122[.]58201[.]144[.]122[.]6045[.]61[.]137[.]12662[.]171[.]185[.]97

Domains (3)

ld-linux-x86-64[.]sorev[.]shwww[.]news9live[.]com

URLs (1)

hxxps://www[.]news9live[.]com/technology/tech-news/hackers-used-claude-hit-mexico-agencies-150gb-data-claim-report-2936314

CVEs (13)

CVE-2020-0796CVE-2020-1206CVE-2020-1472CVE-2020-1938CVE-2021-4034 CVE-2021-44228CVE-2022-22972CVE-2022-42475 CVE-2023-27997CVE-2023-46805CVE-2024-21762 CVE-2024-21887 CVE-2025-0282

Showboat Malware Shows Telecom Linux Servers Need Rootkit-Level Monitoring 9 indicators · Jun 19, 2026

Domains (4)

ld[.]sopastebin[.]com telecom[.]webredirect[.]orgukpkmkk[.]so

URLs (2)

hxxps://pastebin[.]com/raw/[actor_pagewebredirect[.]org

CVEs (3)

CVE-2025-3248 CVE-2026-35273CVE-2026-5027

AutoJack Shows AI Browsing Agents Need Localhost Boundaries 4 indicators · Jun 19, 2026

Domains (2)

evil[.]commsft[.]net

URLs (2)

evil[.]comhxxps://evil[.]com

Apache APISIX Auth Bypass Cluster Shows API Gateways Need Plugin-Level Review 5 indicators · Jun 19, 2026

Domains (2)

apisix[.]apache[.]orgwww[.]cve[.]org

URLs (2)

hxxps://apisix[.]apache[.]orghxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-39999

CVEs (1)

CVE-2026-39999

FortiBleed Shows Firewall Patching Is Not Compromise Recovery 7 indicators · Jun 18, 2026

CVEs (7)

CVE-2018-13379 CVE-2022-42475 CVE-2023-27997 CVE-2024-21762 CVE-2024-55591 CVE-2025-59718CVE-2026-25815

Vendor-Signed UEFI Apps Show Secure Boot Still Depends on Revocation Hygiene 1 indicators · Jun 18, 2026

Domains (1)

pg[.]ae

SmartApeSG Okendo Compromise Shows Third-Party Widgets Are Supply-Chain Risk 12 indicators · Jun 18, 2026

Domains (6)

api[.]wigetticks[.]comapi[.]wizzleticks[.]comcdn-static[.]okendo[.]iookendo[.]iowigetticks[.]comwizzleticks[.]com

URLs (6)

api[.]wigetticks[.]com/logout/private-response[api[.]wizzleticks[.]com/claims/scope-schema[cdn-static[.]okendo[.]io/reviews-widget-plus/js/okendo-reviews[hxxp://cdn-static[.]okendo[.]io/reviews-widget-plus/js/okendo-reviews[.]jshxxps://api[.]wigetticks[.]com/logout/private-response[.]php?8D1V4th3hxxps://api[.]wizzleticks[.]com/claims/scope-schema[.]php?4ManBBdA

Tor-Based Crypto Clipper Shows Clipboard Theft Is Now Backdoor Activity 26 indicators · Jun 17, 2026

sha256 (16)

0020d23b0f9c5e6851a7f737af73fd143175ee47054931166369edd93338538a100407796028bf3649752d9d2a67a0e4394d752eb8de86daa42920e814f3fae820db98af3037b197c8a846dbf17b87fc6f049c3e0d9a188f9b9a74d3916dd5e123c1e673f315dafa14b73034a90dd3d393a984451ff6601b8be8142be6487b4335a6bc44b176a050fd6824904b7604f0f45b0fdfa26bf9500b9e05973b387cfd67fc5cf395e28294bbb91ed0e954fdf2e80ebd9119022a115a42c286dc8bacf57630debd35cac6b7d58c4427695579b3e3a8b1cc462f523234cd6c698882a68c7787a9a7d8ae393aa32f257d083903c4dc9b97a1e5b0458c4cd480d4f3cb5b059d90f54ae36c6c5435d5b8bed40faf54cc91f6db28574a6310b5ffaeb0362e96a7abf1d9d6686af1cefcd60b17a312e7eb8cfe267def1ec34aeab6128c811630b2777b73a4c33ac6a409d475057843be6b5d32262ef28a1f1ff5bb52e3834c5fc824630154ac4fdfce94ded01f037c305eab51e9bef3f493c60ff3184a640502cf9fc891ea5ca5ecd8113ef3e69f6f52ff538b6cccbdaa9559106fc72bc6da30d14b80cbd1a19d4ad0473a0661297f8fdf598e81ff6c4ab24e212dcad2e54b3fd43bf94f0cb0ab97c88113b7e07d1a4024d1610617b5ad05882b1dbab89e15baf3b54984caca95fd496bcfe5d7db1611b08d2f5b7d250b43b430e5d76393f9e0

Dark Web (10)

7goms4byw26kkbaanz5a5u5234gusot7rp5imzc3ozh66wwcvmcudjid[.]onioncgky6bn6ux5wvlybtmm3z255igt52ljml2ngnc5qp3cnw5jlglamisad[.]onionfacebookwkhpilnemxj7asaniu7vnjjbiltxjqhye3mhbshg7kx5tfyd[.]oniongfoqsewps57xcyxoedle2gd53o6jne6y5nq5eh25muksqwzutzq7b3ad[.]onionhe5vnov645txpcv57el2theky2elesn24ebvgwfoewlpftksxp4fnxad[.]onionijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onionj3bv7g27oramhbxxuv6gl3dcyfmf44qnvju3offdyrap7hurfprq74qd[.]onionlyhizqy2js2eh6ufngkbzntouiikdek5zsdj3qwa22b4z6knpqorgiad[.]onionshinypogk4jjniry5qi7247tznop6mxdrdte2k6pdu5cyo43vdzmrwid[.]onionwt26llpl5k6gok3vnaxmucwgzv2wk3l7nuibbh25clghrtus3p5ctsid[.]onion

FortiPortal CVE-2026-49938 Shows Network Configuration Data Is a High-Value Target 1 indicators · Jun 13, 2026

CVEs (1)

CVE-2026-49938

Velvet Ant Shows Authentication Infrastructure Is Critical Infrastructure 6 indicators · Jun 13, 2026

Domains (2)

libethscsi[.]sothc[.]org

URLs (1)

thc[.]org

Email Addresses (1)

contact@sygnia[.]co

CVEs (2)

CVE-2021-44228CVE-2024-20399

Shai-Hulud Shows AI Package Scanners Need Prompt-Injection Boundaries 11 indicators · Jun 12, 2026

Domains (5)

anthropic[.]comapi[.]anthropic[.]comfulcio[.]sigstore[.]devlitellm[.]cloud models[.]litellm[.]cloud

URLs (3)

api[.]anthropic[.]com/v1/apihxxps://api[.]anthropic[.]com/v1/apimodels[.]litellm[.]cloud

sha256 (3)

c539766062555d47716f8432e73adbe3a0c0c954a0b6c4005017a668975e275cdc48b09b2a5954f7ff79ab8a2fd80202bd3b59c08c7cdbc6025aa923cb4c0efee1342a80d4b5e83d2c7c22e1e0aaa95f2d88e3dbf0d853a4994b180c93a4b17d

Portainer CVE-2026-33590 Shows Container Admin Tools Need Least Privilege Defaults 1 indicators · Jun 12, 2026

CVEs (1)

CVE-2026-33590

ShinyHunters PeopleSoft Exploitation Shows ERP Admin Endpoints Are Breach Surface 13 indicators · Jun 11, 2026

IPv4 (6)

142[.]11[.]200[.]186142[.]11[.]200[.]187142[.]11[.]200[.]188142[.]11[.]200[.]189142[.]11[.]200[.]190176[.]120[.]22[.]24

Domains (1)

azurenetfiles[.]net

sha256 (5)

2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a3568257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc309c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711fd83fdb9e53c5ff03c4cb0451ea1bebd79b53f29eadc1e2fa394c7af13a86ce2ff02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc

CVEs (1)

CVE-2026-35273

LangGraph Checkpointer Bugs Show AI Agent Memory Is Backend Attack Surface 4 indicators · Jun 11, 2026

CVEs (4)

CVE-2025-67644CVE-2026-27022CVE-2026-28227CVE-2026-28277

C0XMO Shows IoT Botnets Are Still an Edge Exposure Problem 1 indicators · Jun 7, 2026

CVEs (1)

CVE-2021-27137

SolarWinds Serv-U Exploitation Shows File Transfer Availability Is Security 1 indicators · Jun 6, 2026

CVEs (1)

CVE-2026-28318

Pink Extortion Shows Microsoft 365 Defense Starts With Vishing Controls 9 indicators · Jun 6, 2026

IPv4 (3)

172[.]93[.]100[.]252185[.]178[.]208[.]15396[.]232[.]20[.]66

Domains (3)

deploypasskey[.]compasskeyadd[.]compasskeydeploy[.]com

URLs (3)

deploypasskey[.]compasskeyadd[.]compasskeydeploy[.]com

PAN-OS GlobalProtect Exploitation Shows VPN Access Needs Log Review, Not Just Patching 22 indicators · Jun 5, 2026

IPv4 (9)

104[.]207[.]144[.]154146[.]19[.]216[.]119146[.]19[.]216[.]120146[.]19[.]216[.]125179[.]43[.]172[.]213185[.]195[.]232[.]139198[.]12[.]106[.]60202[.]144[.]192[.]4723[.]128[.]228[.]6

CVEs (13)

CVE-2023-33538 CVE-2025-0921 CVE-2025-14847 CVE-2025-23304 CVE-2025-55182 CVE-2025-66478 CVE-2026-0257 CVE-2026-0300 CVE-2026-1281 CVE-2026-1340 CVE-2026-1731 CVE-2026-22584 CVE-2026-31431

UNC3753 Brings Vishing, RMM Abuse, and Physical Intrusions to U.S. Law Firms 15 indicators · Jun 5, 2026

IPv4 (7)

174[.]169[.]162[.]62192[.]236[.]146[.]173192[.]236[.]147[.]131192[.]236[.]147[.]138192[.]236[.]154[.]158193[.]141[.]60[.]21264[.]94[.]84[.]97

Domains (2)

business-data-leaks[.]comprivnote[.]com

URLs (6)

business-data-leaks[.]comhelpdesk[.]comhxxps://business-data-leaks[.]comit[.]comitdesk[.]comprivnote[.]com

Cisco SD-WAN Zero-Day Shows Edge Controllers Need Compromise Review 14 indicators · Jun 5, 2026

IPv4 (11)

20[.]12[.]7[.]120[.]12[.]7[.]220[.]15[.]4[.]420[.]15[.]4[.]520[.]15[.]5[.]220[.]15[.]5[.]320[.]18[.]3[.]120[.]9[.]9[.]120[.]9[.]9[.]226[.]1[.]1[.]126[.]1[.]1[.]2

CVEs (3)

CVE-2026-20127 CVE-2026-20182CVE-2026-20245

Agentic AI Failure Modes Show Why AI Tools Need Supply-Chain Controls 1 indicators · Jun 4, 2026

CVEs (1)

CVE-2026-25253

Error 524 Smishing Shows Why Fraud Infrastructure Needs CTI 8 indicators · Jun 4, 2026

IPv4 (7)

154[.]81[.]166[.]1743[.]159[.]168[.]18643[.]162[.]84[.]20243[.]165[.]6[.]3645[.]135[.]162[.]9047[.]82[.]154[.]28[.]222[.]134[.]149

Domains (1)

ipapi[.]co

TA4922’s Global Expansion Shows HR and Tax Lures Are Initial Access Infrastructure 24 indicators · Jun 3, 2026

IPv4 (5)

103[.]214[.]172[.]33154[.]211[.]86[.]11018[.]139[.]83[.]110206[.]238[.]115[.]5843[.]156[.]77[.]97

Domains (3)

aeya388[.]clubnwphotoblog[.]comsrt[.]tw

URLs (2)

aeya388[.]clubnwphotoblog[.]com

sha256 (14)

0857148fb0bc4aa7adf967ede2307bdb4fc427065d5b6a6db132688a5a8e1eb82d2a251a88632f010fd9671789746908eeccaa5bc5c0a5d25e4649efe4f5b15d3119cf37b8267db8a2dcd11d9a83d5237d7ef1e42388e7c9afa2831b91da8a2d314f4b59535d1b783e1c20c2be00f9e30f8ed27b2e21fad06a73b47ea43279ef40b41979b317406f8abc601677a3b93aaf6ef8ab8ac188b8f383735e388f13b54fcfa88fffacbce30bbe2136753c9ab5a4c092940d2406fd9d44d5118e745b9d584a9448dda46bd590d7a2f86228100d2ae6e0d6d990c1a4459ed5ee28e07ae866a3836b9a17771bce2161f6b73cbc2494a91e49d6aa30d2d53711e8d10de60d8c9b6542f73c5c7fe455b52f5101314407da4f65ff48e7ebf6896605e607c8d09d0a55c545c4147956db2c2667c4ed931a2875309147548b1dfdd216228f5f73a648db354820ea4d02940cb1702b35974513b7aae83f6dffaacaac4ba31f9295a75eab31d7ff06b6864960ad7e633be3f9730ff3d3873e4539c8f425fc632dadde82998ad5fcd63deae030803388e0fb4290d6223fda82368fd25b99b823f0d2e0a6a71c605d9a4076147e9537f82f79f1e1eccadc874595160aa4637ff4088c

Red Hat’s Miasma npm Compromise Shows Trusted Publishing Is Not a Control Boundary 4 indicators · Jun 3, 2026

Domains (1)

www[.]aikido[.]dev

URLs (1)

hxxps://www[.]aikido[.]dev/blog/red-hat-npm-packages-compromised-credential-stealing-worm

sha1 (2)

0c5077e51419868618aeaa5fe8019c62421857d6de0fac2e4500dabe0009e67214ff5f5447ce83dd

FlutterBridge Shows Why macOS Malvertising Is Backdoor Delivery, Not Just Adware 38 indicators · Jun 2, 2026

Domains (14)

PDF-Brain[.]appPDF-Ninja[.]appads-parkpro[.]comadsparkpro[.]netadsparkpro[.]topatsheisdomestic[.]orgcom[.]appcom[.]pdfninja[.]appdart[.]devetoftheappyrince[.]orgflutter[.]devhealightejustb[.]orgsinterfumesco[.]comsparkle-project[.]org

URLs (15)

ads-parkpro[.]comadsparkpro[.]netadsparkpro[.]topatsheisdomestic[.]orgatsheisdomestic[.]org/update-thanks[.]htmletoftheappyrince[.]orgetoftheappyrince[.]org/update-delayhealightejustb[.]orghealightejustb[.]org/checkupdateTO[.]jshxxps://atsheisdomestic[.]org/update-thanks[.]htmlhxxps://etoftheappyrince[.]org/update-delayhxxps://healightejustb[.]org/checkupdateTO[.]jshxxps://sinterfumesco[.]com/search?utn=[Trackingsinterfumesco[.]comsinterfumesco[.]com/search?utn=[Tracking

sha256 (9)

021666417de8b9972c179783fe60d4c4ad2d93224e3a0f16137065c960b1b84530448686ec900d5213d74f08f0d2b7924c5336a29445b2a434aba8d8b19d7530363923500ce942bf1a953e8a4e943fbf1fb1b5ed6e5d247964c345b3ad5bfc3448047c34bbd57fe1e24bc538bc2ce9e0ac4c4eb48d3b0c195b414f0379dc0745644fc49fa1006a2a2acace694e5fb83753164e2617051ece6d9dc9ea32329e708421c902364980e3d762ec6dbbe6b0f40577c27bd79b48c57d098328b25331099053e8ddaecca1f960c041c944ca8799fc71dc86a4b50d2639ee4e0d2cb82f479425e8e39fa8a7212cdd07f0917cb3dfde38a90b87297de2c82a5850aff1e4deb60074d1ea2008a581f432f2dee5f84f78668d9dd8e66f75d03c42dabd89bdea

FortiClient EMS Exploitation Turns Endpoint Management Into an Infostealer Delivery System 16 indicators · Jun 1, 2026

IPv4 (3)

185[.]220[.]101[.]15192[.]42[.]116[.]1483[.]138[.]53[.]110

URLs (2)

hxxp://83[.]138[.]53[.]110/dl/p[.]exehxxp://83[.]138[.]53[.]110/service/save[.]php

md5 (2)

338662fd0c4d750a0ba203a32b59f0818c5b72906e8183037532afc3f4639931

sha1 (1)

17e771c78430cc67e71d4547f8996a1a488e9d3f

sha256 (5)

0da123adf9251957a4b850a3f6bd6a753dd4892be176a84a18450e899534cc5e2927bc31b4f8254c6b332fc03110a6373cad00ffa2ff9de427c26bb222017bb22f25ea1b622abf3212141af932c2ec4cbd6b2b5903c2a531121f691227d98cffd91c00fad521e76efa89715cca89db487d5676f2c767c883482f9c8f82bd383afd65051c61a904a304919c04a8c8633c001183ac73ac461cd4d9057946f02bf5

CVEs (2)

CVE-2026-35616 CVE-2026-48558

Bitcoin Addresses (1)

338662fd0c4d750a0ba203a32b59f081

Meta AI Support Bot Abuse Shows Account Recovery Is Part of the Identity Perimeter 1 indicators · Jun 1, 2026

Domains (1)

thecybersecguru[.]com

SolyxImmortal Shows Why Python Infostealers Are a Business Risk, Not Just Malware Noise 7 indicators · Jun 1, 2026

Domains (2)

socprime[.]comwww[.]cyfirma[.]com

URLs (2)

hxxps://socprime[.]com/active-threats/solyximmortal-python-malware-analysis/hxxps://www[.]cyfirma[.]com/research/solyximmortal-python-malware-analysis/

md5 (1)

2690f7c685784fff006fe451fa3b154c

sha1 (1)

81c66c043982cfee9e60ae94203f4336da0b50c0

sha256 (1)

5a1b440861ef652cc207158e7e129f0b3a22ed5ef5d2ea5968e1d9eff33017bc

Showboat and JFMBackdoor Show Telecom Intrusions Are Built for Pivoting 35 indicators · May 31, 2026

IPv4 (7)

101[.]36[.]105[.]222116[.]169[.]244[.]208139[.]84[.]227[.]139192[.]9[.]141[.]111194[.]135[.]25[.]13223[.]27[.]201[.]16064[.]176[.]43[.]209

Domains (6)

assets[.]lumen[.]comkaztelecom[.]shopsingtelcom[.]sitetelecom[.]webredirect[.]orgwebredirect[.]orgwww[.]lumen[.]com

URLs (18)

hxxps://assets[.]lumen[.]com/is/content/Lumen/Black_Lotus_Labs_Video-6341053041112hxxps://assets[.]lumen[.]com/is/image/Lumen/author-black-lotus-labs-logo-image-300x300?Creativeid=b08a9660-2840-4cf8-b2b4-aa45b9585632hxxps://assets[.]lumen[.]com/is/image/Lumen/img-blog-bll-malware-fig1?$PNG$&Creativeid=baae57fe-30cb-446d-9373-b5835ed6d74ahxxps://assets[.]lumen[.]com/is/image/Lumen/img-blog-bll-malware-fig2?$PNG$&Creativeid=679e321b-7df3-45e4-9292-c1c02c13732chxxps://assets[.]lumen[.]com/is/image/Lumen/img-blog-bll-malware-fig3?$PNG$&Creativeid=c742db12-86dc-4216-b182-07991ebadce5hxxps://assets[.]lumen[.]com/is/image/Lumen/img-blog-bll-malware-fig4?$PNG$&Creativeid=f104f1c6-3a1f-460b-b597-813b63e43e0dhxxps://assets[.]lumen[.]com/is/image/Lumen/img-blog-bll-malware-fig5?$PNG$&Creativeid=9f6a7f84-711d-4f83-b1b4-38b6129e1d23hxxps://assets[.]lumen[.]com/is/image/Lumen/img-blog-bll-malware-fig6?$PNG$&Creativeid=a9148deb-22b8-43c8-bb11-dc6feceb9714hxxps://assets[.]lumen[.]com/is/image/Lumen/img-blog-bll-malware-fig8?$PNG$&Creativeid=bdd1dcd8-5848-4020-b2e8-448ad48d9e98hxxps://assets[.]lumen[.]com/is/image/Lumen/img-blog-bll-malware-showboat-table?$JPG$&Creativeid=416e9156-1fd8-4382-b2a3-107f5062946ahxxps://assets[.]lumen[.]com/is/image/Lumen/img-blog-bll-newmalware-figure7?$PNG$&Creativeid=adbfea9c-c17b-4cbe-bb9d-c800b6b23a84hxxps://assets[.]lumen[.]com/is/image/Lumen/img-blog-featured-resource-card-bll?Creativeid=844b527d-b24a-4d66-928e-9d6964fc2220hxxps://assets[.]lumen[.]com/is/image/Lumen/img-blog-header-bll-malware-848x566?$PNG$&Creativeid=7832e142-117a-4b22-9ce4-cf575ba34f02hxxps://www[.]lumen[.]com/en-us/security/black-lotus-labs[.]htmlkaztelecom[.]shopsingtelcom[.]sitetelecom[.]webredirect[.]orgwebredirect[.]org

sha256 (4)

2229e7f3cabbce4d67cd79c89fd5a100b20e8a99f4a2bf9aac77a978f49eb52027df475626aafce2ea1548a9f35efb9ad951298c8b11a6adb3ccdfcd5170c677A72427af3c046fd90999a6505b2372dc4ffde122227f30ed21621ecd4f2d3e8bE28a96f983b8605decd2ac1db16ebad5fa741a6aa4e585a38ade0e5ad7d6cec0

WP Maps Pro Exploitation Shows Why Plugin Support Features Need Security Review 1 indicators · May 31, 2026

CVEs (1)

CVE-2026-8732

MediaInfoLib Parser Bugs Show File Metadata Is an Execution Boundary 5 indicators · May 27, 2026

Domains (1)

Snort[.]org

CVEs (4)

CVE-2026-22554CVE-2026-25104CVE-2026-25713CVE-2026-28764

Poisoned Search and AI Recommendations Turn Utility Downloads Into RMM Access 34 indicators · May 26, 2026

IPv4 (4)

193[.]42[.]11[.]108198[.]23[.]185[.]2382[.]59[.]132[.]10693[.]115[.]10[.]35

Domains (11)

Direct-download[.]giize[.]comFree-download[.]giize[.]comdirect-download[.]gleeze[.]comdirect-downloads[.]giize[.]comdirectdownload[.]icudynu[.]comfree-download[.]giize[.]comgiize[.]com gleeze[.]comminemine[.]gleeze[.]comstart-download[.]gleeze[.]com

URLs (7)

Direct-download[.]giize[.]comFree-download[.]giize[.]comdirect-download[.]gleeze[.]comdirectdownload[.]icugiize[.]com gleeze[.]comstart-download[.]gleeze[.]com

sha256 (12)

062bb28765fbaa11f8cc341fa16e2c7f942a122d929cb41f4a0f755b4429f24616562974deec80e41ef57a71a6de8c03ceb393005fb1432f8d9d82c61294ef8c1b2555b09ac62164638f47c8272beb6b0f97186e37d3a54cb84c723ff7a2eee52ee93ccbcd49ed94c65dcf52e7dcb8f0fa0a443ca24c0e0c7f79152efba657b769077fcf940fc5852fb32beed15636756ebc04ac971b7ed71d36251e7ea70a207035c2abeb617e828dfda1b119b8544fa9ae15a1d263d18bc5506acaf381f4969ff07c9fafa9c03fdf69e4abf6806aa7c938b5480e7e258f227db0719ecd6386a460d00ef93c8ce70d32e48e55781af66a53328fc2dde45519be196c265de074c7425fbe6c3a4937934215c54027d4b67202d12ab490682fae03498870d66d06cf3f8160eb5a5580e0c35054847e3ac4d01e9fe74fab8bc12bf6e8a40bf696b2db2d33c4e6e4a5c2263b56e8303c343305a94dde1fc2968304ba260acbbd9f9fe021662a652ba95c8778b991056696ab3c9b0f60d5e23b1e6cf73c3847db6610

LiteSpeed cPanel KEV Shows Shared Hosting Is Privilege Escalation Terrain 1 indicators · May 26, 2026

CVEs (1)

