Skip to content
Bulwark BlackBulwark Black LLC
Latest
Midnight Mimosa Shows Why Cheap Android Devices Need Supply-Chain ControlsAI-Analysis Evasion Shows Why Malware Triage Needs Prompt BoundariesWeb3 C2 Shows Why Build Pipelines Need Egress ControlsAI Agent Swarms Turn Security Basics Into Cost ControlsQ3 Attack Trends Show Trusted Paths Are Becoming the Real TargetFortiBleed Shows Why VPN Credential Compromise Needs Full Incident ResponseGitHub Enterprise SSRF Shows Why Secret Scanning Needs Network GuardrailsBlinder Tunnel Shows How Developer Trust Becomes Critical Infrastructure RiskBrowser Detection and Response Shows Why the Browser Is Now a Security Blind SpotApache Struts REST Plugin Flaws Show Why Legacy Java Apps Need Exposure ReviewClingSTUN Shows Why IoT Edge Devices Need Real Egress MonitoringApache Thrift 61-CVE Patch Shows Why RPC Frameworks Need InventoryNIST OT Zero Trust Guidance Shows Segmentation Must Reach Below Level 3Milk Dragon Shows Social Commerce Phishing Needs Identity and Payment Controls

Threat Intelligence

Indicator Database

Current article-derived observations, grouped by report. Search by value or report, filter by type, and jump straight to the source. Aged provider-supported observations receive one final check from every applicable, enabled service before archival. A fresh qualifying positive keeps an aged value in the current view; incomplete, unavailable, or review results remain in the revalidation queue. These lifecycle labels are not universal maliciousness or clean verdicts. Values are defanged.

3266 current observations · 3061 unique values · 231 reports· 3054 in-window · 7 provider-active holds

Current observations (3061)Revalidation queue (1741) ↓IOC Archive (1116) →

Reporting windows: IP/CIDR 14 days · domains/URLs 30 days · file identifiers 730 days · other context 90 days. Context-only types without an applicable exact provider check remain recency-only. Feed admission remains a separate policy and is independently verified.

Explore Campaign Constellation →

Analysis artifacts:YARA analysis artifact (.yar)Domains · IPs · URLs · Hashes · CSV · JSON →

231 reports

Midnight Mimosa Shows Why Cheap Android Devices Need Supply-Chain Controls158 indicators · Oct 8, 2026

Domains (26)

0aa0cf0637d66c0d[.]com442fe7151fb1e9b5[.]com5[.]ahd187[.]comaa86a52a98162b7d[.]comahd187[.]comapi[.]weatherlive[.]worldcgb[.]jingongbuxiao[.]comcom[.]ads[.]calcom[.]android[.]gallerycom[.]audify[.]editor[.]procom[.]dmstudio[.]weathercom[.]fb[.]w[.]weathercom[.]mobile[.]applock[.]tgcom[.]yun[.]wth[.]erfyapi[.]freeflightbird[.]comkwlib[.]nextnewsadapi[.]zhuifengzhe[.]topoeawmfedpcleaih9[.]apple[.]0aa0cf0637d66c0d[.]comoeawmfedpcleaih9[.]apple[.]442fe7151fb1e9b5[.]comorg[.]life[.]goal[.]toolsoss[.]showtimetool[.]comshowtimetool[.]comv46wd6uramzkmeeo[.]inw[.]postweatherlive[.]worldzhuifengzhe[.]top

URLs (2)

hxxps://api[.]weatherlive[.]world/br_upgrade/upgradeV2/getConfigshxxps://oss[.]showtimetool[.]com/[.][.][.]png

md5 (127)