CVE-2026-48172

Megalodon GitHub Actions Backdoor Shows CI/CD Is Now a Credential Battlefield 8 indicators · May 26, 2026

IPv4 (1)

216[.]126[.]225[.]129

Domains (2)

safedep[.]ioteaak[.]com

URLs (2)

hxxp://216[.]126[.]225[.]129:8443hxxp://216[.]126[.]225[.]129:8443?h=megalodon&l=gh_dump&id=hefs8esnhgkx&quot

sha1 (3)

18aa49e5f42ceaf9f010f01a396f625100c7aad88a454e601c4f69576c4e4edd14b8d2a0c52eaf27acac5a9854650c4ae2883c4740bf87d34120c038

KnowledgeDeliver RCE Shows Shared Machine Keys Are Shared Blast Radius 4 indicators · May 25, 2026

IPv4 (2)

121[.]0[.]0[.]01[.]9[.]2[.]13

sha256 (1)

7c1f99dca8e5a7897892f9d224a6495023a2cfd2671697d229d355978c415ed2

CVEs (1)

CVE-2026-5426

Laravel-Lang Compromise Shows Dependency Tags Can Be Weaponized 4 indicators · May 24, 2026

Domains (2)

Fly[.]ioflipboxstudio[.]info

URLs (2)

flipboxstudio[.]infoflipboxstudio[.]info/exfil

Cl0p’s South Staffs Water Case Shows SOC Coverage Must Be Proven 18 indicators · May 24, 2026

Domains (8)

Booking[.]comdecoded[.]avast[.]ioico[.]orgico[.]org[.]ukmalpedia[.]caad[.]fkie[.]fraunhofer[.]deredcanary[.]comsecurityintelligence[.]comwww[.]ransomware[.]live

URLs (8)

hxxps://decoded[.]avast[.]io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/hxxps://ico[.]org[.]uk/media2/xdrfahsw/south-staffordshire-plc-and-south-staffordshire-water-plc-monetary-penalty-notice[.]pdfhxxps://malpedia[.]caad[.]fkie[.]fraunhofer[.]de/details/win[.]clophxxps://malpedia[.]caad[.]fkie[.]fraunhofer[.]de/details/win[.]get2hxxps://malpedia[.]caad[.]fkie[.]fraunhofer[.]de/details/win[.]sdbbothxxps://redcanary[.]com/blog/raspberry-robinhxxps://securityintelligence[.]com/posts/raspberry-robin-worm-dridex-malware/hxxps://www[.]ransomware[.]live/group/clop

CVEs (2)

CVE-2020-1472CVE-2022-30190

ROADtools Abuse Shows Cloud Identity Is the New Attack Surface 2 indicators · May 24, 2026

Domains (1)

enterpriseregistration[.]windows[.]net

URLs (1)

windows[.]net

Drupal CVE-2026-9082 Shows Web Asset Inventory Is Emergency Response 1 indicators · May 23, 2026

CVEs (1)

CVE-2026-9082

Void Dokkaebi’s InvisibleFerret Shift Shows Developer Endpoints Are Production Risk 9 indicators · May 23, 2026

IPv4 (1)

45[.]59[.]160[.]199

Domains (6)

brw[.]soclaude[.]ai ip-api[.]commc[.]somod[.]sopad[.]so

URLs (2)

hxxp://ip-api[.]com/jsonip-api[.]com/json

F5-to-Confluence Intrusion Shows Edge Devices Are Identity Attack Paths 13 indicators · May 22, 2026

IPv4 (1)

206[.]189[.]27[.]39

Domains (2)

my[.]f5[.]comwww[.]darktrace[.]com

URLs (3)

hxxp://206[.]189[.]27[.]39:8888/5hxxps://my[.]f5[.]com/manage/s/article/K000156741hxxps://www[.]darktrace[.]com/blog/darktraces-view-on-operation-lunar-peek-exploitation-of-palo-alto-firewall-devices-cve-2024-2012-and-2024-9474

sha256 (5)

4a927d031919fd6bd88d3c8a917214b54bca00f8ddc80ecfe4d230663dda746557b3188e24782c27fdf72493ce599537efd3187d03b80f8afe733c72d68c5517710a9d2653c8bd3689e451778dab9daec0de4c4c75f900788ccf23ef254b122ab4592cea69699b2c0737d4e19cff7dca17b5baf5a238cd6da950a37e9986f216bdd5da81ac34d9faa2a5118d4ed8f492239734be02146cd24a0e34270a48a455

CVEs (2)

CVE-2025-33073CVE-2025-53521

Screening Serpens Shows Recruiting Is Now an Espionage Attack Surface 53 indicators · May 22, 2026

IPv4 (2)

144[.]0[.]0[.]0146[.]0[.]0[.]0

Domains (23)

2117[.]filemail[.]comBuisness-centeral-transportation[.]comBusinessstartup[.]azurewebsites[.]netElementShift[.]azurewebsites[.]netLicenceSupporting[.]azurewebsites[.]netNanoMatrix[.]azurewebsites[.]netPeerDistSvcManagers[.]azurewebsites[.]netPremier-HealthAdvisory[.]azurewebsites[.]netPremierHealthAdvisory[.]azurewebsites[.]netPremierHealthAdvisory[.]comQuantumWeave[.]azurewebsites[.]netRamiltons-finance[.]azurewebsites[.]netRamiltonsfinance[.]azurewebsites[.]netRamiltonsfinance[.]comThemesManagers[.]azurewebsites[.]netThemesProviderManagers[.]azurewebsites[.]netbuisness-centeral-transportation[.]azurewebsites[.]netbuisness-centeral[.]azurewebsites[.]netbusiness-startup[.]azurewebsites[.]netbusiness-startup[.]orgdocspace-twpf0e[.]onlyoffice[.]comdocspace-y4cumb[.]onlyoffice[.]comlicencemanagers[.]azurewebsites[.]net

URLs (15)

Buisness-centeral-transportation[.]comPremierHealthAdvisory[.]comRamiltonsfinance[.]comazurewebsites[.]netbusiness-startup[.]orgfilemail[.]com/api/file/get?filekey=T0EnWQ6NugHkW_kLfDxPBEw_um6NSkg9ZwNRQ_5lrKrLLUo35pV8m3TKv1LqF3zZzdUmhxxps://2117[.]filemail[.]com/api/file/get?filekey=T0EnWQ6NugHkW_kLfDxPBEw_um6NSkg9ZwNRQ_5lrKrLLUo35pV8m3TKv1LqF3zZzdUmhxxps://ElementShift[.]azurewebsites[.]nethxxps://NanoMatrix[.]azurewebsites[.]nethxxps://QuantumWeave[.]azurewebsites[.]nethxxps://docspace-twpf0e[.]onlyoffice[.]com/storage/files/root/folder_3765000/file_3764519/v1/content[.]zip?filename=remote[.][REDACTED][.]ziphxxps://docspace-y4cumb[.]onlyoffice[.]com/storage/files/root/folder_3602000/file_3601577/v1/content[.]zip[onlyoffice[.]comonlyoffice[.]com/storage/files/root/folder_3602000/file_3601577/v1/content[.]zip[onlyoffice[.]com/storage/files/root/folder_3765000/file_3764519/v1/content[.]zip?filename=remote[.][REDACTED

md5 (1)

edcdba624ddb43c2a1dcf334aa493068

sha256 (12)

0db36a04d304ad96f9e6f97b531934594cd95a5cea9ff2c9af249201089dc864332ba2f0297dfb1599adecc3e9067893e7cf243aa23aedce4906a4c480574c1738bd137c672bd58d08c4f0502f993a6561e2c3411773d1ae57ee0151a0a9d11d43dc62cef52ebdd69e79f10015b3e13890f26c058325c0ff139c70f8d8eadcfa44f4f7aca7f1d9bfdaf7b3736934cbe19f851a707662f8f0b0c49b383e05425074882085db2088356ed7f72f01e0404a0a98cda88ef56fb15ce74c1f36b26d278808c794c24367438f183e4be941876f1d3ecd0c8d2eb43b10d2380841d2283b9cf029daca89523d917dafed0568d11d00e45ec96b5b90b4a1f7fd4018c7da849e4a658e6d831c9e9bdfe11884a75b7c64812ed0a80e8495ddf6b316505acac1B19e06da580cf91691eda066ac9ee4b09c6e5dc26c367af12660fe1f9306eec4bc3b44154518c5794ce639108e7b9c5fecb0c189607a26de1aaed518d890c7add4a7e9f107fe40c1a5d0139c6c6e25bf6bf57f61feff090bee28f476bb3cc3c2

Kimwolf Arrest Shows DDoS Risk Starts on Forgotten IoT 2 indicators · May 21, 2026

Domains (1)

ottawacitizen[.]com

URLs (1)

hxxps://ottawacitizen[.]com/news/local-news/what-is-going-on-in-ottawa-handcuffing-of-another-child-with-autism-worries-advocates

TamperedChef Shows Signed Productivity Apps Cannot Be Trusted by Default 7 indicators · May 21, 2026

Domains (2)

onezipapp[.]comwww[.]crystalpdf[.]com

URLs (3)

crystalpdf[.]com/conditionshxxps://www[.]crystalpdf[.]com/conditionsonezipapp[.]com

sha256 (2)

2231bfa7c7bd4a8ff12568074f83de8e4ec95c226230cccc6616a1a4416de268248de1470771904462c91f146074e49b3d7416844ec143ade53f4ac0487fdb44

Patriot Bait Shows AI-Enabled Fraud Can Turn Trust Into Attack Surface 7 indicators · May 21, 2026

IPv4 (4)

213[.]165[.]51[.]11534[.]34[.]57[.]14134[.]34[.]81[.]12935[.]192[.]41[.]201

Domains (3)

Venice[.]aiclaude[.]aivebrf[.]digital

ExifTool CVE-2026-3102 Shows Image Metadata Belongs in the Threat Model 2 indicators · May 20, 2026

CVEs (2)

CVE-2021-22204CVE-2026-3102

P2Pinfect Shows Exposed Redis in Kubernetes Can Become Dormant Botnet Infrastructure 15 indicators · May 20, 2026

IPv4 (7)

178[.]62[.]63[.]12547[.]237[.]140[.]1247[.]83[.]124[.]12147[.]86[.]33[.]19547[.]86[.]5[.]1768[.]210[.]178[.]408[.]210[.]50[.]65

URLs (1)

hxxp://8[.]210[.]50[.]65:60126/linux

md5 (4)

08ad2c2877edda9a050b81d011c1c0035d1ca537c4bedebf2f4d276d4199ea9580676a539765a9e117f20b6b99887ecaa1a35afebb585917675534de3d610c93

CVEs (3)

CVE-2022-0543CVE-2025-11953CVE-2025-49844

Fox Tempest Shows Code Signing Trust Can Be Weaponized 7 indicators · May 19, 2026

Domains (1)

signspace[.]cloud

URLs (1)

signspace[.]cloud

sha1 (2)

7e6d9dac619c04ae1b3c8c0906123e752ed66d63dc0acb01e3086ea8a9cb144a5f97810d291020ce

sha256 (3)

11af4566539ad3224e968194c7a9ad7b596460d8f6e423fc62d1ea5fc0724326f0668ce925f36ff7f3359b0ea47e3fa243af13cd6ad9661dfccc9ff79fb4f1ccf0a6b89ec7eee83274cd484cea526b970a3ef28038799b0a5774bb33c5793b55

Storm-2949 Shows Cloud Breaches Start With Identity, Not Malware 3 indicators · May 18, 2026

IPv4 (3)

176[.]123[.]4[.]44185[.]241[.]208[.]24391[.]208[.]197[.]87

AI Agent Governance Is Becoming a Security Control, Not a Nice-to-Have 1 indicators · May 18, 2026

Domains (1)

claude[.]ai

Grafana GitHub Token Breach Shows Why Source Code Access Needs Guardrails 1 indicators · May 17, 2026

Domains (1)

Ransomware[.]live

node-ipc Backdoor Shows Why CI Secrets Need Supply Chain Controls 1 indicators · May 17, 2026

Domains (1)

sh[.]azurestaticprovider[.]net

Exchange OWA Zero-Day Shows Why Email Servers Need Emergency Mitigation 1 indicators · May 16, 2026

CVEs (1)

CVE-2026-42897

Device Code Phishing Turns Legitimate Login Flows Into Token Theft 88 indicators · May 16, 2026

Domains (46)

019d442a-endpoint[.]com019d442e-endpoint[.]com019d6860-endpoint[.]com0fdba029e6a5-endpoint[.]com2dc62559e005-endpoint[.]com4daa2aea93db-endpoint[.]com6dd5fd945b34-endpoint[.]com7740f766-8d1d-46ad-a6bc-onedrive[.]p-9jluifuu[.]workers[.]dev7806d4cf9366-endpoint[.]comaudit-report-9767d3[.]fullerjp09[.]workers[.]devconsistentdigital[.]decrediblebizextension[.]dedigitalcontinuity[.]dedigitalreliability[.]deed5ce47d835f-endpoint[.]comee10bbf6c689-endpoint[.]comeuromarketsignal[.]deeuropesignaltrust[.]deeuropetrustwave[.]deextendyourcredibility[.]def36c2774f013-endpoint[.]comf8uh-dwam-j4l5[.]pvasquez-princetonpartners-com-s-account[.]workers[.]devheilbronner-fruehlingssymposium[.]dehewktree[.]neths-sites-na2[.]comhti-245401512[.]hs-sites-na2[.]comjo2c9ada427c6-endpoint[.]comkohlhoff-edelstahlverarbeitung[.]demarketcredibilitysignals[.]demarktkarree-langenfeld[.]demethodicalness[.]deonedrive-7tu[.]techroboticslabmade-techie-com-s-account[.]workers[.]devpanel[.]hewktree[.]netreliableinteractions[.]dereliablesupport[.]deservicewithoutinterruption[.]destablewebsystems[.]detrustedengagement[.]deuninterruptedperformance[.]devoicemail-59f[.]admin-treyripple-com-s-account[.]workers[.]devvoicemail-lyr[.]nbuckley-cambek-com-s-account[.]workers[.]devvoicemail-wx7[.]mark-squires-expressrancnes-com-s-account[.]workers[.]devworkers[.]devyaga9b286ae2c101-endpoint[.]comytgw-9n30-xlwd[.]pvasquez-princetonpartners-com-s-account[.]workers[.]devz6e43e5886fe-endpoint[.]com

URLs (42)

019d442a-endpoint[.]com019d442e-endpoint[.]com019d6860-endpoint[.]com0fdba029e6a5-endpoint[.]com2dc62559e005-endpoint[.]com4daa2aea93db-endpoint[.]com6dd5fd945b34-endpoint[.]com7740f766-8d1d-46ad-a6bc-onedrive[.]p-9jluifuu[.]workers[.]dev7806d4cf9366-endpoint[.]comconsistentdigital[.]decrediblebizextension[.]dedigitalcontinuity[.]dedigitalreliability[.]deed5ce47d835f-endpoint[.]comee10bbf6c689-endpoint[.]comeuromarketsignal[.]deeuropesignaltrust[.]deeuropetrustwave[.]deextendyourcredibility[.]def36c2774f013-endpoint[.]comf8uh-dwam-j4l5[.]pvasquez-princetonpartners-com-s-account[.]workers[.]devheilbronner-fruehlingssymposium[.]dehti-245401512[.]hs-sites-na2[.]comjo2c9ada427c6-endpoint[.]comkohlhoff-edelstahlverarbeitung[.]demarketcredibilitysignals[.]demarktkarree-langenfeld[.]demethodicalness[.]deonedrive-7tu[.]techroboticslabmade-techie-com-s-account[.]workers[.]devpanel[.]hewktree[.]netreliableinteractions[.]dereliablesupport[.]deservicewithoutinterruption[.]destablewebsystems[.]detrustedengagement[.]deuninterruptedperformance[.]devoicemail-59f[.]admin-treyripple-com-s-account[.]workers[.]devvoicemail-lyr[.]nbuckley-cambek-com-s-account[.]workers[.]devvoicemail-wx7[.]mark-squires-expressrancnes-com-s-account[.]workers[.]devyaga9b286ae2c101-endpoint[.]comytgw-9n30-xlwd[.]pvasquez-princetonpartners-com-s-account[.]workers[.]devz6e43e5886fe-endpoint[.]com

Recent Linux Kernel Exploits Make Attack Surface Reduction a Practical Priority 4 indicators · May 16, 2026

Domains (2)

badkeys[.]infoitsec[.]hboeck[.]de

URLs (2)

hxxps://badkeys[.]info/hxxps://itsec[.]hboeck[.]de/

PawsRunner Steganography Shows Infostealers Are Hiding in Plain Sight 11 indicators · May 15, 2026

IPv4 (1)

5[.]101[.]84[.]202

Domains (2)

everycarebd[.]comxverse[.]app

URLs (2)

everycarebd[.]com/imagelkjh0987[hxxps://everycarebd[.]com/imagelkjh0987[.]png

sha256 (6)

0fcb86ae384e9975933314ac2a231f0ff46c0208556bf4a16f096a642d3f505e1b730de72f921458b6b162b105a9521a931f07e19d3cac53207c7a8efbc412f96910d27b9e1dc2229a8c280f5d0cea85146d50274c56a4d9a5b8d1793505b1b98d0bcde739929fe41a6bcaaa62f7cba802af90b2ba8dea6ed1a4821236cdd58893724f1a9ad3a28c171927fc449ac34dc6ca890f915f00210e8b305577388c6ee2308749f6b7b7573009d0cac6616a6aa83cecb1f2933e868776400d122c86ec

BlackFile Vishing Campaign Shows Why MFA Alone Is Not Enough 11 indicators · May 15, 2026

IPv4 (1)

179[.]43[.]185[.]226

Domains (3)

company[.]sharepoint[.]comgetsession[.]orgorganization[.]sharepoint[.]com

URLs (5)

enrollms[.]comhxxps://company[.]sharepoint[.]com/sites/ProductionOps/hxxps://organization[.]sharepoint[.]com/sites/Legal_Archive/passkeyms[.]comsetupsso[.]com

Email Addresses (2)

victim[.]user@company[.]comvictim[.]user@organization[.]com

Gremlin Stealer Shows Why Browser Sessions Are Now High-Value Targets 19 indicators · May 15, 2026

IPv4 (1)

194[.]87[.]92[.]109

Domains (3)

api[.]ipify[.]orgapi[.]telegram[.]orgtelegram[.]org

URLs (4)

api[.]telegram[.]orghxxp://api[.]ipify[.]org/?format=jsonhxxps://api[.]telegram[.]orgipify[.]org

sha256 (11)

1bd0a200528c82c6488b4f48dd6dbc818d48782a2e25ccd22781c5718c3f62f52172dae9a5a695e00e0e4609e7db0207d8566d225f7e815fada246ae995c0f9b281b970f281dbea3c0e8cfc68b2e9939b253e5d3de52265b454d8f0f578768a2691896c7be87e47f3e9ae914d76caaf026aaad0a1034e9f396c2354245215dc3971198ff86aeb42739ba9381923d0bc6f847a91553ec57ea6bae5becf80f87599aab30a3190301016c79f8a7f8edf45ec088ceecad39926cfcf3418145f3d6149fda1ddb1acf8dd3685ec31b0b07110855832e3bed28a0f3b81c57fe7fe3ac20a9f529a5cbc1f3ee80f785b22e0c472953e6cb226952218aecc7ab07ca328abdab0fa760bd037a95c4dee431e649e0db860f7cdad6428895b9a399b6991bf3cdd11938f14499de03d6a02b5e158782afd903460576e9227e0a15d960a2e9c02cf76ba1a4650d8cafb6d3ff071688c5db6fd37e165050f03cece693826f51d346

Cisco SD-WAN Exploitation Shows Edge Controllers Need Emergency Review 45 indicators · May 14, 2026

IPv4 (16)

104[.]233[.]156[.]113[.]62[.]52[.]206176[.]65[.]139[.]31194[.]163[.]175[.]135194[.]233[.]100[.]40212[.]83[.]162[.]3723[.]27[.]143[.]17038[.]181[.]52[.]8938[.]60[.]214[.]9247[.]104[.]248[.]765[.]20[.]67[.]13471[.]80[.]85[.]13579[.]135[.]105[.]20883[.]229[.]126[.]19589[.]125[.]244[.]3389[.]125[.]244[.]51

Domains (3)

1a820b09-95ba-44eb-b350-417e8241b725-00-1lgwuuen9b77p[.]worf[.]replit[.]deva820b09-95ba-44eb-b350-417e8241b725-00-1lgwuuen9b77p[.]worf[.]replit[.]devreplit[.]dev

URLs (6)

hxxp://13[.]62[.]52[.]206:5004&nbsphxxp://13[.]62[.]52[.]206:5004”hxxp://83[.]229[.]126[.]195:8081/config[.]jsonhxxp://83[.]229[.]126[.]195:8081/xmrighxxps://1a820b09-95ba-44eb-b350-417e8241b725-00-1lgwuuen9b77p[.]worf[.]replit[.]dev/downloadreplit[.]dev

md5 (1)

fece5b954e69b2c6a8d0a1029631a0d7

sha256 (12)

02654acfb21f83485393ba8b14bd8862b919b9ec966fc6768f6aac1338a45ee80c87871642f84e09e8d3fb23ec36bf55601323e31151a7017a85dbec929cf15d0ed72d52347bfe4a78afff8a6982a64050c8fc86d8957a20eeb3e0f3f5342ed017302d903baf182f94dc3be40ab1e0874dd0eb2ec5255bf9131fd53591efe92518d77c9c5bbb5b9d5bdfd366fdfcf26bad9e64c63ca865fad711bcce8e3d5a805bc5998161056b7c8f70c9724d8a63abc7ff8c3843b91c30cffab0899e39b7f872f570ce97de3eaaffef33d90b0c337a153fc9690cc34ee207b557d8683600607aa88a64a527ade7d93c20faf23b54f2ee33ad9b1246cdc2f8ded2ab639affb196fc528ca5e7d1c2b3add5e31b8797cb126f704976c8fbeaecdbf0aa4309ad46b0f51b098842cd630097b462aab0ec357e2c7824af37cca6d08165265da2c2d3d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfaf6f8e0d790645395188fc521039385b7c4f42fa8b426fd035f489f6cda9b5da1

CVEs (7)

CVE-2025-20333 CVE-2025-20362CVE-2026-20122CVE-2026-20127CVE-2026-20128CVE-2026-20133CVE-2026-20182

Kazuar Shows Russian Espionage Malware Is Engineering for Resilience 5 indicators · May 14, 2026

md5 (1)

82760B84F1D703D596C79B88BA4FAC1E

sha256 (4)

436cfce71290c2fc2f2c362541db68ced6847c66a73b55487e5e5c73b0636c8569908f05b436bd97baae56296bf9b9e734486516f9bb9938c2b8752e152315d46eb31006ca318a21eb619d008226f08e287f753aec9042269203290462eaa00dc1f278f88275e07cc03bd390fe1cbeedd55933110c6fd16de4187f4c4aaf42b9

May 2026 Patch Tuesday: How SMBs Should Prioritize 132 Microsoft CVEs 279 indicators · May 13, 2026

CVEs (279)