0377ca97ac0ca35f9134052fede67a8105ae89e761a890fa24f80f4be7263651079298a7a506b376def4f4ff9a25067208d231c6a5303e543eb60d4181f6a4ea0903d7fd3e1d4a599a7eb3c5d356779b0a26a9d5f7ab91cb5eed852cf83ef0780b0d8e995e6ff24d4e9d00417446c25e0b8d3cd264c191f4884a25d0cc5318b51150da1af88729e54a34b8da5a2741c71414d4ef2d1191080abc59a407dcb6c5145b806282d247441751bb4957b716061da42505f1c83959c7f901f5139a158e20108557cacd24263e7e611afc32780120cefb2c667f945d482daded7e698eea250205ee4b8de59e60c745856f439608254bc5f6f81de1f3c47534e6febaf023294ab3f586d76772ae89add417cf63242b784622422f4280e0b3e38b30dd87bc2b7f1a7d5f5515c05d0c8e3857155ae22c77653b889dfccd649b82446f8c0d1b2de346602433cdd1668f36b2e9db0be131b3280f1c0836c39c470932cf6c3e6f33b2d3ec9a35cfb0b5a5d7b24ce4140e345057421c7d9ac2b671c47449f3503036deebfcda4012d18706cd170c1edf1f36f9e8cf47a28f9803fba427cf02a25c37f18a20b9cf32e6f07450e903eaad7c387f7af167530486adcf3d85460634623b20edff1125e146aa3d5153708b58f43b35d3c5667136134b20a8411803c97d3bb270d4927e2a8385793d9084a92fd33bc159537c909fa86bcc55eda127b5aa3c098465af131141996ff840bd34e7913d3358b1057b1bfbd7e60577d8a31e0c42a9f64e75911c167ec7a163e8b249204507363415e7dc6d2cab14eeed137f6c4521a5bbe0f33a15da86bd80ff5d6d9c4a171f62d1bab01827b06ae73d4caafa4e46549122c0236307c5eef8891466f54f7d3c5859100d65ff02449884841b9c50e9cdc3ed145bbc688356eda07f8eb3512a6db4a22244272826f39da020fb445400ffac371c5e5c9b7f3705ce9faca5542ab80429ec42e8643dc645f58b716c5b3a49938f455d1197736971c4c072285d29e9b24708c3ec36d1d5903612483860bc23d3d453f258e2c4ca421cd086a961aac6a98abd6dcff0dc41bb88159786642d84ed5660407b972f1df642acb19266c6512b9a73425aba40c8bfa95d23a06739fe083cfa8dec9b4f989ccba0e99e6aca76699ec0bb8e51372d5c68c8359b6df909898f5f1394e78508d1152fab386ee2be3e5558085b532dacc8db61f3e96eea0568d5cc776ae03e09149cec3cd87322d8a65a56a7ab09f4d526cb343e3d7400c34f7c6f866499029f5e759f58bd7469c9c06e5f324ca608e0140156bbad765d3ce85a6393d05973c4cfa77381167f7747575980098bdc98e7b7aa362697815b910f1efc95f38ba0c5b12c4f2129836739fe7196437d8e998245b6f2b3b4838dc8fcde1b28171e404ece1cfcde44879168159c155758dbfd7a76e8f215488ec360829f4f7ae8dcae47c02b99676290e0d27d808105167fdaa3a22b91821792390cacdd20d2ee5405093669e7302c92f2fd8bcccc8ec4ffa64c7f6b3b9b8d998e9010e5dfc4e4645f5572cbbe5b539a3d04aa36654b5c4b21edd22e46f92d9a46098de785ae732e5fced55a2f30639e7b34e63d8d38e37667f88a945ae69a9f1e2249003ab22cf8a38048e0ff6f6ca02f28387527abe90d73d2879f671972a13af0174bc211709e8b73bf60492a17a147cd8f72aadfcf78f7723db6813e86a57a1ba15364dfb35d334f644d7049e8a8847b68428fde206b6dff8001051f92aac942aaf6ec0773cbac87fde4a6b284ab8d6be686ca9413e27a11e85f9cef1aabe12db77a62ecb99d6ab5dc4fff18c7ac8957a474f8aa812c7b233aafde4723af16072864ae0f9d755f8cf00fded359af7f1eef22bf5ee3d0a394f53ba7e1b8b3a4405d1b8d43545d07b10581008d32b6c5f7dfaf9d47cd67380a48df5e1731b7d0d5ae09b0d2d2f999c1087c450456b862681953e945439167a736ba4cd41bb974ef4106af6b932df352563a9b8b3cbe22c91b4578ac2357a16133615df335c55c9d7e12cc273b812ceffca8f62d4bc75ec7f3bcbc879aae9a21ad544d3232c8ea2a7c1f52c4c2474475c28373ee27ca7e2d265fc35aede432c4636a2cf4cbcb19dbf279a3488aec76c17e8e122c14cde0490e11db8ad54737c1df59ec658bcdfcc848e16660d607aba6ecf24567f4cf20de9d9ddc952bb2265002d26a916fcf4f24fdd283f80313565b08fea9d06dd145b14b9cc15799485f2592b2c16d9ad3faec4f013c4a1e84a1d681448312c0d4ceb05682ecd60f4ebb4e76e02fcf7dd56158a2cc8d13778df850907733b2c4d5d88214170875386ab855172f881e51d6ba4044f9d57f7e86d83187982ed593d9fc6b2cd5eaa3929207f1029663d947da67e37be01c20566990152ecfb14ed1dce5b0dc0e7d7059b5ab8384a7c24ec4de66cac88f156c3227749e03bdf7cf54e250e5966c119a9098f7818fc6c080e5e39bddf592016ad6d0784770df3e2ffee51c11442a529dcd06dc7c8e45974ec2e6650dc6721aaa27f8a289ff92e613ffe75e183027bf897eda6447366c7acd01e7c56b4f580da53cd0e4f11d1a11e402e974cf4cc5d55cddc04f026dd3ea72b8e9b91e1d94bb3ff9a1c00b1c13eb7960e9ec6d7b50c1e54cd523283b9de55e10ed1a6bed83899952b464c27aef9752ccee4e778e53ce4d4339d7c7888d06384dee70ec99121f4d7c8b5a883e5ab3a858f0b7b1c940ebcee97eb68f528682fc50f456f0c6b89bd3d5124699d43971d094f602230f54507cbddf5ef3014737d768fac6548a4a7a88156468b809c4f877f5fc812444baa071f5141ddad812d673defcb9f38cc687fc8a4637e0acdf91ab66