CVE-2025-54518CVE-2026-21530CVE-2026-26129CVE-2026-26164CVE-2026-32161CVE-2026-32170CVE-2026-32175CVE-2026-32177CVE-2026-32185CVE-2026-32204CVE-2026-32207CVE-2026-32209CVE-2026-33109CVE-2026-33110CVE-2026-33111CVE-2026-33112CVE-2026-33117CVE-2026-33821CVE-2026-33823CVE-2026-33833CVE-2026-33834CVE-2026-33835CVE-2026-33837CVE-2026-33838CVE-2026-33839CVE-2026-33840CVE-2026-33841CVE-2026-33844CVE-2026-34327CVE-2026-34329CVE-2026-34330CVE-2026-34331CVE-2026-34332CVE-2026-34333CVE-2026-34334CVE-2026-34336CVE-2026-34337CVE-2026-34338CVE-2026-34339CVE-2026-34340CVE-2026-34341CVE-2026-34342CVE-2026-34343CVE-2026-34344CVE-2026-34345CVE-2026-34347CVE-2026-34350CVE-2026-34351CVE-2026-34645CVE-2026-34646CVE-2026-34647CVE-2026-34648CVE-2026-34649CVE-2026-34650CVE-2026-34651CVE-2026-34652CVE-2026-34653CVE-2026-34654CVE-2026-34655CVE-2026-34656CVE-2026-34658CVE-2026-35415CVE-2026-35416CVE-2026-35417CVE-2026-35418CVE-2026-35419CVE-2026-35420CVE-2026-35421CVE-2026-35422CVE-2026-35423CVE-2026-35424CVE-2026-35428CVE-2026-35429CVE-2026-35432CVE-2026-35433CVE-2026-35435CVE-2026-35436CVE-2026-35438CVE-2026-35439CVE-2026-35440CVE-2026-40357CVE-2026-40358CVE-2026-40359CVE-2026-40360CVE-2026-40361CVE-2026-40362CVE-2026-40363CVE-2026-40364CVE-2026-40365CVE-2026-40366CVE-2026-40367CVE-2026-40368CVE-2026-40369CVE-2026-40370CVE-2026-40374CVE-2026-40377CVE-2026-40379CVE-2026-40380CVE-2026-40381CVE-2026-40382CVE-2026-40397CVE-2026-40398CVE-2026-40399CVE-2026-40401CVE-2026-40402CVE-2026-40403CVE-2026-40405CVE-2026-40406CVE-2026-40407CVE-2026-40408CVE-2026-40410CVE-2026-40413CVE-2026-40414CVE-2026-40415CVE-2026-40416CVE-2026-40417CVE-2026-40418CVE-2026-40419CVE-2026-40420CVE-2026-40421CVE-2026-41086CVE-2026-41088CVE-2026-41089CVE-2026-41094CVE-2026-41095CVE-2026-41096CVE-2026-41097CVE-2026-41100CVE-2026-41101CVE-2026-41102CVE-2026-41103CVE-2026-41105CVE-2026-41107CVE-2026-41109CVE-2026-41610CVE-2026-41611CVE-2026-41612CVE-2026-41613CVE-2026-41614CVE-2026-42823CVE-2026-42825CVE-2026-42826CVE-2026-42830CVE-2026-42831CVE-2026-42832CVE-2026-42833CVE-2026-42838CVE-2026-42891CVE-2026-42893CVE-2026-42896CVE-2026-42898CVE-2026-42899CVE-2026-7896CVE-2026-7897CVE-2026-7898CVE-2026-7899CVE-2026-7900CVE-2026-7901CVE-2026-7902CVE-2026-7903CVE-2026-7904CVE-2026-7905CVE-2026-7906CVE-2026-7907CVE-2026-7908CVE-2026-7909CVE-2026-7910CVE-2026-7911CVE-2026-7912CVE-2026-7913CVE-2026-7914CVE-2026-7915CVE-2026-7916CVE-2026-7917CVE-2026-7918CVE-2026-7919CVE-2026-7920CVE-2026-7921CVE-2026-7922CVE-2026-7923CVE-2026-7924CVE-2026-7925CVE-2026-7926CVE-2026-7927CVE-2026-7928CVE-2026-7929CVE-2026-7930CVE-2026-7931CVE-2026-7932CVE-2026-7933CVE-2026-7934CVE-2026-7935CVE-2026-7936CVE-2026-7937CVE-2026-7938CVE-2026-7939CVE-2026-7940CVE-2026-7941CVE-2026-7942CVE-2026-7943CVE-2026-7944CVE-2026-7945CVE-2026-7946CVE-2026-7947CVE-2026-7948CVE-2026-7949CVE-2026-7950CVE-2026-7951CVE-2026-7952CVE-2026-7953CVE-2026-7954CVE-2026-7955CVE-2026-7956CVE-2026-7957CVE-2026-7958CVE-2026-7959CVE-2026-7960CVE-2026-7961CVE-2026-7962CVE-2026-7963CVE-2026-7964CVE-2026-7965CVE-2026-7966CVE-2026-7967CVE-2026-7968CVE-2026-7969CVE-2026-7970CVE-2026-7971CVE-2026-7972CVE-2026-7973CVE-2026-7974CVE-2026-7975CVE-2026-7976CVE-2026-7977CVE-2026-7978CVE-2026-7979CVE-2026-7980CVE-2026-7981CVE-2026-7982CVE-2026-7983CVE-2026-7984CVE-2026-7985CVE-2026-7986CVE-2026-7987CVE-2026-7988CVE-2026-7989CVE-2026-7990CVE-2026-7991CVE-2026-7992CVE-2026-7993CVE-2026-7994CVE-2026-7995CVE-2026-7996CVE-2026-7997CVE-2026-7998CVE-2026-7999CVE-2026-8000CVE-2026-8001CVE-2026-8002CVE-2026-8003CVE-2026-8004CVE-2026-8005CVE-2026-8006CVE-2026-8007CVE-2026-8008CVE-2026-8009CVE-2026-8010CVE-2026-8011CVE-2026-8012CVE-2026-8013CVE-2026-8014CVE-2026-8015CVE-2026-8016CVE-2026-8017CVE-2026-8018CVE-2026-8019CVE-2026-8020CVE-2026-8021CVE-2026-8022

The Gentlemen RaaS Leak Shows Ransomware Is Still an Edge-Device Problem 69 indicators · May 13, 2026

Domains (1)

chamd5[.]org

md5 (30)

03860d116701cdc9d9bf9c45099bb3d311e7baca7e652995b2364fdab0d362b72cd4eb358c45ca783a20ec854a5a860c2e5d1a352885a6efd84dbc0387cbc79e3b7b4f2d33bdfb8a31b480d0eb2815cd4a94d2b730a5a63e6cd54a9b0bb4ea714e0c37cbf4dde9683943c8a738e5b00a51dec3e170f8a181cc9aea8dcc90c7ab583fe1c1a39f6b873a5c0997bea1f657697f182826495662427ca49edbb345fc71d503709af88821c183a1d0b7ae06ec721606b3659f2c2d80a196ed3cd60053735069890a414869f0113de820ba9afb74ea100b581ec32ea6c2ac2a0030a9f6776e86c13433747299a4e5f9f22e34157aae8fd9187c88dd0292cce1abd050e281a578e065da1ccd8c81a8e90c30927582160a7da5fc4c935e6f48d38a5aaaa6893f735e9a8cc9814dc6eccd5579561c8fceea4fd9ce32dd620ccd580297c7c592d8bd2a6ee7f6d5c84e037066ce0539a023a6b15419600dc3f6b93e11761dfea73526d89e5fb7b57f50d8da340e53e9abd11823ddcc3d746ad8621e677a93ebb5b42ac289581b3387ebf120129a19a6b68e019efb39b85f5a0326e22fd4498abc6b87c79bc71a78da623d031ec1a958d75246d230f22b1da6bbf5fceeed2ef2da9cff1b478b64d47b68d50330e96c60ead0d7a8ae0a6ffb7f0a5873fec4ff5e

sha256 (33)

025fc0976c548fb5a880c83ea3eb21a5f23c5d53c4e51e862bb893c11adf712a1334f0189a8e6dbc48456fa4b482c5726ab7609f7fa652fcc4c1a96f2334436f1af419b36a5edefef387409e2b3248c9223f7dc49a4f7b15ea095d371c3a70b21eece1e1ba4b96e6c784729f0608ad2939cfb67bc4236dfababbe1d09268960c22b38dad7da097ea03aa28d0614164cd25fafeb1383dbc15047e34c8050f6f6724ac3588fb8cfbff63b7fdfcbc7dec1f3c60e54e6f949dd69d68e89e0c89d9662ed9494e9b7b68415b4eb151c922c82c0191294d0aa443dd2cb5133e6bfe3d5d3ab9575225e00a83a4ac2b534da5a710bdcf6eb72884944c437b5fbe5c5c92353c2182cb0bc7528829ef03f1b1745a92bcc47d917eb8870862488f21fdf1a6d648d9b2ce4fcd6854a3164ce395d7140014e0b58b77680623f3e4ca22d3a6e7fd4a175eed927c0a477eafb8aa35a93c191748acaa78ac7aecd8ea3c4cd868887c51b9f246d6da85631131fcd1fabf0a67937d4bdde33625a44f7ee6a3a7baebd25dc607c8990841139768884b1b43e1403496d5a458788a1937be139594f01dca62c2c24937d67fdeb43f2c9690ab10e8bb90713af46945048db9a94a465ffcb86a3ab9e984a759d55af4e84487d1fc44683065cc9a1089d5aa4ad1c0e4e84a63788ba200f776a188c248d6c2029f00b5d34be45d4444f7cb89ffe838c39b8b19860a6177b055a2f5aa61470d17ec3c69da24f1cdf0a782237055cba43115892387d25d0e5880b3b5cd30106853cbfc6ef1ad38966b30d9bd5b99df46098e546c8aa0cb69ca2777001e0f4ba0eaab0841592710e4cc5ccd6b0b526d78bbd8bfba8c87134c1b45e990e9568f0a3899b0076f94be16d3c40fa824ac1e6c6ee892db91415e0b9fe4e7cbe43ec0558a7adf89423de30d22b00b985c2e4b97e75076b1994d6d1edb57f945f4284cc0163ec998861c7496d85f6d45c08657c9727186e39f61ff4deb8afced8b1ecdc8787a134c63bde632b18293fbfc94a91749e3e454a7a19cab7aab606f833fa8225bc94ec9570a6666660b02cc41a63fe39ea8b0adb67958afc982cafbe1c3f114b444d7f4c91a88a3e7a86f89ab8795ac2110d1e6c46b5a18ab3fb5fd1c5c8288a41c75bf0170c10b5e829af89370a12c86dd10f8c7f7b5a6e7d93221344e6368c7ab4abf93e162f7567e1a7bcb8786cb8a183a73dce2e5cc00eff2493f8ced546dc51f9d5ef78c5ee56805906ec642dfa77a1c70dfe696ff713318c53fb17731bd4a6585a02c085b590149b19847990b324a0be6ec368ae0b4369b6ef0da244774995c819c63cffb7fd2132379963b9c1640ccd2efaf8e7422ffd09c7f03f1a5b4e5c2cc32b05334c18d1ccb9673667f8f43108ff736be55193c77af346dbe905e25f6a1dee3ec1aedca8989ad2088e4f6576b12fc75ed2159e0c8274076e46a37671cfb8d677af9f586224da1713df89490a958

CVEs (3)

CVE-2024-55591CVE-2025-32433CVE-2025-33073

Bitcoin Addresses (2)

11e7baca7e652995b2364fdab0d362b73b7b4f2d33bdfb8a31b480d0eb2815cd

JDownloader Site Compromise Shows Why Trusted Downloads Still Need Verification 8 indicators · May 9, 2026

Domains (3)

auraguest[.]lkcheckinnhotels[.]comparkspringshotel[.]com

URLs (5)

auraguest[.]lk/m/douV2quu[.]phpcheckinnhotels[.]comhxxps://auraguest[.]lk/m/douV2quu[.]phphxxps://parkspringshotel[.]com/m/Lu6aeloo[.]phpparkspringshotel[.]com/m/Lu6aeloo[.]php

Fake OpenAI Hugging Face Repo Shows AI Supply Chain Risk Is Already Here 2 indicators · May 9, 2026

Domains (1)

recargapopular[.]com

URLs (1)

recargapopular[.]com

MCP Server Command Injection Shows Why AI Tools Need Real Isolation 1 indicators · May 8, 2026

sha1 (1)

2e8ea913573610667ad54e31dba2e8198ebf7cf9

Dirty Frag Turns Linux Footholds Into Root: What Defenders Should Do Now 4 indicators · May 8, 2026

CVEs (4)

CVE-2026-31431 CVE-2026-43284 CVE-2026-43500CVE-2026-46300

Prompt Injection Just Became an RCE Problem for AI Agents 3 indicators · May 8, 2026

Domains (1)

param[.]name

CVEs (2)

CVE-2026-25592CVE-2026-26030

PAN-OS Captive Portal Zero-Day Shows Why Internet-Facing Edge Devices Need Immediate Review 20 indicators · May 7, 2026

IPv4 (5)

136[.]0[.]8[.]48138[.]0[.]0[.]0146[.]70[.]100[.]69149[.]104[.]66[.]8467[.]206[.]213[.]86

URLs (1)

hxxp://146[.]70[.]100[.]69:8000/php_sess

sha256 (1)

e11f69b49b6f2e829454371c31ebf86893f82a042dae3f2faf63dcd84f97a584

CVEs (13)

CVE-2023-33538 CVE-2025-0921 CVE-2025-14847 CVE-2025-23304 CVE-2025-55182 CVE-2025-66478 CVE-2026-0257 CVE-2026-0300 CVE-2026-1281 CVE-2026-1340 CVE-2026-1731 CVE-2026-22584 CVE-2026-31431

Critical Cisco IMC Authentication Bypass Enables Unauthenticated Admin Access 3 indicators · Apr 4, 2026

CVEs (3)

CVE-2026-20093 CVE-2026-20131 CVE-2026-20160

Critical Cisco IMC Authentication Bypass Grants Remote Attackers Admin Privileges 3 indicators · Apr 4, 2026

CVEs (3)

CVE-2026-20093 CVE-2026-20131 CVE-2026-20160

CL-STA-1087: Chinese APT Targets Southeast Asian Militaries with AppleChris and MemFun Backdoors 16 indicators · Apr 3, 2026

IPv4 (9)

109[.]248[.]24[.]177116[.]63[.]177[.]49118[.]194[.]238[.]51154[.]39[.]137[.]203154[.]39[.]142[.]1778[.]212[.]169[.]278[.]220[.]135[.]1518[.]220[.]177[.]2528[.]220[.]184[.]177

sha256 (7)

0e255b4b04f5064ff97da214050da81a823b3d99bce60cdd9ee90d913cc4a9522ee667c0ddd4aa341adf8d85b54fbb2fce8cc14aa88967a5cb99babb08a10fae413daa580db74a38397d09979090b291f916f0bb26a68e7e0b03b4390c1b472f5a6ba08efcef32f5f38df544c319d1983adc35f3db64f77fa5b51b44d0e5052c9e44a460196cc92fa6c6c8a12d74fb73a55955045733719e3966a7b8ced6c500ad25b40315dad0bda5916854e1925c1514f8f8b94e4ee09a43375cc1e77422adee4d4b7340b3fa70387050cd139b43ecc65d0cfd9e3c7dcb94562f5c9c91f58f

UAT-10608: NEXUS Listener Framework Compromises 766 Next.js Hosts in 24-Hour Credential Harvesting Blitz 5 indicators · Apr 3, 2026

IPv4 (4)

144[.]172[.]102[.]88144[.]172[.]112[.]136144[.]172[.]117[.]112172[.]86[.]127[.]128

CVEs (1)

CVE-2025-55182

LiteLLM Supply Chain Attack: TeamPCP Deploys Multi-Stage Credential Stealer to 95M Monthly Downloads 3 indicators · Apr 1, 2026

Domains (2)

litellm[.]cloud models[.]litellm[.]cloud

URLs (1)

models[.]litellm[.]cloud

Operation TrueChaos: Chinese APT Exploits TrueConf Zero-Day CVE-2026-3502 to Target Southeast Asian Governments 10 indicators · Apr 1, 2026

IPv4 (3)

43[.]134[.]52[.]22143[.]134[.]90[.]6047[.]237[.]15[.]197

Domains (1)

trueconf[.]com

URLs (2)

fxp://47[.]237[.]15[.]197/update[.]7zhxxps://trueconf[.]com/docs/server/en/admin/info/

md5 (3)

22e32bcf113326e366ac480b077067cf248a4d7d4c48478dcbeade8f7dba80b39b435ad985b733b64a6d5f39080f4ae0

CVEs (1)

CVE-2026-3502

Axios npm Supply Chain Attack Deploys Cross-Platform RAT to 83 Million Weekly Users 3 indicators · Mar 31, 2026

Domains (2)

packages[.]npm[.]orgsfrclak[.]com

URLs (1)

sfrclak[.]com

DeepLoad Malware: AI-Generated Evasion Meets ClickFix Delivery in Enterprise Credential Theft Campaign 6 indicators · Mar 31, 2026

Domains (3)

forest-entity[.]cchell1-kitty[.]ccholiday-updateservice[.]com

URLs (3)

forest-entity[.]cchell1-kitty[.]ccholiday-updateservice[.]com

ShinyHunters Breaches European Commission: 350GB of Sensitive Data Exfiltrated from AWS Cloud 1 indicators · Mar 30, 2026

Domains (1)

Match[.]com

Infinity Stealer: New macOS Infostealer Combines ClickFix Social Engineering with Nuitka Compilation 2 indicators · Mar 29, 2026

Domains (1)

URLs (1)

Infinity Stealer: New macOS Infostealer Uses ClickFix and Nuitka Compilation to Evade Detection 2 indicators · Mar 29, 2026

Domains (1)

URLs (1)

Infinity Stealer: New macOS Malware Uses ClickFix Lures and Nuitka-Compiled Python Payload 2 indicators · Mar 28, 2026

Domains (1)

URLs (1)

CVE-2026-0826 CVE-2026-52806

Chinese APT Red Menshen Plants Stealthy BPFdoor Backdoors in Global Telecom Networks 2 indicators · Mar 26, 2026

CVEs (2)

Pawn Storm Deploys PRISMEX Malware Suite Against Ukrainian Defense Supply Chain and NATO Allies 15 indicators · Mar 26, 2026

Domains (10)

Filen[.]ioclaude[.]aidropbox[.]comegest[.]filen[.]iogateway[.]filen-1[.]netgateway[.]filen-6[.]netgateway[.]filen[.]iogateway[.]filen[.]netingest[.]filen[.]iowellnesscaremed[.]com

URLs (2)

dropbox[.]comwellnesscaremed[.]com

sha256 (1)

aefd15e3c395edd16ede7685c6e97ca0350a702ee7c8585274b457166e86b1fa

CVEs (2)

CVE-2026-21509 CVE-2026-21513

Oracle Issues Rare Out-of-Band Patch for Critical CVE-2026-21992 RCE in Identity Manager 3 indicators · Mar 25, 2026

IPv4 (2)

12[.]2[.]1[.]414[.]1[.]2[.]1

CVEs (1)

CVE-2026-21992

CanisterWorm Wiper Weaponizes Trivy Supply Chain to Target Iran 23 indicators · Mar 24, 2026

Domains (8)

championships-peoples-point-cassette[.]trycloudflare[.]comdl[.]k8s[.]ioicp0[.]ioinvestigation-launches-hearings-copying[.]trycloudflare[.]comsouls-entire-defined-routes[.]trycloudflare[.]comtdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]iotrycloudflare[.]comwww[.]aikido[.]dev

URLs (15)

hxxps://championships-peoples-point-cassette[.]trycloudflare[.]comhxxps://championships-peoples-point-cassette[.]trycloudflare[.]com/prop[.]pyhxxps://dl[.]k8s[.]io/release/$(curlhxxps://dl[.]k8s[.]io/release/stable[.]txt)/bin/linux/${ARCH}/kubectl&quothxxps://investigation-launches-hearings-copying[.]trycloudflare[.]com/hxxps://souls-entire-defined-routes[.]trycloudflare[.]com/hxxps://souls-entire-defined-routes[.]trycloudflare[.]com/kamikaze[.]shhxxps://souls-entire-defined-routes[.]trycloudflare[.]com/kube[.]py&quothxxps://www[.]aikido[.]dev/blog/teampcp-stage-payload-canisterworm-iranicp0[.]iotdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]iotrycloudflare[.]comtrycloudflare[.]com/trycloudflare[.]com/kube[.]py&quottrycloudflare[.]com/prop[.]py

TeamPCP Deploys CanisterWorm Wiper to Target Iranian Systems 99 indicators · Mar 24, 2026

IPv4 (1)

45[.]148[.]10[.]212

Domains (3)

plug-tab-protective-relay[.]trycloudflare[.]comscan[.]aquasecurtiy[.]orgtdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]io

URLs (3)

aquasecurtiy[.]orghxxps://scan[.]aquasecurtiy[.]orghxxps://tdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]io/

sha1 (82)

0891663bc55073747be0eb864fbec3727840945d0d49ceb356f7d4735c63bd0d5c7e67665ec7f80c18f01febc4c3cd70ce6b94b70e69ab866fc033f519851bef764b57ff95b35e66589f31949eeb229d1d74e4cf63b7cf083cf92bf5923cf037f7011c6b2297a1b967ecc05ba2285eb6af56ab4da554ecae22e864e71155122e2834eb0c10d0e7e0b8f65aa3252554b0e1130467f4301ba65c55a9c373508e35276ca9680f6df9016db12f7c48571e5c4639451d2a51c5c5bb1fd1f0e134c9754f1702cfa359c3dd2b1dac84ff12ba56158b3a97e2941a587cb20da92e7964d59cd24d1fd2aa4d6a5f93b7f09ea969473201ddddd69a1419c6f1511a14c5945ba3217126384add36b52014a0f99c0ab3a3d58bd47e53d00f38623bf26706d51c45647909dcfb669825442804386c0f18ac3d7f2ed33e2d884761119f4024ff8a3c615ac0f29e743eda8863377f9776619fd2db763d1b5be1589a83fc98b82781c263708b2eb3b47b3dffed04dc90cf1c548f40577d642c52241ec76c405e91f329294fb696f55793203abf1f6aba9b404209dcadeaea6a7df69262fef1beeda940881d4d4bdcc5d9ef3ddb42ccc9126e6c07faa3df2807e3506d7ff06abc509692c600b5b69b4dc6ceaa4b15555e7ad4c895c558c7214496df1cd56d1390c51661fbe20b7589e6b61eedcd5fe1e958e1a95fbd1366c90331c8b991e7895d37796ac712b5895dda3b6d8d730153d6151e03549f276faca0275ed9c7b26ec7aaf336b7d2593d980908be9bc4fed6d407c66fc874a1f9d65052d4c67a314da1dae914f1daff7550f14b64c1c724035a075b36e71423719a1f30794b6d99daefd5e27ecb33e12691c4026739bf987a4b6f31edb8db48cc22a1d41e298b38c4a6417e7b955a5ece1e1b085c12dac7ac10e0eb1f5b0d4d7f6f0ce52a59bdfc5757c3982aac2353b58f4c73820428afeb64484d311211658383ce7f79d31a0a848d665ed24dc1a41f6b4b7c7ffac7693d6b37be8519037888b189f13047371758f7aed2283c6b5885cb72f1e8ee5e6e44488cd6cbdbca94722f96ed8aa8af3ea1de8e968a3e49a40afb063692ab8eae8ae5a08aec3013ee8f6132b2a9012b45002f8eaa8afa9b9f9183b4e00c46e2b82d34047e3c177bd08cfb9c31cc944da57458555aa398bb99336d5a1f9092287c0339a8102f91c5a257a7e27625d9d02991d5e0a13afab54533a95f8019dd7530bd38a07191e7c2c36dcad14149d8e455b960af62a2ffb2759738180dd24427b8824445dbbc23c30ffc1cb0d8985447b035c447c1ed45f38fad7ca7a4254cb66899b93c070aac11b52dfc3e41a55cbb24a331ae759ba3c3cd3b23d033cd91253a9e61a4bf59c8a6709c000ba9d482773cbbc2c3544d61b109bc9eb8329e8968cb83234f0de0217aa8c934a68a317ee518a5b4818debf2adbaba872aaffd6a0f64a26449faa9bc513ea7989e3234b395cafb8ed5ccc3755636aa3c46a9643b18125abb8aefc13219014e9c4be8ab6606b76e5a054be08cab3d07da323e90e751e8ad623e14ebdfe82b9627811d57b9a39e283d6128b7252377a3d82c73d497bfafa3eabe84de1d02c4b745a35bad072d93a9b83080e9920ec52c6b5a27b7befdc106c600585d3eec87d7e98e1c136839aeb9faa60f85f6f780a34b8d0faaf45b3e3966fddabb75a9059c2d5803db49e6ed6c6f7e0b367f96bec19401b2f58dc6d2632cb473d44be98dd8292a93c5967f85626795f647d4bf6eb67227f9b79e02f5cf1692a1fc7a47120e6508309765db7e33477946cf19d27c8a7fb7a8bbf1e1000e9318749bcd82cfd488f4388ff4aa268906e25c2144f1433a4edec2da73ae0790e458e878b300b57ceb5f81ac573b46ddb6697447a97198bdef9bae00215059eb5e8bc2ddb94181dcbc723d96ffc07fddd14d97e4849016ddb9da4475c1cef7d5389062bdfdfbdbd1394648e0198fd2b6e1679e36d32933941182d9afa82f6fe53b0483d08da44da9dfe8a84bf2837e5163699bea56cd31d82b853932d50f1144e95b21817e52cfef3a510e3f94df3ea9fcd01621155ca5f2c3bf5bf4436225d8a5fd1715d3c2290d8a50643e726031f4f1785be270ae13f36f6a8cfbf6faaae50e660af5c9fd927027beaa3760d2a84daa8b00e6e5ee21f77738448eec70113cf711656914b61905b3bd47fa4209b6182a4c1609ce34d40b67f5cfd7f00f53fa78e67c0df002c509bcdea88677fb5e2fe6a9b1fd090040b5f584f4fcbe466878cb204d0735dcf4fd429cf86db999572f3d9ca7c54561fdf7d388a4

sha256 (10)

0880819ef821cff918960a39c1c1aada55a5593c61c608ea9215da858a86e3496328a34b26a63423b555a61f89a6a0525a534e9c88584c815d937910f1ddd538822dd269ec10459572dfaaefe163dae693c344249a0161953f0d5cdd110bd2a0887e1f5b5b50162a60bd03b66269e0ae545d0aef0583c1c5b00972152ad7e073bef7e2c5a92c4fa4af17791efc1e46311c0f304796f1172fce192f5efc40f5d7d5edd791021b966fb6af0ace09319ace7b97d6642363ef27b3d5056ca654a94ce6310d8a003d7ac101a6b1cd39ff6c6a88ee454b767c1bdce143e04bc1113243e64e152afe2c722d750f10259626f357cdea40420c5eedae37969fbf13abbecfecce7ae5ffc9f57bb70efd3ea136a2923f701334a8cd47d4fbf01a97fd22859cf7084b0229dce605ccc5506b14acd4d954a496da4b6134a294844ca8d601970d

Hackers Exploit CVE-2025-32975 (CVSS 10.0) to Hijack Unpatched Quest KACE SMA Systems 2 indicators · Mar 23, 2026

IPv4 (1)

216[.]126[.]225[.]156

CVEs (1)

CVE-2025-32975

FBI Flash Alert: Iranian Handala Hackers Weaponize Telegram for Malware C2 Operations 8 indicators · Mar 23, 2026

Domains (4)

handala-hack[.]tohandala-redwanted[.]tojusticehomeland[.]orgkarmabelow80[.]org

URLs (4)

handala-hack[.]tohandala-redwanted[.]tojusticehomeland[.]orgkarmabelow80[.]org

Unit 42 Warns: AI Agents Could Enable Gift Card Theft and Returns Fraud at Scale 2 indicators · Mar 22, 2026

URLs (1)

xyz[.]com

Email Addresses (1)

attacker@xyz[.]com

CVE-2026-33017: Critical Langflow AI Framework Vulnerability Exploited Within 20 Hours of Disclosure 4 indicators · Mar 22, 2026

IPv4 (1)

173[.]212[.]205[.]251

Domains (1)

1[.]9[.]0[.]dev

CVEs (2)

CVE-2025-3248 CVE-2026-33017

Interlock Ransomware Exploited Cisco Firewall Zero-Day Weeks Before Public Disclosure 1 indicators · Mar 21, 2026

CVEs (1)

CVE-2026-20131

DarkSword iOS Exploit Kit: Russian Hackers Weaponize Six Vulnerabilities for Full iPhone Takeover 20 indicators · Mar 21, 2026

IPv4 (2)

62[.]72[.]21[.]1072[.]60[.]98[.]48

Domains (5)

e5[.]malaymoil[.]comsahibndn[.]iosqwas[.]shapelie[.]comstatic[.]cdncounter[.]netsystemgroup[.]com

URLs (6)

cdncounter[.]nethxxps://static[.]cdncounter[.]net/assets/index[.]htmlhxxps://static[.]cdncounter[.]net/widgets[.]js?uhfiu27fajf2948fjfefaa42"></script&gtmalaymoil[.]comsahibndn[.]ioshapelie[.]com

sha256 (1)

2e5a56beb63f21d9347310412ae6efb29fd3db2d3a3fc0798865a29a3c578d35

CVEs (6)

CVE-2025-14174CVE-2025-31277CVE-2025-43510CVE-2025-43520CVE-2025-43529 CVE-2026-20700

CVE-2026-33017: Critical Langflow AI Platform Flaw Exploited Within 20 Hours of Disclosure 4 indicators · Mar 21, 2026

IPv4 (1)

173[.]212[.]205[.]251

Domains (1)

1[.]9[.]0[.]dev

CVEs (2)

CVE-2025-3248 CVE-2026-33017

Critical Langflow AI Platform Flaw CVE-2026-33017 Exploited Within 20 Hours of Disclosure 4 indicators · Mar 20, 2026

IPv4 (1)

173[.]212[.]205[.]251

Domains (1)

1[.]9[.]0[.]dev

CVEs (2)

CVE-2025-3248 CVE-2026-33017

CVE-2026-3564: Critical ScreenConnect Flaw Enables Session Hijacking Through ASP.NET Machine Key Abuse 3 indicators · Mar 20, 2026

CVEs (3)

CVE-2026-15409 CVE-2026-15410CVE-2026-3564

Interlock Ransomware Exploited Cisco FMC Zero-Day for Six Weeks Before Patch: Amazon Reveals Full Attack Chain 1 indicators · Mar 20, 2026

CVEs (1)

CVE-2026-20131

9 Critical IP KVM Flaws Enable Unauthenticated Root Access Across Four Vendors 14 indicators · Mar 19, 2026

CVEs (14)

CVE-2025-3710CVE-2025-3711CVE-2025-3712CVE-2025-3713CVE-2025-3714CVE-2026-32290CVE-2026-32291CVE-2026-32292CVE-2026-32293CVE-2026-32294CVE-2026-32295CVE-2026-32296CVE-2026-32297CVE-2026-32298

CISA Adds Wing FTP Server Information Disclosure Flaw to KEV Catalog Amid Active Exploitation 2 indicators · Mar 18, 2026

CVEs (2)

CVE-2025-47812CVE-2025-47813

GlassWorm Supply Chain Campaign Hijacks 72 Open VSX Extensions to Target Developers 10 indicators · Mar 17, 2026

IPv4 (3)

45[.]32[.]150[.]25145[.]32[.]151[.]15770[.]34[.]242[.]255

Domains (7)

angular-studio[.]ngbrategmaqendaalar-studio[.]prodaeumer-web[.]esoigotm[.]mypessa07tm[.]mypublisher[.]namestudio-velte-distributor[.]pro

Iranian Threat Actors Target Hikvision and Dahua IP Cameras for Kinetic Strike Coordination 5 indicators · Mar 16, 2026

CVEs (5)

CVE-2017-7921CVE-2021-33044CVE-2021-36260CVE-2023-6895CVE-2025-34067

Critical Veeam Backup Vulnerabilities Draw Ransomware Group Attention: Seven CVSS 9.9 Flaws Patched 9 indicators · Mar 16, 2026

Email Addresses (1)

ops@rescana[.]com

CVEs (8)

CVE-2026-21666CVE-2026-21667CVE-2026-21668CVE-2026-21669CVE-2026-21670CVE-2026-21671CVE-2026-21672CVE-2026-21708

The Promptware Kill Chain: A New Framework for Understanding AI Malware Attacks 9 indicators · Mar 15, 2026

Domains (5)

Kore[.]aiVerifiedVoting[.]orgdoi[.]orggo[.]nature[.]comwww[.]schneier[.]com

URLs (2)

hxxps://doi[.]org/10[.]48550/arXiv[.]2509[.]14233hxxps://www[.]schneier[.]com

Email Addresses (1)

schneier@schneier[.]com

CVEs (1)

CVE-2025-15467

Operation Lightning: Global Takedown of SocksEscort Botnet That Enslaved 369,000 Routers in 163 Countries 2 indicators · Mar 15, 2026

Domains (1)

socksescort[.]com

URLs (1)

socksescort[.]com

Google Patches Two Chrome Zero-Days Actively Exploited in the Wild, CISA Adds to KEV Catalog 3 indicators · Mar 14, 2026

CVEs (3)

CVE-2026-2441 CVE-2026-3909 CVE-2026-3910

Pro-Iranian Hackers Expand Targeting of US Critical Infrastructure as Cyber Chaos Escalates 1 indicators · Mar 13, 2026

Domains (1)

ap[.]org

Google Patches Two Actively Exploited Chrome Zero-Days: CVE-2026-3909 and CVE-2026-3910 3 indicators · Mar 13, 2026

CVEs (3)

CVE-2026-2441 CVE-2026-3909 CVE-2026-3910

Storm-2561 Weaponizes SEO Poisoning to Deploy Trojanized VPN Clients and Steal Enterprise Credentials 51 indicators · Mar 13, 2026

IPv4 (1)

194[.]76[.]226[.]93

Domains (20)

checkpoint-vpn[.]comcisco-secure-client[.]esforticlient-for-mac[.]comforticlient-vpn[.]deforticlient-vpn[.]frforticlient-vpn[.]itforticlient[.]caforticlient[.]coforticlient[.]co[.]ukforticlient[.]nofortinet-vpn[.]comivanti-pulsesecure[.]comivanti-secure-access[.]deivanti-vpn[.]orgmyconnection[.]propn-connection[.]prosonicwall-netextender[.]nlsophos-connect[.]orgvpn-fortinet[.]comwatchguard-vpn[.]com

URLs (19)

checkpoint-vpn[.]comcisco-secure-client[.]esco[.]ukforticlient-for-mac[.]comforticlient-vpn[.]deforticlient-vpn[.]frforticlient-vpn[.]itforticlient[.]caforticlient[.]nofortinet-vpn[.]comivanti-pulsesecure[.]comivanti-secure-access[.]deivanti-vpn[.]orgmyconnection[.]propn-connection[.]prosonicwall-netextender[.]nlsophos-connect[.]orgvpn-fortinet[.]comwatchguard-vpn[.]com

sha256 (11)

26db3fd959f12a61d19d102c1a0fb5ee7ae3661fa2b301135cdb68629898917944906752f500b61d436411a121cab8d88edf614e1140a2d01474bd587a8d7ba857a50a1c04254df3db638e75a64d5dd3b0d6a460829192277e252dc0c157a62f6129d717e4e3a6fb4681463e421a5603b640bc6173fb7ba45a41a881c79415ca6c9ab17a4aff2cdf408815ec120718f19f1a31c13fc5889167065d448a40dfe685c4837e3337165d24c6690ca63a3274dfaaa03b2ddaca7f1d18b3b169c6aac1862f004679d3b142d9d2c729e78df716aeeda0c7a87a11324742a5a8eda9b5578ebe082a4b52ad737f7ed33ccc61024c9f020fd085c7985e9c90dc2008a15adc98f21b8fa426fc79aa82e28669faac9a9c7fce9b49d75bbec7b60167e21963c9cfa4781ebfa5a8d68b233efb723dbde434ca70b2f76ff28127ecf13753bfe011eb8b81277c80eeb3c094d0a168533b07366e759a8671af8bfbe12d8bc87650c9

Infostealer Infection Unmasks DPRK Operative Behind Polyfill.io Supply Chain Attack and US Crypto Exchange Infiltration 33 indicators · Mar 12, 2026

IPv4 (1)

192[.]161[.]60[.]132

Domains (22)

Gate[.]ioGate[.]usPolyfill[.]ioapps[.]nulab[.]comcctest[.]kk5yuzmev2qbgulz[.]comcockpit[.]sumsub[.]comdiscord[.]comfeee[.]iofriday[.]stark-industries[.]solutionsgy4q3fpx3gh77gw[.]kk5yuzmev2qbgulz[.]comkk5yuzmev2qbgulz[.]comlrtechs[.]backlog[.]comlrtechs[.]colrtechs[.]co[.]jppolyfill[.]compolyfill[.]iopolyfillcache[.]comstark-industries[.]solutionst2[.]funnull[.]hostvision[.]stark-industries[.]solutionswww[.]hudsonrock[.]comwww[.]mediafire[.]com

URLs (10)

funnull[.]hosthxxps://apps[.]nulab[.]com/signup/verifyhxxps://cockpit[.]sumsub[.]com/checkus#/applicant/66a453df5137ba3da8742f58/basicInfo?clientId=gate[.]us_60664hxxps://discord[.]com/registerhxxps://gy4q3fpx3gh77gw[.]kk5yuzmev2qbgulz[.]com/#/domin/listhxxps://lrtechs[.]backlog[.]com/dashboardhxxps://vision[.]stark-industries[.]solutions/auth/loginhxxps://www[.]hudsonrock[.]com/schedule-demohxxps://www[.]mediafire[.]com/file/gflsp6ovigjnvms/@#Full_Istaller_Pc_Setup_2024_PaSSW%E1%B9%8FrD^$[.]zip/filekk5yuzmev2qbgulz[.]com

KadNap Botnet Hijacks 14,000+ ASUS Routers Using Novel Kademlia DHT Protocol for Stealth C2 1 indicators · Mar 11, 2026

IPv4 (1)

212[.]104[.]141[.]140

FortiGate Devices Exploited as Network Entry Points for Service Account Credential Theft 4 indicators · Mar 11, 2026

IPv4 (1)

172[.]67[.]196[.]232

CVEs (3)

CVE-2025-59718CVE-2025-59719CVE-2026-24858

Iranian MOIS Cyber Actors Embrace Criminal Ecosystem: From Rhadamanthys to Ransomware Affiliates 26 indicators · Mar 10, 2026

IPv4 (1)

18[.]223[.]24[.]218

md5 (1)

eb5e96e05129e5691f9677be4e396c88

sha1 (10)

0902d7915a19975817ec1ccb0f2f6714aed196382087bb914327e937ea6e77fe6c832576338c2af821a435ecaa7b86efbec7f6fb61fcda3da686125c389b12da259a23fa4559eb1d97198120f2a722fe551bdf646df8e9abe04483882650a8ffae43cb55579a4584a6eef0a2453841453221d0fb25c08c899dcb994ea2b8e6169b76a524fae7b2d2dcd1807db674578d4bdb24cd58bf2dc884eaa658b7aa250cd920ae0f8ea8b5bd42de49e01c6bbd4c2c6d0847f8444dfc740b94227ab9b2e757b8f8f1fa49362a

sha256 (14)

077ab28d66abdafad9f5411e18d26e87fe43da1410ee8fe846bd721ab0cb52de24857fe82f454719cd18bcbe19b0cfa5387bee1022008b7f5f3a8be9f05e4d142a09bbb3d1ddb729ea7591f197b5955453aa3769c6fb98a5ef60c6e4b7df23a52b7d8a519f44d3105e9fde2770c75efb933994c658855dca7d48c8b4897f81e64aef998e3b3f6ca21c78ed71732c9d2bdcc8a4e0284f51d7462c79d446fbc7be64263640a6fdeb2388bca2e9094a17065308cf8dcb0032454c0a71d9b78327eb64cf334716f15da1db7981fad6c81a640d94aa1d65391ef879f4b7b6edf6e7f174db1f653da6de134bdc526412a517a30b6856de9c3e5d0c742cb5fe9959ad0d94f05495eb1b2ebe592481e01d3900615040aa02bd1807b705a50e45d7c53444a4bd1371fe644d7e6898045cc8e7b5e1562bdfd0e4871d46034e29a22dec6377a8c380b57cb7c381ca6ba845bd7af7333f52ee4dc4e935e98b48bb81facad72ba92d28f1d32e3a9ab7c3691f8bfca8f7586bb0666adbba47eab3e1a8faf7ecc0aae017e7a36e016655c91bd01b4f3c46309bbe540733f82cce29392e72e9bd1fddceade244c636435f2444cd4c4d3dc161981f3af1f622c03442747ecef50888

BlackSanta EDR Killer Campaign Targets HR Departments Through Weaponized Resume Files 4 indicators · Mar 10, 2026

Domains (2)

resumebuilders[.]usthresumebuilder[.]com

CVEs (2)

Seedworm APT Deploys Dindoor and Fakeset Backdoors Inside US Critical Infrastructure Networks 2 indicators · Mar 10, 2026

CVEs (2)

Seedworm APT Targets US Banks and Airports with New Dindoor and Fakeset Backdoors 2 indicators · Mar 9, 2026

CVEs (2)

lucian_constantin@foundryco[.]com

BoryptGrab Stealer Spreads Through 100+ Fake GitHub Repositories in Massive Malware Campaign 34 indicators · Mar 8, 2026

IPv4 (3)

193[.]143[.]1[.]10445[.]93[.]20[.]19545[.]93[.]20[.]61

Domains (4)

best-tinted[.]combotshield[.]vuclaude[.]aikiamatka[.]com

URLs (11)

best-tinted[.]com/github-download[.]htmlbotshield[.]vu/KKRkm9botshield[.]vu/kFcjldhxxp://193[.]143[.]1[.]104:5000hxxp://45[.]93[.]20[.]195:5000hxxp://45[.]93[.]20[.]61:5466/api/x32_chromiumhxxps://best-tinted[.]com/github-download[.]htmlhxxps://botshield[.]vu/KKRkm9hxxps://botshield[.]vu/kFcjldhxxps://kiamatka[.]com/kaiok[.]kakmankiamatka[.]com/kaiok[.]kakman

sha256 (16)

0434437a073a3f3a49e84d5ecb20c99dd551bacc32bf100fbb8cf67a5064218115de71073f44c657c23f5f97caa11f1b12e654d4d17684bfc628cc1e5b6bcdd51bd605ef84b6767df74bd6290f1468eed5a88264df23fcf70b6a75d5bdcf7d762050468744e44554fac17fb83f1515c95f2f2236716e2b5267a81c2b94205e6a2abe0ef88ba92db79d82cde4c0ed1f382bb347517a54ea82084c841d0f9555184264a88035aa0b63e9aef96daa78a58114d60a344ea10168a8ef5ef36bf8edbd433a13cc70396f80dc29d1150c050339d78964fdc91bcdc3f40c67a77add1476449f528f5ceae8c3f8336d0d8e3e3ec9031d1ad67c31ee7311b67e01d5fdf2254e90d386c1c7d3d1fd4176975795a2f432d95685690778e09313b4a1dbab9997576692df4bf1c7d8927d3a183f5219a81c3bff3dd22971691f8af6889f80c5a07f2315b89fb9a47e1516def136844d617bfcdce19000a1b0436706692dbe166cc40b9913e79c5dd09751b1afb03aaa98658bab61bacf27a299abd84fd44fe707d295720bc0c1111ce1c3d8b1bc1b36ba840f103b3ca7e95a5a8bf03e2cc44fe5ed1745cc49b929e499966d87e163219fe0f24069fe88dfacbd69c0ebab85a640fa767391b99865f8533efc1fe6dfa6175215718679fb00ca85fc13c3bd4ae4b7fe4e5fb28d2c2b3a640112b6b125ce8c4afa8be28342e3bfda097ad9dd2ef9ee

SAP NetWeaver Critical Zero-Day (CVE-2025-31324) Under Active Exploitation by Initial Access Brokers 2 indicators · Mar 7, 2026

Email Addresses (1)

CVEs (1)

CVE-2025-31324

Google Disrupts Chinese APT UNC2814’s GRIDTIDE Backdoor Campaign Targeting 42 Countries 435 indicators · Mar 6, 2026

Domains (208)

URLs (195)

1cv2f3d5s6a9w[.]ddnsfree[.]com Boemobww[.]ddnsfree[.]com DCLCWPDTSDCC[.]ddnsfree[.]com Kaushalya[.]freeddns[.]org Microsoft[.]bumbleshrimp[.]com Mosplosaq[.]accesscam[.]org Npeoples[.]theworkpc[.]com PRIFTP[.]kozow[.]com PolicyAgent[.]theworkpc[.]com Scopps[.]ddnsgeek[.]com Smartfren[.]giize[.]com USOShared1[.]ddnsfree[.]com admina[.]freeddns[.]org afsaces[.]accesscam[.]org ancisesic[.]accesscam[.]org applebox[.]camdvr[.]org appler[.]kozow[.]com asdad21ww[.]freeddns[.]org aw2o25forsbc[.]camdvr[.]org awcc001jdaigfwdagdcew[.]giize[.]com bab2o25com[.]accesscam[.]org babaji[.]accesscam[.]org babi5599ss[.]ddnsgeek[.]com balabalabo[.]mywire[.]org bggs[.]giize[.]com bibabo[.]freeddns[.]org binmol[.]webredirect[.]org bioth[.]giize[.]com brcallletme[.]theworkpc[.]com btbtutil[.]theworkpc[.]com btltan[.]ooguy[.]com camcampkes[.]ddnsfree[.]com camsqewivo[.]kozow[.]com ccammutom[.]ddnsgeek[.]com cdnvmtools[.]theworkpc[.]com cloacpae[.]ddnsfree[.]com cmwwoods1[.]theworkpc[.]com cnrpaslceas[.]freeddns[.]org codemicros12[.]gleeze[.]com cressmiss[.]ooguy[.]com cvabiasbae[.]ddnsfree[.]com cvnoc01da1cjmnftsd[.]accesscam[.]org cvpc01aenusocirem[.]accesscam[.]org cvpc01cgsdfn53hgd[.]giize[.]com dlpossie[.]ddnsfree[.]com dnsfreedb[.]ddnsfree[.]com doboudix1024[.]mywire[.]org evilginx2[.]loseyourip[.]com examp1e[.]webredirect[.]org faeelt[.]giize[.]com fakjcsaeyhs[.]ddnsfree[.]com fasceadvcva3[.]gleeze[.]com ffosies2024[.]camdvr[.]org fgdedd1dww[.]gleeze[.]com filipinet[.]ddnsgeek[.]com freeios[.]theworkpc[.]com fxpuser14[.]gleeze[.]com fxpzpak[.]kozow[.]com globoss[.]kozow[.]com gogo2025up[.]ddnsfree[.]com googlel[.]gleeze[.]com googles[.]accesscam[.]org googles[.]ddnsfree[.]com googlett[.]camdvr[.]org googllabwws[.]gleeze[.]com gtaldps31c[.]ddnsfree[.]com hamkorg[.]kozow[.]com honidoo[.]loseyourip[.]com huygdr12[.]loseyourip[.]comhxxp://130[.]94[.]6[.]228/amp[.]tar[.]gzhxxp://130[.]94[.]6[.]228/apt[.]tar[.]gzhxxp://130[.]94[.]6[.]228/update[.]tar[.]gzicekancusjhea[.]ddnsgeek[.]com idstandsuui[.]kozow[.]com indoodchat[.]theworkpc[.]com jarvis001[.]freeddns[.]org khyes001ndfpnuewdm[.]kozow[.]com kskxoscieontrolanel[.]gleeze[.]com ksv01sokudwongsj[.]theworkpc[.]com lcskiecjj[.]loseyourip[.]com lcskiecs[.]ddnsfree[.]com losiesca[.]ddnsgeek[.]com lps2staging[.]ddnsfree[.]com lsls[.]casacam[.]net ltiuys[.]ddnsgeek[.]com ltiuys[.]kozow[.]com mailsdy[.]gleeze[.]com maliclick1[.]ddnsfree[.]com mauritasszddb[.]ddnsfree[.]com meetls[.]kozow[.]com ml3[.]freeddns[.]org mlksucnayesk[.]kozow[.]com mmmfaco2025[.]mywire[.]org mms[.]bumbleshrimp[.]com mmvmtools[.]giize[.]com modgood[.]gleeze[.]com mysql[.]casacam[.]net nenigncagvawr[.]giize[.]com nenignenigoncqvoo[.]ooguy[.]com nenigoncqnutgo[.]accesscam[.]org nenigoncuopzc[.]giize[.]com nims[.]gleeze[.]com nisaldwoa[.]theworkpc[.]com nmszablogs[.]ddnsfree[.]com nodekeny11[.]freeddns[.]org nodjs2o25nodjs[.]giize[.]com officeshan[.]kozow[.]com okkstt[.]ddnsgeek[.]com oldatain1[.]ddnsgeek[.]com onlyosun[.]ooguy[.]com osix[.]ddnsgeek[.]com ovmmiuy[.]mywire[.]org palamolscueajfvc[.]gleeze[.]com pawanp[.]kozow[.]com pcmainecia[.]ddnsfree[.]com pcvmts3[.]kozow[.]com peisuesacae[.]loseyourip[.]com peowork[.]ddnsgeek[.]com pepesetup[.]ddnsfree[.]com pewsus[.]freeddns[.]org plcoaweniva[.]ddnsgeek[.]com polokinyea[.]gleeze[.]com pplodsssead222[.]loseyourip[.]com pplosad231[.]kozow[.]com ppsaBedon[.]gleeze[.]com prdanjana01[.]ddnsfree[.]com prepaid127[.]freeddns[.]org prihxlcs[.]ddnsfree[.]com prihxlcsw[.]theworkpc[.]com pxlaxvvva[.]freeddns[.]org quitgod2023luck[.]giize[.]com rabbit[.]ooguy[.]com rsm323[.]kozow[.]com saf3asg[.]giize[.]com sdhite43[.]ddnsfree[.]com sdsuytoins63[.]kozow[.]com selfad[.]gleeze[.]com serious[.]kozow[.]com setupcodpr2[.]freeddns[.]org sgsn[.]accesscam[.]org sn0son4t31bbsvopou[.]camdvr[.]org sn0son4t31opc[.]freeddns[.]org soovuy[.]gleeze[.]com styuij[.]mywire[.]org supceasfg1[.]loseyourip[.]com systemsz[.]kozow[.]com t31c0mjumpcuyerop[.]ooguy[.]com t31c0mopamcuiomx[.]kozow[.]com t31c0mopmiuewklg[.]webredirect[.]org t31c0mopocuveop[.]accesscam[.]org t3lc0mcanyqbfac[.]loseyourip[.]com t3lc0mczmoihwc[.]camdvr[.]org t3lc0mh4udncifw[.]casacam[.]net t3lc0mhasvnctsk[.]giize[.]com t3lm0rtlcagratu[.]kozow[.]com tch[.]giize[.]com telcomn[.]giize[.]com telen[.]bumbleshrimp[.]com telkom[.]ooguy[.]com telkomservices[.]theworkpc[.]com thbio[.]kozow[.]com timpe[.]kozow[.]com timpe[.]webredirect[.]org tlse001hdfuwwgdgpnn[.]theworkpc[.]com tltlsktelko[.]ddnsfree[.]com transport[.]dynuddns[.]net trvcl[.]bumbleshrimp[.]com ttsiou12[.]loseyourip[.]com ua2o25yth[.]ddnsgeek[.]com udieyg[.]gleeze[.]com unnjunnani[.]ddnsfree[.]com updatamail[.]kozow[.]com updatasuccess[.]ddnsgeek[.]com updateservices[.]kozow[.]com updatetools[.]giize[.]com uscplxsecjs[.]ddnsgeek[.]com vals[.]bumbleshrimp[.]com vass2025[.]casacam[.]net vass[.]ooguy[.]com vmtools[.]camdvr[.]org vmtools[.]loseyourip[.]com vosies[.]ddnsfree[.]com vpaspmine[.]freeddns[.]org wdlcamaakc[.]ooguy[.]com winfoss1[.]kozow[.]com ysiohbk[.]camdvr[.]org zammffayhd[.]ddnsfree[.]com zmcmvmbm[.]ddnsfree[.]com zwmn350n3o1fsdf3gs[.]kozow[.]com zwmn350n3o1ugety2xbe[.]camdvr[.]org zwmn350n3o1vsdrggs[.]ddnsfree[.]com zwt310n3o1unety2kab[.]webredirect[.]org zwt310n3o2unety6a3k[.]kozow[.]com zwt31n3t0nidoqmve[.]camdvr[.]org zwt3ln3t1aimckalw[.]theworkpc[.]com

sha256 (6)

01fc3bd5a78cd59255a867ffb3dfdd6e0b7713ee90098ea96cc01c640c6495eb 4eb994b816a1a24cf97bfd7551d00fe14b810859170dbf15180d39e05cd7c0f9 669917bad46a57e5f2de037f8ec200a44fb579d723af3e2f1be1e8479a267966 ce36a5fc44cbd7de947130b67be9e732a7b4086fb1df98a5afd724087c973b47 d25024ccea8eac85a9522289cfb709f2ed4e20176dd37855bacc2cd75c995606 eb08c840f4c95e2fa5eff05e5f922f86c766f5368a63476f046b2b9dbffc2033

Google and Mandiant Disrupt GRIDTIDE: Chinese APT Espionage Campaign Compromises 53 Victims in 42 Countries 435 indicators · Mar 5, 2026

Domains (208)

URLs (195)

1cv2f3d5s6a9w[.]ddnsfree[.]com Boemobww[.]ddnsfree[.]com DCLCWPDTSDCC[.]ddnsfree[.]com Kaushalya[.]freeddns[.]org Microsoft[.]bumbleshrimp[.]com Mosplosaq[.]accesscam[.]org Npeoples[.]theworkpc[.]com PRIFTP[.]kozow[.]com PolicyAgent[.]theworkpc[.]com Scopps[.]ddnsgeek[.]com Smartfren[.]giize[.]com USOShared1[.]ddnsfree[.]com admina[.]freeddns[.]org afsaces[.]accesscam[.]org ancisesic[.]accesscam[.]org applebox[.]camdvr[.]org appler[.]kozow[.]com asdad21ww[.]freeddns[.]org aw2o25forsbc[.]camdvr[.]org awcc001jdaigfwdagdcew[.]giize[.]com bab2o25com[.]accesscam[.]org babaji[.]accesscam[.]org babi5599ss[.]ddnsgeek[.]com balabalabo[.]mywire[.]org bggs[.]giize[.]com bibabo[.]freeddns[.]org binmol[.]webredirect[.]org bioth[.]giize[.]com brcallletme[.]theworkpc[.]com btbtutil[.]theworkpc[.]com btltan[.]ooguy[.]com camcampkes[.]ddnsfree[.]com camsqewivo[.]kozow[.]com ccammutom[.]ddnsgeek[.]com cdnvmtools[.]theworkpc[.]com cloacpae[.]ddnsfree[.]com cmwwoods1[.]theworkpc[.]com cnrpaslceas[.]freeddns[.]org codemicros12[.]gleeze[.]com cressmiss[.]ooguy[.]com cvabiasbae[.]ddnsfree[.]com cvnoc01da1cjmnftsd[.]accesscam[.]org cvpc01aenusocirem[.]accesscam[.]org cvpc01cgsdfn53hgd[.]giize[.]com dlpossie[.]ddnsfree[.]com dnsfreedb[.]ddnsfree[.]com doboudix1024[.]mywire[.]org evilginx2[.]loseyourip[.]com examp1e[.]webredirect[.]org faeelt[.]giize[.]com fakjcsaeyhs[.]ddnsfree[.]com fasceadvcva3[.]gleeze[.]com ffosies2024[.]camdvr[.]org fgdedd1dww[.]gleeze[.]com filipinet[.]ddnsgeek[.]com freeios[.]theworkpc[.]com fxpuser14[.]gleeze[.]com fxpzpak[.]kozow[.]com globoss[.]kozow[.]com gogo2025up[.]ddnsfree[.]com googlel[.]gleeze[.]com googles[.]accesscam[.]org googles[.]ddnsfree[.]com googlett[.]camdvr[.]org googllabwws[.]gleeze[.]com gtaldps31c[.]ddnsfree[.]com hamkorg[.]kozow[.]com honidoo[.]loseyourip[.]com huygdr12[.]loseyourip[.]comhxxp://130[.]94[.]6[.]228/amp[.]tar[.]gzhxxp://130[.]94[.]6[.]228/apt[.]tar[.]gzhxxp://130[.]94[.]6[.]228/update[.]tar[.]gzicekancusjhea[.]ddnsgeek[.]com idstandsuui[.]kozow[.]com indoodchat[.]theworkpc[.]com jarvis001[.]freeddns[.]org khyes001ndfpnuewdm[.]kozow[.]com kskxoscieontrolanel[.]gleeze[.]com ksv01sokudwongsj[.]theworkpc[.]com lcskiecjj[.]loseyourip[.]com lcskiecs[.]ddnsfree[.]com losiesca[.]ddnsgeek[.]com lps2staging[.]ddnsfree[.]com lsls[.]casacam[.]net ltiuys[.]ddnsgeek[.]com ltiuys[.]kozow[.]com mailsdy[.]gleeze[.]com maliclick1[.]ddnsfree[.]com mauritasszddb[.]ddnsfree[.]com meetls[.]kozow[.]com ml3[.]freeddns[.]org mlksucnayesk[.]kozow[.]com mmmfaco2025[.]mywire[.]org mms[.]bumbleshrimp[.]com mmvmtools[.]giize[.]com modgood[.]gleeze[.]com mysql[.]casacam[.]net nenigncagvawr[.]giize[.]com nenignenigoncqvoo[.]ooguy[.]com nenigoncqnutgo[.]accesscam[.]org nenigoncuopzc[.]giize[.]com nims[.]gleeze[.]com nisaldwoa[.]theworkpc[.]com nmszablogs[.]ddnsfree[.]com nodekeny11[.]freeddns[.]org nodjs2o25nodjs[.]giize[.]com officeshan[.]kozow[.]com okkstt[.]ddnsgeek[.]com oldatain1[.]ddnsgeek[.]com onlyosun[.]ooguy[.]com osix[.]ddnsgeek[.]com ovmmiuy[.]mywire[.]org palamolscueajfvc[.]gleeze[.]com pawanp[.]kozow[.]com pcmainecia[.]ddnsfree[.]com pcvmts3[.]kozow[.]com peisuesacae[.]loseyourip[.]com peowork[.]ddnsgeek[.]com pepesetup[.]ddnsfree[.]com pewsus[.]freeddns[.]org plcoaweniva[.]ddnsgeek[.]com polokinyea[.]gleeze[.]com pplodsssead222[.]loseyourip[.]com pplosad231[.]kozow[.]com ppsaBedon[.]gleeze[.]com prdanjana01[.]ddnsfree[.]com prepaid127[.]freeddns[.]org prihxlcs[.]ddnsfree[.]com prihxlcsw[.]theworkpc[.]com pxlaxvvva[.]freeddns[.]org quitgod2023luck[.]giize[.]com rabbit[.]ooguy[.]com rsm323[.]kozow[.]com saf3asg[.]giize[.]com sdhite43[.]ddnsfree[.]com sdsuytoins63[.]kozow[.]com selfad[.]gleeze[.]com serious[.]kozow[.]com setupcodpr2[.]freeddns[.]org sgsn[.]accesscam[.]org sn0son4t31bbsvopou[.]camdvr[.]org sn0son4t31opc[.]freeddns[.]org soovuy[.]gleeze[.]com styuij[.]mywire[.]org supceasfg1[.]loseyourip[.]com systemsz[.]kozow[.]com t31c0mjumpcuyerop[.]ooguy[.]com t31c0mopamcuiomx[.]kozow[.]com t31c0mopmiuewklg[.]webredirect[.]org t31c0mopocuveop[.]accesscam[.]org t3lc0mcanyqbfac[.]loseyourip[.]com t3lc0mczmoihwc[.]camdvr[.]org t3lc0mh4udncifw[.]casacam[.]net t3lc0mhasvnctsk[.]giize[.]com t3lm0rtlcagratu[.]kozow[.]com tch[.]giize[.]com telcomn[.]giize[.]com telen[.]bumbleshrimp[.]com telkom[.]ooguy[.]com telkomservices[.]theworkpc[.]com thbio[.]kozow[.]com timpe[.]kozow[.]com timpe[.]webredirect[.]org tlse001hdfuwwgdgpnn[.]theworkpc[.]com tltlsktelko[.]ddnsfree[.]com transport[.]dynuddns[.]net trvcl[.]bumbleshrimp[.]com ttsiou12[.]loseyourip[.]com ua2o25yth[.]ddnsgeek[.]com udieyg[.]gleeze[.]com unnjunnani[.]ddnsfree[.]com updatamail[.]kozow[.]com updatasuccess[.]ddnsgeek[.]com updateservices[.]kozow[.]com updatetools[.]giize[.]com uscplxsecjs[.]ddnsgeek[.]com vals[.]bumbleshrimp[.]com vass2025[.]casacam[.]net vass[.]ooguy[.]com vmtools[.]camdvr[.]org vmtools[.]loseyourip[.]com vosies[.]ddnsfree[.]com vpaspmine[.]freeddns[.]org wdlcamaakc[.]ooguy[.]com winfoss1[.]kozow[.]com ysiohbk[.]camdvr[.]org zammffayhd[.]ddnsfree[.]com zmcmvmbm[.]ddnsfree[.]com zwmn350n3o1fsdf3gs[.]kozow[.]com zwmn350n3o1ugety2xbe[.]camdvr[.]org zwmn350n3o1vsdrggs[.]ddnsfree[.]com zwt310n3o1unety2kab[.]webredirect[.]org zwt310n3o2unety6a3k[.]kozow[.]com zwt31n3t0nidoqmve[.]camdvr[.]org zwt3ln3t1aimckalw[.]theworkpc[.]com

sha256 (6)

01fc3bd5a78cd59255a867ffb3dfdd6e0b7713ee90098ea96cc01c640c6495eb 4eb994b816a1a24cf97bfd7551d00fe14b810859170dbf15180d39e05cd7c0f9 669917bad46a57e5f2de037f8ec200a44fb579d723af3e2f1be1e8479a267966 ce36a5fc44cbd7de947130b67be9e732a7b4086fb1df98a5afd724087c973b47 d25024ccea8eac85a9522289cfb709f2ed4e20176dd37855bacc2cd75c995606 eb08c840f4c95e2fa5eff05e5f922f86c766f5368a63476f046b2b9dbffc2033

Coruna iOS Exploit Kit: Nation-State Spyware Tools Now Targeting Crypto Wallet Users 1 indicators · Mar 5, 2026

CVEs (1)

CVE-2024-23222

UAT-9244: China-Nexus APT Deploys Three New Malware Implants Against South American Telecom Providers 75 indicators · Mar 5, 2026

IPv4 (24)

149[.]28[.]25[.]33154[.]205[.]154[.]194154[.]205[.]154[.]65154[.]205[.]154[.]70154[.]205[.]154[.]82154[.]223[.]21[.]130154[.]223[.]21[.]194158[.]247[.]238[.]240185[.]196[.]10[.]247185[.]196[.]10[.]38207[.]148[.]120[.]52207[.]148[.]121[.]95212[.]11[.]64[.]105216[.]238[.]112[.]222216[.]238[.]123[.]242216[.]238[.]94[.]3738[.]54[.]125[.]13438[.]60[.]199[.]3445[.]32[.]106[.]9445[.]77[.]34[.]19445[.]77[.]41[.]14147[.]76[.]100[.]15964[.]190[.]113[.]17064[.]95[.]10[.]253

Domains (3)

bloopencil[.]netxcit76[.]comxtibh[.]com

URLs (3)

bloopencil[.]netxcit76[.]comxtibh[.]com

sha1 (1)

2b170a6d90fceba72aba3c7bc5c40b9725f43788

sha256 (44)

00735a8a50d2856c11150ef1e29c05acebce7ad3edad00e37c7f043aacb46330023467e236a95d5f0e62e26445d430d749c59312f66cf136e6e2c2d526c46ba103eac9eb7f4b4bc494ef0496ee23cabbf38f883896838ed813741d8f64ac9fde06b23d84fd7afd525dfd7860ebd561dcdd72ccbeb51981d5d9a75acf068d0a2a075b20a21ea6a0d2201a12a049f332ecc61348fc0ad3cfee038c6ad6aa44e7440c7e36683a100a96f695a952cf07052af9a47f5898e1078311fd58c5fdbdecc815d937803f90c2b9e277ff94d3e98ff30015ecc7f4623a158e3c98861e5cb27817652d7bb5fe0454023db4fc7f608df0dbe6af237be31258e16ba52f0e895e261cedf01dd4b7e50181d0e781825c66957b862941395d77c8bd7705114f319c801f5635a512a923e98a90cdc1b2fb988a2da78706e07e419dae9e1a54dd4d682b1fcdd5a417db31e5e07d32cecfa69e53f0dce95b7130ad9c03b92249f001801d2c3f2261b00ea45e25eb4e9de2b7ff8e41f311c0b3d986461f834022c08b3b992d2ca7d21310b14f5f5641bbf4a9ff4c3e566b1fbbd370034c6844cedc8f053834d64b3cd9430e85edefcb883973a086dd5de9917e05fabec89b1f4ab9627e9138eeaa4eaad72feb3f8e6993565fcc548d8e7bb93642590f00fa24aacc0e28623c098a687947938e36ab34b9f09a11ebd82d50089cbfe6e237d810faa729f8ff3d9fbfc2c056eac857ba54e5ed134aa45a4b8322ee9f9353ba32e5b2ca71b0e33fcadde4b414a18b2fed56c1ec59d97977123615fbbf411a1c78425445a6e71c3fcced9332301ff70b20c98c9434c858400013d659afa6bb5149cffb0206357d56bead2933e91366e4a0d5761daf5b238a7f2c22e597664ef67b3ecae20ab32666adeedfb739774fcc09aa7426c8fad29f8047ab4caee8040d07c0e84d01161166bdce93de3b02cf9cdadad18ca1504ac83e379a752d51f60deae6dcbafe4e3166ce42258062e902bd7f9e90ad5453a901cfc424f0ea497c4d14f063f3acd3296a2d23cc8746a83e9a3b974788fce0e414706b8e75ff390426dd7e10b19967b36ec070457d1f6f239cb02c5e1576a3660cca98f3a07eec6e4e107f698d7fe555711d9427ee43bc2186b9124f31cba2db5f54ec9a0d56dc2948e1a4377bada28974d1a678bdc4bb9f33321e94e3bd1bc1740472ed734231fc46af720072ecb77e74fbc8360d4c95d64d7acaa4d18943dce2d41f91d080b0b5e435d8bce52861a57b70cd956f082b1029d02b4cb7608893f2de7fa9c500d7d7febdd0f745ac3cb6870e791af14caaf395c56028176a9c3f4c1ff0318ef3112d57ecd3d4a1be2ef99a7225c17e4bad3ffe7f080530d36f4f8aca5c116b913caa91ab9b0cee85638eA5e413456ce9fc60bb44d442b72546e9e4118a61894fbe4b5c56e4dfad6055e3a313f76fca50fff1bcd6f2c6cbc1268985f8c0a3a05fe7f43c4fc0ac3aff84dcbabc81fc9c998e9dc4ab545f0e112e34d2641e1333bc81aaa131abd061a5b604bfc35f12d00fa4b40c5fbce9e37d704e12a52262709bcbdf09f97890bc40cad5c9a42423ef08bd7f183915780d39530eba5e4e25968c51965ff8bb3026965a28c9fc2af30f769d856b88b3051f19fdb663b3e0a0916279df9bbcba93c6a110c9d5eb979cb8a72706bfa591fa57d4ebf7d13cecdc9377b0192375e2f570f796dfd78b3c6df8f3756a7e310cf7435fdba201dd03ec9f97420a0db683489a01a7c9e34c9159e6e78c59518a14c5b96bddfee094b684f99d4f69b13371284a014e87ebcb2691b7c92cdf2b2ff5e2d753abeea8cb325c16596cd839e6bd147f80e38af36913607356a32ea106103387105c635fa923f8ed98ad0194b66ec79e379a02f3e899789b56429f483e5096e1f473335024f1f763e2d428132338e30352b89ef8066833e47814793d8c58743622b051070dac09cb010c323970c81b59260f84

Cisco Patches Two Max Severity Secure FMC Flaws Enabling Root Access 2 indicators · Mar 4, 2026

CVEs (2)

CVE-2026-20079CVE-2026-20131

Open-Source CyberStrikeAI Tool Weaponized in AI-Driven FortiGate Attacks Across 55 Countries 1 indicators · Mar 4, 2026

IPv4 (1)

212[.]11[.]64[.]250

Zerobot Malware Targets n8n Automation Platform: First Active Exploitation of CVE-2025-68613 18 indicators · Mar 3, 2026

IPv4 (5)

103[.]59[.]160[.]237140[.]233[.]190[.]96144[.]172[.]100[.]228172[.]86[.]123[.]179216[.]126[.]227[.]101

Domains (3)

0bot[.]qzz[.]ioandro[.]notemacro[.]compivot[.]notemacro[.]com

URLs (2)

notemacro[.]comqzz[.]io

sha256 (6)

045a1e42cb64e4aa91601f65a80ec5bd040ea4024c6d3b051cb1a6aa15d03b57360467c3b733513c922b90d0e222067509df6481636926fa1786d0273169f4dac8e8b627398ece071a3a148d6f38e46763dc534f9bfd967ebc8ac3479540111fcc1efbca0da739b7784d833e56a22063ec4719cd095b16e3e10f77efd4277e24d024039824db6fe535ddd51bc81099c946871e4e280c48ed6e90dada79ccfcc7deb70af83a9b3bb8f9424b709c3f6342d0c63aa10e7f8df43dd7a457bda8f060

CVEs (2)

CVE-2025-68613CVE-2025-7544

Silver Dragon APT Targets Southeast Asia and Europe Using GearDoor Backdoor with Google Drive C2 63 indicators · Mar 3, 2026

IPv4 (1)

104[.]21[.]51[.]8

Domains (17)

ampolice[.]orgbigflx[.]netcopilot-cloud[.]netdrivefrontend[.]padrivefrontend[.]pa-clients[.]workers[.]devexchange4study[.]commindssurpass[.]comns1[.]exchange4study[.]comns1[.]onedriveconsole[.]comns2[.]onedriveconsole[.]comoicm[.]orgonedriveconsole[.]comprotacik[.]comrevitpourtous[.]comsplunkds[.]comwikipedla[.]blogzhydromet[.]com

URLs (13)

ampolice[.]orgbigflx[.]netcopilot-cloud[.]netexchange4study[.]commindssurpass[.]comoicm[.]orgonedriveconsole[.]comprotacik[.]comrevitpourtous[.]comsplunkds[.]comwikipedla[.]blogworkers[.]devzhydromet[.]com

md5 (1)

9d3f61dcaba90db2ede1c1906a80ace2

sha256 (31)

166e777cb72a7c4e126f8ed97e0a82e7ca9e87df7793fea811daf34e1e7e47a616b9a7358be88632378ba20ba1430786f3b844694b1f876211ecdbecf5cccbc219139a525ee9c22efd6a4842c4cd50ab2c5f9ee391e5531071df0bb4e685f55d2f787c1454891b242ab221b8b8b420373c3eb1a0c1fdcb624dd800c50758bbb03128bdb8efaaa04c0ba96337252f4cc2dc795021cbc410f74ace9dde958bac1d37b485ed8d150d022c41e5e307b8c54c34ef806625b44d0c940b18be7d5b29ce3a2df7a2cfeca5ba315a29cf313268a53a22316c925e6b9760ead8f4df0d1f753e2a0bafbd44e24b17fd7b17c9f2b2a3727349971d42612d55bbc1732082619a43f8f94ca5aa0af7bfb0cc1d2f664a46500a161b2d082b48b516d084ef48534844e769efed3e4f9f04c52dcd13f15cead251a1a08827a2cb6ea68427522c7fbb4f93be0c46a53701b1777ab8df874c837df3d8256e026f138d60fc2932e569a851684a0e356513486489986f5832c948107ff687c8501d64846cdc43074294135341c7256542405abdd01ee288b08e49dcb6d1782be6b7bea63b459d80f9a8f5568c67564d62b09d1a1bc29a494cf4bf31afddcafcf78592b178c63f23ccfcae5ad857df8976523cb3ad2fdf30e87c0e7daa64135716b139ffdcd209b98e165472e4b6540e32b8b7aac850055609bc5afc19e29834e9aa6be29a8ea59a2c97857384462d420bdc9683a4cac2a8ad19353a2aa7d2244c91e9182345777e811e33740a09fcdefa5a5f79355b720f54ff09efa64062229fb388adbccd9c829e9ff074a11a07d167f8f5c0baa724d1f7708985c81d0ac3d0e4d7ef3f3220c335e0097f89a4d5af47bc00a9ad58f0bcbe8a7be2662953dcd03f0e881cc5cbf6b7bca885a03d2e74ae84093a74699057693d11e5c61f85b62e741778cbc5fc9f89022f8c29f9189a9ad75a959024f59e68c62d42a6fd42f9eacf847128c7efe4ef7578948468aba5c851952ebe56a5bf37904ed83a6c8cb520304db6938d79892f0a1b967b5c611d304385807ea2d865fa561c15cde0473dd63e768679a4f29f0e4563a6b5448ba45f3f352f5f4c5376024891adda1ef8ebf62a8fe63424fa230c691db93560c4d18120e113fb8b04a8aa05f66a12116d1fbf18a93186f6314381e97ebcbe2f0a8134c0e7fce18d0394ababc1d910e6f7b77b8c07643434cd14f4c5d6bd699ed720e2bd7085b3444cb8f4d36870b5b48df1055ec6cc1553db3eef7fafc4de1f1a8cb3b0392802ee56096ddb25b6f51c51350ce7c45e14d8c285765300ddaca57f3d5f4986da052ca172631b351410d6f5831f6af351699c6201cc011be3b016f2fc865d0f53f635f740eb0203626517425ed9a2908058f96a3bcf470d

APT28 Exploited CVE-2026-21513 MSHTML Zero-Day as Attack Vector Before February Patch Tuesday 4 indicators · Mar 3, 2026

Domains (1)

wellnesscaremed[.]com

URLs (1)

wellnesscaremed[.]com

CVEs (2)

CVE-2026-21509 CVE-2026-21513

Malicious Go Crypto Module Steals Passwords and Deploys Rekoobe Backdoor 2 indicators · Mar 2, 2026

IPv4 (1)

154[.]84[.]63[.]184

Domains (1)

go[.]googlesource[.]com

Fake Google Security Check Transforms Browser Into Surveillance Toolkit via PWA Installation 3 indicators · Mar 2, 2026

Domains (1)

google-prism[.]com

URLs (1)

google-prism[.]com

sha256 (1)

1fe2be4582c4cbce8013c3506bc8b46f850c23937a564d17e5e170d6f60d8c08

Google Disrupts UNC2814 GRIDTIDE Campaign: Chinese APT Breaches 53 Organizations Across 42 Countries 435 indicators · Feb 28, 2026

Domains (208)

URLs (195)

1cv2f3d5s6a9w[.]ddnsfree[.]com Boemobww[.]ddnsfree[.]com DCLCWPDTSDCC[.]ddnsfree[.]com Kaushalya[.]freeddns[.]org Microsoft[.]bumbleshrimp[.]com Mosplosaq[.]accesscam[.]org Npeoples[.]theworkpc[.]com PRIFTP[.]kozow[.]com PolicyAgent[.]theworkpc[.]com Scopps[.]ddnsgeek[.]com Smartfren[.]giize[.]com USOShared1[.]ddnsfree[.]com admina[.]freeddns[.]org afsaces[.]accesscam[.]org ancisesic[.]accesscam[.]org applebox[.]camdvr[.]org appler[.]kozow[.]com asdad21ww[.]freeddns[.]org aw2o25forsbc[.]camdvr[.]org awcc001jdaigfwdagdcew[.]giize[.]com bab2o25com[.]accesscam[.]org babaji[.]accesscam[.]org babi5599ss[.]ddnsgeek[.]com balabalabo[.]mywire[.]org bggs[.]giize[.]com bibabo[.]freeddns[.]org binmol[.]webredirect[.]org bioth[.]giize[.]com brcallletme[.]theworkpc[.]com btbtutil[.]theworkpc[.]com btltan[.]ooguy[.]com camcampkes[.]ddnsfree[.]com camsqewivo[.]kozow[.]com ccammutom[.]ddnsgeek[.]com cdnvmtools[.]theworkpc[.]com cloacpae[.]ddnsfree[.]com cmwwoods1[.]theworkpc[.]com cnrpaslceas[.]freeddns[.]org codemicros12[.]gleeze[.]com cressmiss[.]ooguy[.]com cvabiasbae[.]ddnsfree[.]com cvnoc01da1cjmnftsd[.]accesscam[.]org cvpc01aenusocirem[.]accesscam[.]org cvpc01cgsdfn53hgd[.]giize[.]com dlpossie[.]ddnsfree[.]com dnsfreedb[.]ddnsfree[.]com doboudix1024[.]mywire[.]org evilginx2[.]loseyourip[.]com examp1e[.]webredirect[.]org faeelt[.]giize[.]com fakjcsaeyhs[.]ddnsfree[.]com fasceadvcva3[.]gleeze[.]com ffosies2024[.]camdvr[.]org fgdedd1dww[.]gleeze[.]com filipinet[.]ddnsgeek[.]com freeios[.]theworkpc[.]com fxpuser14[.]gleeze[.]com fxpzpak[.]kozow[.]com globoss[.]kozow[.]com gogo2025up[.]ddnsfree[.]com googlel[.]gleeze[.]com googles[.]accesscam[.]org googles[.]ddnsfree[.]com googlett[.]camdvr[.]org googllabwws[.]gleeze[.]com gtaldps31c[.]ddnsfree[.]com hamkorg[.]kozow[.]com honidoo[.]loseyourip[.]com huygdr12[.]loseyourip[.]comhxxp://130[.]94[.]6[.]228/amp[.]tar[.]gzhxxp://130[.]94[.]6[.]228/apt[.]tar[.]gzhxxp://130[.]94[.]6[.]228/update[.]tar[.]gzicekancusjhea[.]ddnsgeek[.]com idstandsuui[.]kozow[.]com indoodchat[.]theworkpc[.]com jarvis001[.]freeddns[.]org khyes001ndfpnuewdm[.]kozow[.]com kskxoscieontrolanel[.]gleeze[.]com ksv01sokudwongsj[.]theworkpc[.]com lcskiecjj[.]loseyourip[.]com lcskiecs[.]ddnsfree[.]com losiesca[.]ddnsgeek[.]com lps2staging[.]ddnsfree[.]com lsls[.]casacam[.]net ltiuys[.]ddnsgeek[.]com ltiuys[.]kozow[.]com mailsdy[.]gleeze[.]com maliclick1[.]ddnsfree[.]com mauritasszddb[.]ddnsfree[.]com meetls[.]kozow[.]com ml3[.]freeddns[.]org mlksucnayesk[.]kozow[.]com mmmfaco2025[.]mywire[.]org mms[.]bumbleshrimp[.]com mmvmtools[.]giize[.]com modgood[.]gleeze[.]com mysql[.]casacam[.]net nenigncagvawr[.]giize[.]com nenignenigoncqvoo[.]ooguy[.]com nenigoncqnutgo[.]accesscam[.]org nenigoncuopzc[.]giize[.]com nims[.]gleeze[.]com nisaldwoa[.]theworkpc[.]com nmszablogs[.]ddnsfree[.]com nodekeny11[.]freeddns[.]org nodjs2o25nodjs[.]giize[.]com officeshan[.]kozow[.]com okkstt[.]ddnsgeek[.]com oldatain1[.]ddnsgeek[.]com onlyosun[.]ooguy[.]com osix[.]ddnsgeek[.]com ovmmiuy[.]mywire[.]org palamolscueajfvc[.]gleeze[.]com pawanp[.]kozow[.]com pcmainecia[.]ddnsfree[.]com pcvmts3[.]kozow[.]com peisuesacae[.]loseyourip[.]com peowork[.]ddnsgeek[.]com pepesetup[.]ddnsfree[.]com pewsus[.]freeddns[.]org plcoaweniva[.]ddnsgeek[.]com polokinyea[.]gleeze[.]com pplodsssead222[.]loseyourip[.]com pplosad231[.]kozow[.]com ppsaBedon[.]gleeze[.]com prdanjana01[.]ddnsfree[.]com prepaid127[.]freeddns[.]org prihxlcs[.]ddnsfree[.]com prihxlcsw[.]theworkpc[.]com pxlaxvvva[.]freeddns[.]org quitgod2023luck[.]giize[.]com rabbit[.]ooguy[.]com rsm323[.]kozow[.]com saf3asg[.]giize[.]com sdhite43[.]ddnsfree[.]com sdsuytoins63[.]kozow[.]com selfad[.]gleeze[.]com serious[.]kozow[.]com setupcodpr2[.]freeddns[.]org sgsn[.]accesscam[.]org sn0son4t31bbsvopou[.]camdvr[.]org sn0son4t31opc[.]freeddns[.]org soovuy[.]gleeze[.]com styuij[.]mywire[.]org supceasfg1[.]loseyourip[.]com systemsz[.]kozow[.]com t31c0mjumpcuyerop[.]ooguy[.]com t31c0mopamcuiomx[.]kozow[.]com t31c0mopmiuewklg[.]webredirect[.]org t31c0mopocuveop[.]accesscam[.]org t3lc0mcanyqbfac[.]loseyourip[.]com t3lc0mczmoihwc[.]camdvr[.]org t3lc0mh4udncifw[.]casacam[.]net t3lc0mhasvnctsk[.]giize[.]com t3lm0rtlcagratu[.]kozow[.]com tch[.]giize[.]com telcomn[.]giize[.]com telen[.]bumbleshrimp[.]com telkom[.]ooguy[.]com telkomservices[.]theworkpc[.]com thbio[.]kozow[.]com timpe[.]kozow[.]com timpe[.]webredirect[.]org tlse001hdfuwwgdgpnn[.]theworkpc[.]com tltlsktelko[.]ddnsfree[.]com transport[.]dynuddns[.]net trvcl[.]bumbleshrimp[.]com ttsiou12[.]loseyourip[.]com ua2o25yth[.]ddnsgeek[.]com udieyg[.]gleeze[.]com unnjunnani[.]ddnsfree[.]com updatamail[.]kozow[.]com updatasuccess[.]ddnsgeek[.]com updateservices[.]kozow[.]com updatetools[.]giize[.]com uscplxsecjs[.]ddnsgeek[.]com vals[.]bumbleshrimp[.]com vass2025[.]casacam[.]net vass[.]ooguy[.]com vmtools[.]camdvr[.]org vmtools[.]loseyourip[.]com vosies[.]ddnsfree[.]com vpaspmine[.]freeddns[.]org wdlcamaakc[.]ooguy[.]com winfoss1[.]kozow[.]com ysiohbk[.]camdvr[.]org zammffayhd[.]ddnsfree[.]com zmcmvmbm[.]ddnsfree[.]com zwmn350n3o1fsdf3gs[.]kozow[.]com zwmn350n3o1ugety2xbe[.]camdvr[.]org zwmn350n3o1vsdrggs[.]ddnsfree[.]com zwt310n3o1unety2kab[.]webredirect[.]org zwt310n3o2unety6a3k[.]kozow[.]com zwt31n3t0nidoqmve[.]camdvr[.]org zwt3ln3t1aimckalw[.]theworkpc[.]com

sha256 (6)

01fc3bd5a78cd59255a867ffb3dfdd6e0b7713ee90098ea96cc01c640c6495eb 4eb994b816a1a24cf97bfd7551d00fe14b810859170dbf15180d39e05cd7c0f9 669917bad46a57e5f2de037f8ec200a44fb579d723af3e2f1be1e8479a267966 ce36a5fc44cbd7de947130b67be9e732a7b4086fb1df98a5afd724087c973b47 d25024ccea8eac85a9522289cfb709f2ed4e20176dd37855bacc2cd75c995606 eb08c840f4c95e2fa5eff05e5f922f86c766f5368a63476f046b2b9dbffc2033

APT37 Ruby Jumper Campaign: North Korean Hackers Deploy Malware Arsenal to Bridge Air-Gapped Networks 23 indicators · Feb 27, 2026

IPv4 (1)

144[.]172[.]106[.]66

Domains (6)

hightkdhe[.]store homeatedke[.]store philion[.]store www[.]hightkdhe[.]store www[.]homeatedke[.]store www[.]philion[.]store

URLs (7)

hightkdhe[.]storehightkdhe[.]store/star/main[.]phphomeatedke[.]store/star/main[.]phphxxps://www[.]hightkdhe[.]store/star/main[.]phphxxps://www[.]homeatedke[.]store/star/main[.]phphxxps://www[.]philion[.]store/star/main[.]phpphilion[.]store/star/main[.]php

md5 (9)

098d697f29b94c11b52c51bfe8f9c47d 4214818d7cde26ebeb4f35bc2fc29ada 476bce9b9a387c5f39461d781e7e22b9 57dac5f7d21da2454d0fbefdced80bf3 585322a931a49f4e1d78fb0b3f3c6212 5c6ff601ccc75e76c2fc99808d8cc9a9 709d70239f1e9441e8e21fcacfdc5d08 ad556f4eb48e7dba6da14444dcce3170 ed54cf1ebffbfc1c8ae1ccdd2c681012

UAC-0050 Targets European Financial Institution in Strategic Phishing Campaign 1 indicators · Feb 27, 2026

Domains (1)

ThemesDNA[.]com

Chinese APT Campaign Delivers PlugX RAT via G DATA Antivirus DLL Side-Loading 20 indicators · Feb 26, 2026

Domains (5)

decoorat[.]netdecoraat[.]netgesecole[.]netonedow[.]gesecole[.]netonedown[.]gesecole[.]net

URLs (7)

decoorat[.]netdecoraat[.]nethxxps://decoraat[.]net:443hxxps://onedow[.]gesecole[.]net/downloadhxxps://onedown[.]gesecole[.]net/downloadonedow[.]gesecole[.]net/downloadonedown[.]gesecole[.]net/download

sha256 (8)

29cd44aa2a51a200d82cca578d97dc13241bc906ea6a33b132c6ca567dc8f3ad46314092c8d00ab93cbbdc824b9fc39dec9303169163b9625bae3b1717d70ebc5f9af68db10b029453264cfc9b8eee4265549a2855bb79668ccfc571fb11f5fc6df8649bf4e233ee86a896ee8e5a3b3179c168ef927ac9283b945186f8629ee78421e7995778faf1f2a902fb2c51d85ae39481f443b7b3186068d5c33c472d99d293ded5a63679b81556d2c622c78be6253f500b6751d4eeb271e6500a23b21ede8ddc2451fb1305d76ab20661725d11c77625aeeaa1447faf3fbf56706c87f1e7ed0cd4115f3ff35c38d36cc50c6a13eba2d845554439a36108789cd1e05b17

APT37 Deploys Ruby Jumper Campaign to Breach Air-Gapped Networks 23 indicators · Feb 26, 2026

IPv4 (1)

144[.]172[.]106[.]66

Domains (6)

hightkdhe[.]store homeatedke[.]store philion[.]store www[.]hightkdhe[.]store www[.]homeatedke[.]store www[.]philion[.]store

URLs (7)

hightkdhe[.]storehightkdhe[.]store/star/main[.]phphomeatedke[.]store/star/main[.]phphxxps://www[.]hightkdhe[.]store/star/main[.]phphxxps://www[.]homeatedke[.]store/star/main[.]phphxxps://www[.]philion[.]store/star/main[.]phpphilion[.]store/star/main[.]php

md5 (9)

098d697f29b94c11b52c51bfe8f9c47d 4214818d7cde26ebeb4f35bc2fc29ada 476bce9b9a387c5f39461d781e7e22b9 57dac5f7d21da2454d0fbefdced80bf3 585322a931a49f4e1d78fb0b3f3c6212 5c6ff601ccc75e76c2fc99808d8cc9a9 709d70239f1e9441e8e21fcacfdc5d08 ad556f4eb48e7dba6da14444dcce3170 ed54cf1ebffbfc1c8ae1ccdd2c681012

Diesel Vortex: Russian Cybercrime Group Steals 1,600+ Credentials From Global Logistics Sector 27 indicators · Feb 25, 2026

Domains (16)

USCARGOEXPRESSyahoo[.]comernigr-esfilc[.]comglobalprofit-lpanel-abcdefghij[.]topipinfo[.]iolpanel-bckaoplsks[.]toplpanel-bumaepxuje-iframe[.]toplpanel-bumaepxuje[.]toplpanel-kkbnukltpo[.]topns1[.]suspended-domain[.]compenskecar[.]riersrmissecured[.]compenskecar[.]rsrmissecured[.]topriersrmissecured[.]comrsrmissecured[.]topsuspended-domain[.]comt[.]meyasomawork[.]space

URLs (11)

ernigr-esfilc[.]com/security/logon[globalprofit-lpanel-abcdefghij[.]tophxxps://ernigr-esfilc[.]com/security/logon[.]jsp?verify=7g2q978fg11jka=891FHjaH32-2f1Hnb2sFhxxps://penskecar[.]riersrmissecured[.]com/_c/cstm/4325/reg/DOTLookup[.]aspxhxxps://rsrmissecured[.]top/[.]git/configlpanel-bumaepxuje-iframe[.]toplpanel-bumaepxuje[.]toplpanel-kkbnukltpo[.]topns1[.]suspended-domain[.]compenskecar[.]riersrmissecured[.]com/_c/cstm/4325/reg/DOTLookup[.]aspxpenskecar[.]rsrmissecured[.]top

Cisco Talos Exposes Three-Year Campaign: UAT-8616 Exploits SD-WAN Zero-Day for Critical Infrastructure Access 6 indicators · Feb 25, 2026

IPv4 (1)

1[.]1[.]1[.]10

CVEs (5)

CVE-2022-20775CVE-2025-20333 CVE-2025-20362 CVE-2026-20127 CVE-2026-20182

APT31’s Multi-Year Cyber Espionage Campaign Against Czech Ministry of Foreign Affairs 5 indicators · Feb 24, 2026

Domains (1)

www[.]treadstone71[.]com

URLs (4)

hxxps://www[.]treadstone71[.]com/cognitive-armyhxxps://www[.]treadstone71[.]com/training/building-a-cognitive-warfare-cyber-psyops-programhxxps://www[.]treadstone71[.]com/training/p-omega-syllabushxxps://www[.]treadstone71[.]com/training/the-mission

APT28 Deploys Operation MacroMaze: Webhook-Based Macro Malware Targets European Entities 2 indicators · Feb 24, 2026

Domains (1)

URLs (1)

Chinese APT UnsolicitedBooker Deploys LuciDoor and MarsSnake Backdoors Against Central Asian Telecoms 1 indicators · Feb 24, 2026

CVEs (1)

CVE-2018-0802

APT28 Targets European Entities with Operation MacroMaze Webhook Malware Campaign 2 indicators · Feb 23, 2026

Domains (1)

URLs (1)

Unit 42 Exposes Active Exploitation of BeyondTrust CVE-2026-1731 with VShell and SparkRAT Backdoors 64 indicators · Feb 23, 2026

IPv4 (19)

134[.]122[.]13[.]34138[.]197[.]14[.]95142[.]111[.]152[.]50144[.]172[.]103[.]200155[.]2[.]215[.]64178[.]128[.]212[.]209179[.]43[.]146[.]4223[.]162[.]40[.]18737[.]19[.]221[.]18045[.]61[.]150[.]9664[.]31[.]28[.]22164[.]95[.]10[.]11570[.]23[.]0[.]6682[.]29[.]53[.]18782[.]29[.]72[.]1683[.]138[.]53[.]13985[.]155[.]186[.]12192[.]223[.]44[.]13498[.]10[.]233[.]76

Domains (7)

39uchxifap4cvgzsuirom0szrrg[.]d65lre9sfqnlcv49317gcis6pyjsatzho[.]oast[.]proaliyundunupdate[.]xyzd65sb7ngveucv5k2nm508abdsjmbn7qmn[.]oast[.]projudiemkqjajsfzpidfjlowgl8nyrtd49x[.]oast[.]funoastify[.]comq0r2e5q2dzbykcox9qmkptm12s8mwb[.]oastify[.]comtransfer[.]weepee[.]io

URLs (14)

aliyundunupdate[.]xyzhxxp://134[.]122[.]13[.]34:8979/chxxp://39uchxifap4cvgzsuirom0szrrg[.]d65lre9sfqnlcv49317gcis6pyjsatzho[.]oast[.]prohxxp://64[.]31[.]28[.]221/supporthxxp://82[.]29[.]53[.]187:8778/app_clihxxp://85[.]155[.]186[.]121/accesshxxps://64[.]95[.]10[.]115:23011/update[.]shhxxps://85[.]155[.]186[.]121/access/Remote%20Access-linux64-offline[.]tar?language=en&app=76049110434275449312180081368257747094hxxps://judiemkqjajsfzpidfjlowgl8nyrtd49x[.]oast[.]funhxxps://transfer[.]weepee[.]io/7nZw7/blue[.]drxoast[.]funoast[.]prooastify[.]comweepee[.]io/7nZw7/blue[.]drx

sha256 (9)

0ecc867ce916d01640d76ec03de24d1d23585eb582e9c48a0364c62a590548ac4762e944a0ce1f9aef243e11538f84f16b6f36560ed6e32dfd9a5f99e17e8e5066cceb2c2f1d9988b501832fd3b559775982e2fce4ab38fc4ffe71b74eafc726679ee05d92a858b6fe70aeb6072eb804548f1732e18b6c181af122b833386afb98442387d466f27357d727b3706037a4df12a78602b93df973b063462a67776198a7b0900a9072bb40af579ec372da7b27af12b15868394df51fefe290ab176b9f431d5549a03aee92cfd2bdbbe90f1c91e965c99e90a0c9ad5a001f4e80c350cc2bc3750cc5125a50466f66ae4f2bedf1cac0e43477a78ed2fd88f3e987a292cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce

CVEs (14)

CVE-2023-33538CVE-2024-12356CVE-2025-0921 CVE-2025-14847 CVE-2025-23304 CVE-2025-55182 CVE-2025-66478 CVE-2026-0257 CVE-2026-0300 CVE-2026-1281 CVE-2026-1340 CVE-2026-1731 CVE-2026-22584 CVE-2026-31431

Bitcoin Addresses (1)

39uchxifap4cvgzsuirom0szrrg

Chinese APT Exploited Dell RecoverPoint Zero-Day for 18 Months Before Discovery 3 indicators · Feb 22, 2026

CVEs (3)

CVE-2026-15409 CVE-2026-15410CVE-2026-22769

CVE-2026-20841: Windows Notepad RCE Vulnerability Weaponized with Public PoC Exploit 1 indicators · Feb 22, 2026

CVEs (1)

CVE-2026-20841

Facebook Malvertising Campaign Uses Fake Windows 11 Pages to Deploy Credential-Stealing Malware 9 indicators · Feb 20, 2026

Domains (4)

ms-25h2-download[.]proms-25h2-update[.]proms25h2-download[.]proms25h2-update[.]pro

URLs (4)

ms-25h2-download[.]proms-25h2-update[.]proms25h2-download[.]proms25h2-update[.]pro

sha256 (1)

c634838f255e0a691f8be3eab45f2015f7f3572fba2124142cf9fe1d227416aa

Kimwolf Botnet Swamps I2P Anonymity Network in Massive Sybil Attack 1 indicators · Feb 19, 2026

Domains (1)

geti2p[.]net

Threat Actors Abuse Atlassian Jira Cloud to Bypass Email Security and Target Government Entities 12 indicators · Feb 18, 2026

IPv4 (1)

13[.]227[.]180[.]4

Domains (7)

adrinal[.]comarchicad3d[.]comatlassian[.]netbarankinyserialxud[.]onlineclaude[.]aigo[.]sparkpostmail1[.]comsparkpostmail1[.]com

URLs (4)

adrinal[.]comarchicad3d[.]combarankinyserialxud[.]onlinego[.]sparkpostmail1[.]com

LockBit 5.0 Ransomware Emerges: Cross-Platform Threat Targeting Windows, Linux, and ESXi Systems 2 indicators · Feb 17, 2026

CVEs (2)

CVE-2025-14174 CVE-2025-43529 CVE-2026-20700

CVE-2026-20700: Apple Patches First Zero-Day of 2026 After Extremely Sophisticated Targeted Attacks 3 indicators · Feb 16, 2026

CVEs (3)

CVE-2026-2441: Google Patches First Actively Exploited Chrome Zero-Day of 2026 2 indicators · Feb 16, 2026

CVEs (2)

CVE-2026-20700 CVE-2026-2441

Physical Mail Phishing Targets Trezor and Ledger Users: Attackers Use QR Codes to Steal Recovery Phrases 8 indicators · Feb 15, 2026

Domains (2)

ledger[.]setuptransactioncheck[.]comtrezor[.]authentication-check[.]io

URLs (6)

authentication-check[.]io/authentication-check[.]io/black/api/send[.]phphxxps://ledger[.]setuptransactioncheck[.]com/hxxps://trezor[.]authentication-check[.]io/hxxps://trezor[.]authentication-check[.]io/black/api/send[.]phpsetuptransactioncheck[.]com/

Microsoft Exposes DNS-Based ClickFix Attack: Nslookup Commands Used for Stealth Malware Staging 6 indicators · Feb 15, 2026

Domains (3)

azwsappdev[.]comraxelpak[.]comtestdomain123123[.]shop

URLs (3)

azwsappdev[.]comraxelpak[.]comtestdomain123123[.]shop

CVE-2026-1731: Critical BeyondTrust Remote Support Vulnerability Under Active Exploitation 2 indicators · Feb 14, 2026

Email Addresses (1)

lucian_constantin@foundryco[.]com

CVEs (1)

CVE-2026-1731

Critical Unstructured.io Vulnerability CVE-2025-64712 Threatens AI Pipelines at Amazon, Google, and Fortune 1000 Enterprises 3 indicators · Feb 13, 2026

Domains (2)

Unstructured[.]iounstructured[.]io

CVEs (1)

CVE-2025-64712

XWorm RAT Campaign Exploits 7-Year-Old Office Vulnerability with Fileless Techniques 1 indicators · Feb 13, 2026

CVEs (1)

CVE-2018-0802

Metro4Shell: Critical React Native CLI Vulnerability Actively Exploited to Deploy Malware 4 indicators · Feb 12, 2026

IPv4 (3)

134[.]209[.]69[.]155223[.]6[.]249[.]1415[.]109[.]182[.]231

CVEs (1)

CVE-2025-11953

AiFrame Campaign: 30 Fake AI Chrome Extensions with 300K Users Steal Credentials, Gmail Content 2 indicators · Feb 12, 2026

Domains (1)

tapnetic[.]pro

URLs (1)

tapnetic[.]pro

XWorm RAT Campaign Exploits CVE-2018-0802 in Multi-Language Phishing Attacks Using Fileless Injection 25 indicators · Feb 11, 2026

Domains (6)

berlin101[.]comcloudinary[.]compub-3bc1de741f8149f49bdbafa703067f24[.]r2[.]devr2[.]devres[.]cloudinary[.]comretrodayaengineering[.]icu

URLs (10)

berlin101[.]comhxxp://pub-3bc1de741f8149f49bdbafa703067f24[.]r2[.]dev/wwa[.]txthxxps://pub-3bc1de741f8149f49bdbafa703067f24[.]r2[.]dev/wwa[.]txthxxps://res[.]cloudinary[.]com/dbjtzqp4q/image/upload/v1767455040/hxxps://res[.]cloudinary[.]com/dbjtzqp4q/image/upload/v1767455040/optimized_MSI_lpsd9p[.]jpghxxps://retrodayaengineering[.]icu/HGG[.]htapub-3bc1de741f8149f49bdbafa703067f24[.]r2[.]dev/wwa[.]txtres[.]cloudinary[.]com/dbjtzqp4q/image/upload/v1767455040/res[.]cloudinary[.]com/dbjtzqp4q/image/upload/v1767455040/optimized_MSI_lpsd9p[.]jpgretrodayaengineering[.]icu/HGG[.]hta

md5 (1)

3bc1de741f8149f49bdbafa703067f24

sha256 (5)

3F4C3C16F63FB90D1FD64B031D8A9803035F3CB18332E198850896881FB42FE58665BC1B33CBE6F5859CD6E362AF77738BA73A6E6D4B9974C16C8521D84C1892EACD8E95EAD3FFE2C225768EF6F85672C4BFDF61655ED697B97F598203EF2CF6EE663D016894D44C69B1FDC9D2A5BE02F028A56FC22B694FF7C1DACB2BBBCC6DFD9BA9E6BD4886EDC1123D4074D0EAC363DF61162364530B1303390AA621140B

CVEs (2)

CVE-2017-11882CVE-2018-0802

Bitcoin Addresses (1)

3bc1de741f8149f49bdbafa703067f24

Chinese APT UNC3886 Breaches Singapore’s Four Largest Telcos in Coordinated Espionage Campaign 3 indicators · Feb 10, 2026

CVEs (3)

CVE-2022-41328CVE-2023-20867CVE-2023-34048

BlueNoroff’s GhostCall and GhostHire Campaigns Use Stolen Victim Videos to Compromise Crypto Executives 194 indicators · Feb 10, 2026

IPv4 (1)

104[.]168[.]214[.]151

Domains (47)

Backdoor[.]Python[.]Agent[.]brCrypto[.]comTrojan[.]Shell[.]Agent[.]gnautoupdate[.]onlinebots[.]autoupdate[.]onlinebotsc[.]autoupdate[.]xyzcheck[.]datatabletemplate[.]shopchkactive[.]onlinecloud-server[.]storedataupload[.]storedownload[.]datatabletemplate[.]xyzdownload[.]face-online[.]worldfile-server[.]storefiledrive[.]onlinefirst[.]longlastfor[.]onlinefirst[.]system-update[.]xyzfirstfromsep[.]onlineflashserve[.]storegroup[.]comimage-support[.]xyzinstant-update[.]onlinemetamask[.]awaitingfor[.]sitepre[.]alwayswait[.]sitereadysafe[.]xyzreal-update[.]xyzroot[.]chkstate[.]onlineroot[.]security-update[.]xyzsafefor[.]xyzsafeup[.]storesafeupload[.]onlinesecond[.]awaitingfor[.]onlinesecond[.]systemupdate[.]cloudsecondshop[.]onlinesecondshop[.]storesignsafe[.]sitesignsafe[.]xyzsupport[.]mssupport[.]ms-live[.]ussupport[.]video-meeting[.]onlineswissborg[.]blogsystem[.]updatecheck[.]storeurgent-update[.]cloudus[.]zoom[.]comweb071zoom[.]usweb[.]commoncome[.]onlinewriteup[.]livezoom[.]app

URLs (69)

alwayswait[.]siteautoupdate[.]onlineautoupdate[.]xyzawaitingfor[.]onlineawaitingfor[.]site/updatebots[.]autoupdate[.]onlinechkactive[.]online/updatechkstate[.]onlinecloud-server[.]store/updatecommoncome[.]onlinedatatabletemplate[.]shopdatatabletemplate[.]xyzdatatabletemplate[.]xyz/account/register/id=8118555902061899&ampdataupload[.]storedataupload[.]store/uploadfilesface-online[.]worldfile-server[.]store/updatefiledrive[.]onlinefiledrive[.]online/uploadfilesfirstfromsep[.]online/clientflashserve[.]store/updatehxxp://web071zoom[.]us/fix/audio-fv/7217417464hxxp://web071zoom[.]us/fix/audio-tr/7217417464hxxp://web071zoom[.]us/fix/audio/4542828056hxxps://bots[.]autoupdate[.]online:8080/testhxxps://chkactive[.]online/updatehxxps://cloud-server[.]store/updatehxxps://dataupload[.]store/uploadfileshxxps://download[.]datatabletemplate[.]xyz/account/register/id=8118555902061899&secret=QwLoOZSDakFhhxxps://file-server[.]store/updatehxxps://filedrive[.]online/uploadfileshxxps://flashserve[.]store/updatehxxps://metamask[.]awaitingfor[.]site/updatehxxps://safeup[.]store/testhxxps://safeupload[.]online/uploadfileshxxps://support[.]ms-live[.]us/301631/checkhxxps://support[.]ms-live[.]us/register/22989524464UcX2b5w52hxxps://support[.]ms-live[.]us/update/02583235891M49FYUN57hxxps://urgent-update[.]cloud/uploadfileshxxps://writeup[.]live/testimage-support[.]xyzinstant-update[.]onlinelonglastfor[.]onlinems-live[.]us/301631/checkms-live[.]us/register/22989524464UcX2b5w52ms-live[.]us/update/02583235891M49FYUN57readysafe[.]xyzreal-update[.]xyzsafefor[.]xyzsafeup[.]store/testsafeupload[.]onlinesafeupload[.]online/uploadfilessecondshop[.]onlinesecondshop[.]storesecurity-update[.]xyzsignsafe[.]sitesignsafe[.]xyzsignsafe[.]xyz/updateswissborg[.]blogsystem-update[.]xyzsystemupdate[.]cloudsystemupdate[.]cloud/clientupdatecheck[.]storeurgent-update[.]cloud/uploadfilesvideo-meeting[.]onlineweb071zoom[.]us/fix/audio-fv/7217417464web071zoom[.]us/fix/audio-tr/7217417464web071zoom[.]us/fix/audio/4542828056writeup[.]live/test

md5 (58)

00dd47af3db45548d2722fe8a448950801d3ed1c228f09d8e56bfbc5f5622a6c0af11f610da1f691e43173d44643283f0ca37675d75af0e7def0025cd564d6c510cd1ef394bc2a2d8d8f2558b73ac7b81243968876262c3ad4250e1371447b231653d75d579872fadec1f22cf7fee3c017baae144d383e4dc32f1bf69700e58719a7e16332a6860b65e6944f1f3c50011ee10fa01587cec51f455ceec779a160261a409946b6b4d9ce706242a76134e32B499EB3865A7EF17264D15252B7F73E2c42253ebf9a743814b9b16a89522bef31b88dd319af8e4b8a96fc9732ebc708358c2969041c8be74ce478edb2ffcd19389447013870120775556bb4519dba9738c8d80dd32d00e9c9440a498f7dd7393bbe4dfe3134c8a7928d10c948e20bee50f341b24cb75f37d042d1e5f9e3e5aa529fe6eff1cf452680976087e2250c025ad40a5fd18a1b57b69c44bc2963dc6b5cb4f0084f3c25e640952753ed5b25d060bfe4f378e9f5a84183ac505a0322286348b49f3499d760797247b94385fda36422795a6df10c45c1006f92d686ee7e6aa93664b4852cb5bad84ba1a187f6457168ce5c6e5545a5b389db09c90038da73d26eb56e5a3426884733c104c3f6257581854ff6c890684823f3aed03c210f76ACE3A6892C25512B17ED42AC2EBD0576ace3a6892c25512b17ed42ac2ebd057e50c3f301dd045eb189ba1644ded1557f94ed2d5f566c12de5ebe4b5e3d8aa38006efb8dd703073197e5a27682b35bf8f8942cd14f646f59729f83cbd4c357b931cec3c80c78d233e3602a042a2e71b9551b4af789b2db563f9452eaf46b6aa963f473f1734d8b3fbb8c9a227c06d07a070b77c5028d7a5d2895f1c9d35016fa0eb7e480752d494709c63aa35ccf36ca26f2b97ca4e2b4b5d58933900f02131a6ce961f487b4cbdfe68d0a249647c48ab1e8693931f8c694247d96cf5a85197b2e9a6412fd7c068a5d7c38d0afd946fb567bfdaac131a2d8a23ad8fd450a31dc42c7a2ea1c2f00dddb0cc4c8bfb5bcfc446682f33641cff21083ac2ce477dbec6f0c8d41b9ad4f079161548d2435d80d63805e89053716b6ab93ce6decf8450d8529855fab4b4aa6c2b34449cb3b9fbde93e85199240de761a8ba0a56f0088de33f942cf1479ca8530a916868bad954e8680d17fba6425e4a9bb552fb8db2b1e9fdd703e60b31eb803b1b59985cabeceda0525c078f5a216a977bc64e86160af1bad0efbd3bd5a4202fe740756f977af1d2af27b13cd3424556b18dfd3cf83ff8bb2528bf35f8c11fbc4369e68c4038

sha256 (8)

3DD226D0B700F33974F409142DEFB62A8CD172AE5F2EB9BEB7F5750EB1702E2A4451EE8BC53EA7C148D8348BC7B82ACA9977BDD31C0156DFE25C4A879A1D21905B77F83ECEFA0E32BA922F61C9EFFF7F755BA51A010DB844CA7E8AD3DB28650A71B743C529F0B27735F7774A0903CB908EDC93423B60FE9BE49A3729982D0E8DA6C1A7CE43B029A1EF4AE69B26F745440ECCE8368C89F11AC999D4ED04A31572B3CC15C1033DE79024F9CF3CD6A6A7A9B7E54A1A57D3156036F5C05F541694B7B494A0AE421AFE170F6CB9DE2C1193A78FBE16F627F85139676AFC5D9BFE93A2C4DB903322D17C8CBF1D1DB55124854C0B070D6ECE54162B6A4D06DF24C572DF

Bitcoin Addresses (11)

10cd1ef394bc2a2d8d8f2558b73ac7b81243968876262c3ad4250e1371447b231653d75d579872fadec1f22cf7fee3c017baae144d383e4dc32f1bf69700e58719a7e16332a6860b65e6944f1f3c50011ee10fa01587cec51f455ceec779a16031b88dd319af8e4b8a96fc9732ebc708358c2969041c8be74ce478edb2ffcd19389447013870120775556bb4519dba9738c8d80dd32d00e9c9440a498f7dd7393bbe4dfe3134c8a7928d10c948e20bee

APT28 Exploits CVE-2026-21509 in Operation Neusploit: Stealing Emails with MiniDoor Backdoor 48 indicators · Feb 9, 2026

Domains (2)

freefoodaid[.]comwellnesscaremed[.]com

URLs (8)

freefoodaid[.]comfreefoodaid[.]com/documents/2_2[.]dfreefoodaid[.]com/documents/2_2[.]lNkfreefoodaid[.]com/tables/tables[.]dhxxps://freefoodaid[.]com/documents/2_2[.]dhxxps://freefoodaid[.]com/documents/2_2[.]lNkhxxps://freefoodaid[.]com/tables/tables[.]dwellnesscaremed[.]com

md5 (12)

154ff6774294e0e6a46581c8452a77de2f7b4dca1c79e525aef8da537294a6c44727582023cd8071a6f388ea3ba2feaa7c396677848776f9824ebe408bbba943859c4b85ed85e6cc4eadb1a037a61e1695e59536455a089ced64f5af2539a449d47261e52335b516a777da368208ee91e4a5c4b205e1b80dc20d9a2fb4126d06ea6615942f2c23dba7810a6f7d69e2daee0b44346db028a621d1dec99f429823f05d0b13c633ad889334781cf4091d3ef3b869a8d5ad243e35963ba6d7f89855

sha1 (12)

22da6a104149cad87d5ec5da4c3153bebf68c41123b6f9c00b9d5475212173ec3cbbcff34c4400a74592e6173a643699dc526778aa0a30330d16fe087bbb530eb77c6416f02813cd2764e49bd084465cD577c4a264fee27084ddf717441eb89f714972a5c1b272067491258ea4a2b1d2789d82d157aaf90ac4799d17a4343bd353e0edb0a4de248b99295d4dc8c84bf33c05fb3a69bc5e2d6377b73649b93dcecea7e9323d79054f92634f4032c26d30c1cedd7ed788d85335e20bb1f173d4d0494629d36083dddcda1c3e92f69e6ca0e4f4823525905cb6969a44ade52a9f004f4359ea0f8f9c6eb91731ed78e5c4d3

sha256 (12)

0bb0d54033767f081cae775e3cf9ede7ae6bea75f35fbfb748ccba9325e28e5e1ed863a32372160b3a25549aad25d48d5352d9b4f58d4339408c4eea69807f502822c72a59b58c00fc088aa551cdeeb92ca10fd23e23745610ff207f53118db93f446d316efe2514efd70c975d0c87e12357db9fca54a25834d60b28192c6a695a17cfaea0cc3a82242fdd11b53140c0b56256d769b07c33757d61e0a0a6ec029f4672c1374034ac4556264f0d4bf96ee242c0b5a9edaa4715b5e61fe8d55cc8a876f648991711e44a8dcf888a271880c6c930e5138f284cd6ca6128eca56ba1a944a09783023a2c6c62d3601cbd5392a03d808a6a51728e07a3270861c2a8eeb2ba51b4491da8604ff9410d6e004971e3cd9a321390d0258e294ac42010b546bb23545380fde9f48ad070f88fe0afd695da5fcae8c5274814858c5a681d8c4ec91183175ce77360006f964841eb4048cf37cb82103f2573e262927be4c7607ffd3f13db41cd5b442fa26ba8bc0e9703ed243b3516374e3ef89be71cbf07436b

CVEs (1)

CVE-2026-21509

Bitcoin Addresses (1)

154ff6774294e0e6a46581c8452a77de

Fake 7-Zip Downloads Convert Home PCs Into Residential Proxy Nodes for Cybercriminals 21 indicators · Feb 9, 2026

Domains (9)

7-zip[.]org7zip[.]comapex[.]herosms[.]aiflux[.]smshero[.]coiplogger[.]orgneo[.]herosms[.]conova[.]smshero[.]aisoc[.]hero-sms[.]cospark[.]herosms[.]io

URLs (8)

7zip[.]comhero-sms[.]coherosms[.]aiherosms[.]coherosms[.]ioiplogger[.]orgsmshero[.]aismshero[.]co

sha256 (3)

3544ffefb2a38bf4faf6181aa4374f4c186d3c2a7b9b059244b65dce8d5688d9b7a7013b951c3cea178ece3363e3dd06626b9b98ee27ebfd7c161d0bbcfbd894e7291095de78484039fdc82106d191bf41b7469811c4e31b4228227911d25027

Mutex Names (1)

Mutex: Global\3a886eb8-fe40-4d0a-b78b-9e0bcb683fb7

TGR-STA-1030 Espionage Campaign Compromises 70 Organizations Across 37 Nations Using ShadowGuard Linux Rootkit 1 indicators · Feb 8, 2026

Domains (1)

mega[.]nz

BridgePay Ransomware Attack Forces Nationwide Cash-Only Payment Disruption 1 indicators · Feb 8, 2026

Domains (1)

Gateway[.]Itstgate[.]com

Flickr Data Breach Exposes User Information Through Third-Party Email Vendor Vulnerability 1 indicators · Feb 7, 2026

Domains (1)

Winbuzzer[.]com

APT-Q-27 (GoldenEyeDog) Deploys Fileless Malware in Stealthy Corporate Network Attacks 2 indicators · Feb 7, 2026

IPv4 (1)

185[.]135[.]79[.]200

Domains (1)

wk[.]goldeyeuu[.]io

Iranian APT Infy Resurfaces with New Tornado Malware After Internet Blackout 1 indicators · Feb 6, 2026

CVEs (1)

CVE-2025-8088

SystemBC Botnet Survives Law Enforcement Takedown, Infects Over 10,000 Devices Worldwide 30 indicators · Feb 5, 2026

IPv4 (16)

103[.]112[.]211[.]167103[.]28[.]36[.]105148[.]113[.]208[.]227185[.]93[.]89[.]145196[.]13[.]207[.]92202[.]142[.]184[.]23436[.]255[.]98[.]15236[.]255[.]98[.]15936[.]255[.]98[.]16036[.]255[.]98[.]16536[.]255[.]98[.]17962[.]60[.]131[.]18062[.]60[.]131[.]18462[.]60[.]131[.]18762[.]60[.]131[.]19162[.]60[.]131[.]204

Domains (7)

bthoster[.]comconcours[.]govconcours[.]gov[.]bfexploit[.]inforum[.]exploit[.]ingov[.]vnphutho[.]duchop[.]gov[.]vn

URLs (4)

bthoster[.]comconcours[.]gov[.]bfduchop[.]gov[.]vnforum[.]exploit[.]in

sha256 (3)

0f5c81eaf35755a52e670c89b9546e7047828d83f346e3c29be1f6958e14a384c729bf6ea292116b3477da4843aaeec73370e2bd46e7a27674671e9a65fb473ada95384032f84228ef62f982f3c0f9e574dc6b06b606db33889ea6a5f93d6ae2

DKnife: Cisco Talos Exposes China-Nexus Gateway-Monitoring AitM Framework Active Since 2019 5 indicators · Feb 5, 2026

Domains (2)

Hunt[.]io malpedia[.]caad[.]fkie[.]fraunhofer[.]de

URLs (1)

hxxps://malpedia[.]caad[.]fkie[.]fraunhofer[.]de/details/win[.]shadowpad&quot

sha1 (1)

a182e35da64e6d71cb55f125c4d4225196523f14

CVEs (1)

CVE-2021-44515

CISA Confirms VMware ESXi Flaw CVE-2025-22225 Now Exploited in Active Ransomware Campaigns 5 indicators · Feb 4, 2026

CVEs (5)

CVE-2024-37079CVE-2025-22224CVE-2025-22225CVE-2025-22226CVE-2025-41244

EnCase Forensic Driver Weaponized: BYOVD Attack Targets 59 EDR Tools Through SonicWall VPN Breach 5 indicators · Feb 4, 2026

IPv4 (2)

193[.]160[.]216[.]22169[.]10[.]60[.]250

Domains (1)

OemHwUpd[.]sy

sha256 (2)

3111f4d7d4fac55103453c4c8adb742def007b96b7c8ed265347df97137fbee06a6aaeed4a6bbe82a08d197f5d40c2592a461175f181e0440e0ff45d5fb60939

PDFSider: The Stealthy Backdoor Targeting Fortune 100 Financial Institutions 50 indicators · Feb 4, 2026

ShinyHunters Claims Massive Ivy League Breach: 2.2 Million Records from Harvard and UPenn 1 indicators · Feb 4, 2026

Domains (1)

Claude[.]ai

AI-Powered Attack Achieves AWS Admin Access in Under 10 Minutes: A New Era of Automated Intrusions 20 indicators · Feb 4, 2026

IPv4 (18)

103[.]177[.]183[.]165104[.]155[.]129[.]177104[.]155[.]178[.]59104[.]197[.]169[.]222136[.]113[.]159[.]75152[.]58[.]47[.]83194[.]127[.]167[.]92197[.]51[.]170[.]131204[.]152[.]223[.]17234[.]171[.]37[.]3434[.]173[.]176[.]17134[.]30[.]49[.]23534[.]63[.]142[.]3434[.]66[.]36[.]3834[.]69[.]200[.]12534[.]9[.]139[.]20635[.]188[.]114[.]13235[.]192[.]38[.]204

Domains (2)

download[.]pytorch[.]orgterraform-bedrock-deploy[.]tf

ShadowHS: Fileless Linux Post-Exploitation Framework Runs Entirely in Memory 40 indicators · Feb 3, 2026

IPv4 (3)

204[.]93[.]253[.]18062[.]171[.]153[.]4791[.]92[.]242[.]200

Domains (7)

Kawpow[.]asiaKawpow[.]asia[.]mine[.]zergpool[.]comKawpow[.]naKawpow[.]na[.]mine[.]zergpool[.]comkawpow[.]eukawpow[.]eu[.]mine[.]zergpool[.]compayload[.]so

URLs (1)

zergpool[.]com

sha256 (26)

04a072481ebda2aa8f9e0dac371847f210199a503bf31950d796901d5dbe9d58072e08b38a18a00d75b139a5bbb18ac4aa891f4fd013b55bfd3d6747e1ba0a270bb7d4d8a9c8f6b3622d07ae9892aa34dc2d0171209e2829d7d39d5024fd79ef148f199591b9a696197ec72f8edb0cf4f90c5dcad0805cfab4a660f65bf27ef319df5436972b330910f7cb9856ef5fb17320f50b6ced68a76faecddcafa7dcd720c1819c2fb886375d9504b0e7e5debb87ec9d1a53073b1f3f36dd6a6ac3f4273ba88f92a87c0bb01b13754190c36d8af7cd047f738ebb3d6f975960fe7614d63f014aa3e339d33760934f180915045daf922ca8ae07531c8e716608e683d92d4069eaadc94efb5be43b768c47d526e4c080b7d35b4c9e7eeb63b8dcf0038d7d574a17028b28fdf860e23754d16ede622e4e27bac11d33dbf5c39db501dfccdc5a6b08d42cc8296b32034b132bab18d201a48c1628df3200e869722506dd4ec6662d4e58e95b7b27eb961f3d81d299af961892c74bc7a1f2bb7a8f2442030d0e666122c39b2fd4499678105420e21b938f0f62defdbc85275e14156ae69539d66c50fcf14af7f984a152016498bf4096dd1f71e9d35000301b8319bd50f7f6d072023e9829b0de93cf9f057858cac1bcd4a0499b018fb81406e08cd3053ae55b7361c6861fdb08cab819b13bf2327bc82eebdd70651c7de1aed18515c1700d977fbab71fcc454401f6c3db91ed0afb0027266d5681c23900894f1002ceca389a8007b94d367b7dbacaac4c1da0305b489f0f3f7a38770dcdb68d5824fe33d041847846a0f0c76cf5699342a066378774f1101d2fb74850e3731dc9b74e12a69d9f2cfc65b480695aa2fd847db901e6b1135b5ed982d9942c61b629243d6830dd9fdaf64180b7d02b399d2a92f1cdd062af2e6584852ea597c50194b62cca3c0bb3ee445675fce1fccf365a7b681b316124b1a5f0a7e87042136e91776b187f39c679b408275f9624602702f5601954f3b51efbb1acc505950ee88175854e783fe11bcba19ac628ae1d0b56e43646ae1b5da2ccc1da5162e6719d4b7d68d37096e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855e5a6deec56095d0ae702655ea2899c752f4a0735f9077605d933a04d45cd7e24

Ethereum Addresses (1)

0xd67f158b2bcc819eee7029f3477f0270ec1d37b4

Monero Addresses (2)

87YLCx7zEFghgMEeZvJCZ3gHyS3fUsbAnXSTH8nh8EP7SeptPH8Pnh18snravwhE3dfRt5x67aWo8e6tSJ2cv4mpRNkSdqL88H9UmU6QyYiGeZdR6hXZJXtJF9Z8zLHDQbC1NV1PDdjCynBq3QKzB1fo1NRhgMX4cBx68Rva5msyKW3PGXfPhCA4itHmiv

Vibe Coding Gone Wrong: Moltbook AI Social Network Exposes 4.75 Million Records in Massive Database Breach 7 indicators · Feb 3, 2026

Domains (2)

ehxbxtjliybbloantpwq[.]supabase[.]cowww[.]moltbook[.]com

URLs (5)

hxxps://ehxbxtjliybbloantpwq[.]supabase[.]co/rest/v1/agents?selecthxxps://ehxbxtjliybbloantpwq[.]supabase[.]co/rest/v1/owners?select=email,x_handle,x_name&email=neq[.]null&limit=5hxxps://ehxbxtjliybbloantpwq[.]supabase[.]co/rest/v1/posts?id=eq[.]74b073fd-37db-4a32-a9e1-c7652e5c0d59hxxps://ehxbxtjliybbloantpwq[.]supabase[.]co/rest/v1/usershxxps://www[.]moltbook[.]com/_next/static/chunks/18e24eafc444b2b9[.]js

Russian Legion Hacker Alliance Launches OpDenmark Campaign Against Danish Critical Infrastructure 1 indicators · Feb 2, 2026

Domains (1)

sundhed[.]dk

Iconics Suite SCADA Vulnerability Enables Denial-of-Service Through Privileged File Operations 14 indicators · Jan 31, 2026

CVEs (14)

CVE-2023-33538CVE-2024-7587CVE-2025-0921 CVE-2025-14847 CVE-2025-23304 CVE-2025-55182 CVE-2025-66478 CVE-2026-0257 CVE-2026-0300 CVE-2026-1281 CVE-2026-1340 CVE-2026-1731 CVE-2026-22584 CVE-2026-31431

Global Energy Systems Exposed: Widespread Cybersecurity Gaps Found in Power Grid OT Networks 1 indicators · Jan 31, 2026

Domains (1)

ThemesDNA[.]com

WinRAR CVE-2025-8088: Russia, China, and Cybercriminals Unite to Exploit Path Traversal Flaw 46 indicators · Jan 31, 2026

sha256 (44)

272c86c6db95f1ef8b83f672b65e64df16494cae261e1aba1aeb1e59dcb6852429f89486bb820d40c9bee8bf70ee8664ea270b16e486af4a53ab7039969432562c40e7cf613bf2806ff6e9bc396058fe4f85926493979189dbdbc7d615b7cb1433580073680016f23bf474e6e62c61bf6a776e561385bfb06788a4713114ba9d3b47df790abb4eb3ac570b50bf96bb1943d4b46851430ebf3fc36f645061491b3b85d0261ab2531aba9e2992eb85273be0e26fe61e4592862d8f45d6807ceee4498961237cf1c48f1e7764829818c5ba0af24a234c2f29c4420fb80276aec6764f4567abe9ff520797b04b04255bbbe07ecdddb594559d436ac53314ec62c1b353f1b841d323c211c715b8f80d0efb9529440caae921a60340de027052946dd954305c7b95d8105601461bb18de87f1f679d833f15e38a9ee7895a0c8605c0d055b3dc57929d8eacfdadc71d92483eabe4874bf3d0189f861b145705a0f0a8fe5b64786ed92545eeac013be9456e1ff03d95073910742e45ff6b88a86e91901b5dee69127d501142413fb93fd2af8c8a378682c140c52b48990a5c41f2ce361668d9020aa9b509a6d018d6d9f4c77e7604a588b2848e05da6a4d9f82d725f91b6d3586aa6603f1c1c79d7bd7e0b5c5f0cc8e8a84577c35d21b0f462656c2e1f9867a05d67dd184d544d5513f4f07959a7c2b558197c99cb8139ea797ad9fbece8a7ee2a8e6b3476319a3a0d5846805fd25fa388c7f2215668bc134202ea093fa91e61fd77460393a89a8af657d09df6a815465f6ce22f1db8277d58342b32249958921ea0995482fb04ea4a50bbdb654f272ab991046a43c1fdbd22da302d544a54bcafd9d4ece87fa314d508a68f47b0ec3351c0a270aa2ed3a0e275b9db03ca97f460bfa612f1d406823620d0d25e381f9b980a0497e2775269917a7150f04ae93d9327a91e90bf7744c6ce0eb4affb3acb62a5d1b2dafd645cba9af28d795aea13e5871b683a19a05015ff0369b412b985d47eb67a3af93f44400a026b4b0b2b62703a1ef7d9d3376c6b3609cd901cbccdcca80fba940ce8ed3f4e54cdbe6b53069a380a9dd3dc1c758888d0e50dd43935f16df0f7124c77569375a9f44f5b90ef1d21523eeffbca17181ccccf269bca3840786fcbf5c73218c6e1d6a51a9ba86b6e0199b8907427364246f049efd67dc4eda0b5078f4bc7607253634cf24bb4856a66bf7e0de18522e35798c0a8734179c1aab21ed2ad6821aaa99e1cb4cc7726c166e1947fdbf808a50b75ca7400d56fa6fef2a76cefe314848db22c76ccf35ce47b35f1405969f40633fcf35132ca3ccb3fdfded8cc270fc2223049b80cf8ebfd98da3025dc09d0b3bbeef874d8f9c4d4ba4937719f0a9a3aa04c81bebd418f878fa02729b38b5384bcb3216872a968f5d0c9c77609d8c5aacedb07546d981a16b9da1615514a02f5ebb38416a009f5621c0b718214d5b105c9f552389ddd67dda5d58c7480152c9f6e8043c3ea7de2e593beedf86b867b83f005bf0ccdefe25e400d4925d8a2bb4b1181044d06a8bf61688fd9c9ea59f1e0bb7bc21d8e836873479ff558cfb885097e8783356aad1f2d30b69d825b3a71cb7a57cf930ea0869fa9d5e23bdd16cddfefbbf9c67744598f379be306ff652f910db1ba162ed5b920dad5dcd3f9e55828f82a27211a212839c8942531c288535b92df7f453edc1f7528ca93ec432daca820f47e08d218b79cceca1ee764966f8f90d6a58bdef0e1bb2d389ab8b5f15d2f83cf978662e18e31dbe875f39db563e8a019af577f3e5667d02f95c001c717dfc5a0e100d2b701be4ec35a3e6875dc276431a7497f6761b5341a33188a7a1ca7a904d5866e07b8ddbde9adebdbce4306923cfc60afc2a6138786fae4e33dc343aea2b1a7cd6411187307ea2c82cd96b45f6d1f2a0ffc6c3805bbaef2c4003763fd5fac0ebcccf99a1656f10cf7677f6c2a5d16dbd

CVEs (2)

CVE-2023-38831CVE-2025-8088

CVE-2026-24061: 11-Year-Old GNU Telnetd Vulnerability Grants Instant Root Access 12 indicators · Jan 30, 2026

Domains (4)

codeberg[.]orglists[.]gnu[.]orgwww[.]cve[.]orgwww[.]cvedetails[.]com

URLs (5)

hxxps://codeberg[.]org/inetutils/inetutils/commit/ccba9f748aa8d50a38d7748e2e60362edd6a32cchxxps://codeberg[.]org/inetutils/inetutils/commit/fd702c02497b2f398e739e3119bed0b23dd7aa7bhxxps://lists[.]gnu[.]org/archive/html/bug-inetutils/2026-01/msg00004[.]htmlhxxps://www[.]cve[.]org/CVERecord?id=CVE-2026-24061hxxps://www[.]cvedetails[.]com/cve/CVE-2026-24061/

sha1 (2)

ccba9f748aa8d50a38d7748e2e60362edd6a32ccfd702c02497b2f398e739e3119bed0b23dd7aa7b

CVEs (1)

CVE-2026-24061

Ivanti Patches Two Critical EPMM Zero-Day Vulnerabilities Under Active Exploitation 7 indicators · Jan 30, 2026

IPv4 (3)

12[.]5[.]1[.]012[.]6[.]1[.]012[.]8[.]0[.]0

Domains (1)

help[.]ivanti[.]com

URLs (1)

hxxps://help[.]ivanti[.]com/mi/help/en_us/core/11[.]x/gsg/CoreGettingStarted/Configuring_LDAP_servers[.]htm

CVEs (2)

CVE-2026-1281 CVE-2026-1340

Ivanti EPMM Zero-Days Actively Exploited: Pre-Auth RCE via Bash Arithmetic Expansion 7 indicators · Jan 30, 2026

IPv4 (2)

12[.]7[.]0[.]012[.]8[.]0[.]0

Domains (1)

forums[.]ivanti[.]com

URLs (1)

hxxps://forums[.]ivanti[.]com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2026-1281-CVE-2026-1340?language=en_US

sha256 (1)

123aabf796106cfb2ab40cbbd43ba5b44fd937f1a5856e0a95640ba6f9d71843

CVEs (2)

CVE-2026-1281 CVE-2026-1340

Android Malware Campaign Abuses Hugging Face AI Platform to Distribute RAT 31 indicators · Jan 30, 2026

IPv4 (4)

108[.]187[.]7[.]133143[.]204[.]11[.]112148[.]135[.]44[.]146154[.]198[.]48[.]57

Domains (5)

au-club[.]topcdn-lfs-us-1[.]hf[.]cohuggingface[.]cotrustbastion[.]comwww[.]trustbastion[.]com

URLs (12)

au-club[.]tophf[.]co/rhf[.]co/repos/a5/0c/a50cf45d8b119af0cc75679c8307b05e29f2bc85b6d0bd55999dd018639f1c72/19f1a6b9ad1a9654e7c78fa2d37a3ec10192b01b636c5fc1995b80bf6f7dcb36?response-content-disposition=attachment%3B+filename*%3DUTF-8%27%27b[.]apk%3B+filename%3D%22b[.]apk%22%3B&amphuggingface[.]cohuggingface[.]co/datasets/xcvqsccm/sfxyt851/resolve/main/b[.]apk?download=truehxxps://cdn-lfs-us-1[.]hf[.]co/rhxxps://cdn-lfs-us-1[.]hf[.]co/repos/a5/0c/a50cf45d8b119af0cc75679c8307b05e29f2bc85b6d0bd55999dd018639f1c72/19f1a6b9ad1a9654e7c78fa2d37a3ec10192b01b636c5fc1995b80bf6f7dcb36?response-content-disposition=attachment%3B+filename*%3DUTF-8%27%27b[.]apk%3B+filename%3D%22b[.]apk%22%3B&response-content-type=application%2Fvnd[.]android[.]package-archive&Expires=1764089304&Policy=eyJTdGF0ZW1lbnQiOlt7IkNvbmRpdGlvbiI6eyJEYXRlTGVzc1RoYW4iOnsiQVdTOkVwb2NoVGltZSI6MTc2NDA4OTMwNH19LCJSZXNvdXJjZSI6Imh0dHBzOi8vY2RuLWxmcy11cy0xLmhmLmNvL3JlcG9zL2E1LzBjL2E1MGNmNDVkOGIxMTlhZjBjYzc1Njc5YzgzMDdiMDVlMjlmMmJjODViNmQwYmQ1NTk5OWRkMDE4NjM5ZjFjNzIvMTlmMWE2YjlhZDFhOTY1NGU3Yzc4ZmEyZDM3YTNlYzEwMTkyYjAxYjYzNmM1ZmMxOTk1YjgwYmY2ZjdkY2IzNj9yZXNwb25zZS1jb250ZW50LWRpc3Bvc2l0aW9uPSomcmVzcG9uc2UtY29udGVudC10eXBlPSoifV19&Signature=Mqc2vLuG17L9PD9eOO96Tbl8S1P6Efgzc1c%7EvjGQqg7jE6NcLyKqkIn7Koq06ybpChfuNeUOUSIRvqUXUd%7EAUt1mvivbp8cZla5frbYSx6ce2-Enp7KmhKXafgpPH6Hr8sGEt8EO56g3oF867bsCO3qH4Q9HqcX6DZZfgyysDxK22VIzEOYCoGqzIa0pj1gFr57PGdcyQJxqFDvpQ9KiCoLxqGjf4O5EpO-4bLJ53D3nZUTrDZX3sCHo7hUOxwqBMUefhgL0BKhL4JPfaBsHyfM9Cj%7EO1yPsf6CqZd%7EVfQWh9CH6ZW834YlKppFxovUMdg3dUHxUNUBDZg2-Nf3plw__&Key-Pair-Id=K24J24Z295AEI9hxxps://huggingface[.]cohxxps://huggingface[.]co/datasets/xcvqsccm/sfxyt851/resolve/main/b[.]apk?download=truehxxps://www[.]trustbastion[.]com/xiazz[.]htmltrustbastion[.]comtrustbastion[.]com/xiazz[.]html

md5 (6)

15bdc66aca9fb7290165d460e6a993a9b62c906078644edd3439e2d986abd2e2b716a8a742fec3084b0f497abbfecfc0d184d705189e42b54c6243a55d6c9502d8b0fd515d860be2969cf441ea3b620dfc874c42ea76dd5f867649cbdf81e39b

sha1 (1)

bdf3779ddc10f241603be57a90865b680cde8c31

sha256 (2)

19f1a6b9ad1a9654e7c78fa2d37a3ec10192b01b636c5fc1995b80bf6f7dcb36a50cf45d8b119af0cc75679c8307b05e29f2bc85b6d0bd55999dd018639f1c72

Bitcoin Addresses (1)

15bdc66aca9fb7290165d460e6a993a9

SmarterMail Fixes Critical Unauthenticated RCE Flaw with CVSS 9.3 Score 4 indicators · Jan 30, 2026

Domains (1)

CVE[.]org

CVEs (3)

CVE-2026-23760CVE-2026-24423CVE-2026-25067

Match Group Data Breach Exposes User Information from Tinder, Hinge, and OkCupid 2 indicators · Jan 30, 2026

Domains (2)

Match[.]commatchinternal[.]com

SolarWinds Fixes Six Critical Web Help Desk Vulnerabilities Including RCE and Auth Bypass 11 indicators · Jan 29, 2026

Domains (1)

Horizon3[.]ai

CVEs (10)

CVE-2024-28986CVE-2024-28987CVE-2024-28988CVE-2025-26399CVE-2025-40536CVE-2025-40537CVE-2025-40551CVE-2025-40552CVE-2025-40553CVE-2025-40554

Google Disrupts World’s Largest Residential Proxy Botnet 45 indicators · Jan 28, 2026

IPv4 (4)

1[.]3[.]6[.]145[.]78[.]214[.]18849[.]51[.]68[.]14360[.]2[.]1[.]3

Domains (23)

00857cca77b615c369f48ead5f8eb7f3[.]com0aa0cf0637d66c0d[.]com31d58c226fc5a0aa976e13ca9ecebcc8[.]com3k7m1n9p4q2r6s8t0v5w2x4y6z8u9[.]com442fe7151fb1e9b5[.]com6b86b273ff34fce1[.]online7x2k9n4p1q0r5s8t3v6w0y2z4u7b9[.]com8b21a945159f23b740c836eb50953818[.]com8f00b204e9800998[.]coma7b37115ce3cc2eb[.]coma8d3b9e1f5c7024d6e0b7a2c9f1d83e5[.]comaa86a52a98162b7d[.]comaf4760df2c08896a9638e26e7dd20aae[.]comb5e9a2d7f4c8e3b1a0d6f2e9c5b8a7d[.]combdrv7wlbszfotkqf[.]ukcfe47df26c8eaf0a7c136b50c703e173[.]come4f8c1b9a2d7e3f6c0b5a8d9e2f1c4d[.]comhexsdk[.]compacketsdk[.]iopacketsdk[.]netpacketsdk[.]xyzv46wd6uramzkmeeo[.]inwillmam[.]com

md5 (10)

00857cca77b615c369f48ead5f8eb7f30c855f87a7574b28df383eca5084fcdc31d58c226fc5a0aa976e13ca9ecebcc88a9bd7e7a806b2cc606b7a1d8f4956628b21a945159f23b740c836eb50953818993AE4FE78B879239BDC14DFBC0963CDa8d3b9e1f5c7024d6e0b7a2c9f1d83e5af4760df2c08896a9638e26e7dd20aaec8eb024c053f82831f2738bd48afc256cfe47df26c8eaf0a7c136b50c703e173

sha256 (6)

01ac6012d4316b68bb3165ee451f2fcc494e4e37011a73b8cf2680de3364fcf42d1891b6d0c158ad7280f0f30f3c9d913960a793c6abcda249f9c76e13014e4559cbdecfc01eba859d12fbeb48f96fe3fe841ac1aafa6bd38eff92f0dcfd4554aef34f14456358db91840c416e55acc7d10185ff2beb362ea24697d7cdad321fb0726bdd53083968870d0b147b72dad422d6d04f27cd52a7891d038ee83aef5bba9b1f4cc2c7f4aeda7a1280bbc901671f4ec3edaa17f1db676e17651e9bff5f

Bitcoin Addresses (2)

31d58c226fc5a0aa976e13ca9ecebcc83k7m1n9p4q2r6s8t0v5w2x4y6z8u9

SoundCloud Data Breach Exposes 29.8 Million User Accounts 1 indicators · Jan 28, 2026

Domains (1)

HaveIBeenPwned[.]com

Fortinet Blocks Actively Exploited FortiCloud SSO Zero-Day Until Patch is Ready 14 indicators · Jan 27, 2026

IPv4 (10)

104[.]28[.]195[.]105104[.]28[.]195[.]106104[.]28[.]212[.]114104[.]28[.]212[.]115104[.]28[.]227[.]105104[.]28[.]227[.]106104[.]28[.]244[.]114104[.]28[.]244[.]115217[.]119[.]139[.]5037[.]1[.]209[.]19

Email Addresses (2)

cloud-init@mail[.]iocloud-noc@mail[.]io

CVEs (2)

CVE-2025-59718 CVE-2026-24858

Fake Clawdbot VS Code Extension Deploys ScreenConnect RAT 24 indicators · Jan 27, 2026

IPv4 (2)

178[.]16[.]54[.]253179[.]43[.]176[.]32

Domains (6)

clawdbot[.]getintwopc[.]sitedarkgptprivate[.]comgetintwopc[.]sitemeeting[.]bulletmailer[.]netwww[.]aikido[.]devwww[.]dropbox[.]com

URLs (12)

bulletmailer[.]netdarkgptprivate[.]comdropbox[.]com/scl/fi/tmwi4j86op04r9qo2xdgh/zoomupdate[.]msi?rlkey=ymr9yn5p3q2w2l3uz9cg71dvm&ampgetintwopc[.]sitegetintwopc[.]site/config[.]jsongetintwopc[.]site/config[.]json&#x27hxxp://clawdbot[.]getintwopc[.]site/config[.]json&#x27hxxp://clawdbot[.]getintwopc[.]site/dl/Lightshot[.]dll&#x27hxxp://clawdbot[.]getintwopc[.]site/dl/Lightshot[.]exe&#x27hxxps://darkgptprivate[.]com/d111&quothxxps://www[.]aikido[.]dev/blog/fake-clawdbot-vscode-extension-malwarehxxps://www[.]dropbox[.]com/scl/fi/tmwi4j86op04r9qo2xdgh/zoomupdate[.]msi?rlkey=ymr9yn5p3q2w2l3uz9cg71dvm&st=q93av9p6&dl=1

sha256 (4)

04ef48b104d6ebd05ad70f6685ade26c1905495456f52dfe0fb42f550bd43388adbcdb613c04fd51936cb0863d2417604db0cd04792ab7cae02526d48944c77bd1e0c26774cb8beabaf64f119652719f673fb530368d5b2166178191ad5fcbeae20b920c7af988aa215c95bbaa365d005dd673544ab7e3577b60fecf11dcdea2

Chinese APT Groups Leverage PeckBirdy JavaScript C2 Framework Since 2023 2 indicators · Jan 27, 2026

IPv4 (1)

47[.]238[.]184[.]9

CVEs (1)

CVE-2020-16040

Complete Guide: Setting Up FreePBX with VPS, Docker, and VPN (CGNAT Bypass Solution) 3 indicators · Jul 17, 2025

Domains (3)

mypbx[.]pstn[.]ashburn[.]twilio[.]comtwilio[.]comyourname[.]pstn[.]ashburn[.]twilio[.]com

THIS WEEK IN SECURITY: LOOP DOS, FLIPPER RESPONDS, AND MORE! 2 indicators · Mar 22, 2024

CVEs (2)

CVE-2023-48788CVE-2024-2169

How to communicate a cyber breach to minimize reputational damage 2 indicators · Mar 22, 2024

Domains (1)

www[.]ambitiouspr[.]co[.]uk

URLs (1)

hxxps://www[.]ambitiouspr[.]co[.]uk/

New Go loader pushes Rhadamanthys stealer 3 indicators · Mar 22, 2024

Domains (2)

arnaudpairoto[.]computty[.]org

URLs (1)

arnaudpairoto[.]com

The Updated APT Playbook: Tales from the Kimsuky threat actor group 19 indicators · Mar 22, 2024

Domains (3)

00701111[.]000webhostapp[.]comgosiweb[.]gosiclass[.]comniscarea[.]com

URLs (4)

gosiclass[.]com/m/gnu/convert/html/com/list[.]php?query=6hxxp://gosiweb[.]gosiclass[.]com/m/gnu/convert/html/com/list[.]php?query=6hxxps://niscarea[.]com/in[.]php?cn=[base64]&fn=[DateTimeniscarea[.]com/in[.]php?cn=[base64

md5 (3)

364d4fdf430477222fe854b3cd5b6d4071db2ae9c36403cec1fd38864d64f239f35b05779e9538cec363ca37ab38e287

sha1 (3)

5c7b2705155023e6e438399d895d30bf924e0547b5224224fdbabdea53a91a96e9f816c6f9a8708cd4fa57f9c9e35222a8cacddc79055c1d76907fb9

sha256 (3)

c62677543eeb50e0def44fc75009a7748cdbedd0a3ccf62f50d7f219f6a5aa05da79eea1198a1a10e2ffd50fd949521632d8f252fb1aadb57a45218482b9fd89e8000ddfddbe120b5f2fb3677abbad901615d1abd01a0de204fade5d2dd5ad0d

CVEs (2)

CVE-2026-0826 CVE-2026-52806

Bitcoin Addresses (1)

364d4fdf430477222fe854b3cd5b6d40

China-Linked Group Breaches Networks via Connectwise, F5 Software Flaws 5 indicators · Mar 22, 2024

CVEs (5)

CVE-2022-0185CVE-2022-3052CVE-2023-22518CVE-2023-46747CVE-2024-1709

Endpoints vs Routes: What every API hacker needs to know 2 indicators · Feb 13, 2024

Domains (2)

u[.]iduser[.]id

Announcing cvemap from ProjectDiscovery 4 indicators · Jan 26, 2024

Domains (1)

cloud[.]projectdiscovery[.]io

URLs (2)

hxxps://cloud[.]projectdiscovery[.]io/hxxps://cloud[.]projectdiscovery[.]io/?ref=api_key

CVEs (1)

CVE-2024-21887

How to protect Evilginx using Cloudflare and HTML Obfuscation 7 indicators · Jan 26, 2024

Domains (4)

academy[.]breakdev[.]orghelp[.]evilginx[.]comindex[.]htwww[.]r-tec[.]net

URLs (3)

hxxps://academy[.]breakdev[.]org/evilginx-masteryhxxps://help[.]evilginx[.]com/docs/category/getting-startedhxxps://www[.]r-tec[.]net/r-tec-blog-evade-signature-based-phishing-detections[.]html

THE BUG HUNTERS METHODOLOGY LIVE 3 indicators · Jan 12, 2024

Domains (2)

Hunter[.]iotbhmlive[.]com

URLs (1)

hxxps://tbhmlive[.]com/

FAKING BLUETOOTH LE WITH AN NRF24L01+ MODULE 4 indicators · Jan 11, 2024

Domains (2)

hackaday[.]iowww[.]sparkfun[.]com

URLs (2)

hxxps://hackaday[.]io/project/162131-graphical-pinout-generator/hxxps://www[.]sparkfun[.]com/news/1947

Review: Engineering-grade OT security: A manager’s guide 2 indicators · Jan 11, 2024

CVEs (2)