IPv4:Port (3)

120[.]78[.]215[.]151:8039[.]96[.]8[.]180:900885[.]17[.]70[.]38:6000
AI-Analysis Evasion Shows Why Malware Triage Needs Prompt Boundaries12 indicators · Oct 8, 2026

sha256 (11)

2aa7f13bf474e2ce5049fd4db2bf4da04b4ce51ac0d36dceb24865255241c9372e3e1bcd44cc3cbec4f5ca9991d14a326d3cc6bf76fe6e0d434c9b5f7e1ae6ab34098fe0bc4c69c4c4eb3f74688fb375326804536d25e5574e8c4c28c113b5c3389066bd5543aeea363d23a4dce7f7a21c7f2c73c61f506a93a69f594cf48ecf5f60d16fa67ff8ef07817c33b7e6b7fa91c6c21060020df46b1f5c56e076e2597dd3747d777f9576a11004532b463351e7718b6af193d8ee7221ac41479d199aa0294f7152f9c4c908e9def58279e9fa29952715947c950c8489949f26a15cc8a42632c68d2dcea06300e790c9440fe0943ce0dee2075f29170fd2774eacf433bacb5794a300f7a88c7f6d458382eb11d2f39c0f496b509ca512afe8588fc33fc17bf76d02163863c251c3bb3a12725eeb525fab5522521923925e0469ca269ff8f5e0440c57c7deffd75ca33e2511867039796aa803e7ef847396a379188a7d

CVEs (1)

CVE-2015-2291
FortiBleed Shows Why VPN Credential Compromise Needs Full Incident Response24 indicators · Oct 6, 2026

IPv4 (20)

103[.]27[.]186[.]156104[.]28[.]155[.]27154[.]202[.]59[.]169185[.]136[.]15[.]43185[.]136[.]15[.]66185[.]199[.]199[.]56193[.]8[.]186[.]33193[.]8[.]187[.]2193[.]8[.]187[.]4245[.]154[.]12[.]13245[.]155[.]250[.]15845[.]227[.]254[.]21066[.]175[.]220[.]11177[.]91[.]118[.]1080[.]75[.]212[.]11385[.]11[.]187[.]887[.]251[.]64[.]1387[.]251[.]64[.]1687[.]251[.]64[.]1787[.]251[.]64[.]44

Domains (2)

socradar[.]iowww[.]cloudsek[.]com

URLs (2)

hxxps://socradar[.]io/blog/fortibleed-fortinet-firewalls-compromised/hxxps://www[.]cloudsek[.]com/blog/inside-the-fortibleed-open-directory-a-technical-analysis-of-what-the-
Blinder Tunnel Shows How Developer Trust Becomes Critical Infrastructure Risk26 indicators · Oct 6, 2026

IPv4 (4)

38[.]180[.]136[.]12765[.]109[.]214[.]14587[.]248[.]129[.]23991[.]107[.]156[.]29

Domains (10)

asdfafadafg[.]onlinecloud[.]g-drive[.]camdrivegoogel[.]camg-drive[.]camgoogeldrive[.]camgoogelmeet[.]onlinemeetonline[.]cammusicdel[.]irns1[.]soroshpasargad[.]comportal[.]sharjahairport[.]cloud

URLs (2)

hxxps://github[.]com/GreenBeret0hxxps://github[.]com/peakyblinders-tm

sha256 (8)

3fd810a3aa0039993393741b32287c367a9a5037a41e826906440887cdd3ed1353f35e49eb9b271fd8cbcd3daacb525328dbf159a03dbd1c7adebe0363daa4026e7d9b33f1e72ea1ede71373a604ecdb060dab7d42055179c1eede9ecd1fd23976273382e4252c1f60a2251141e108942494409c759358320735891762c0682e7cc571aca6d8715d9aaad3d83e1bcd30467565d583db1dfe73697c5d00a1f875d3561bd4aad003dc3e08157b0891860bb496b80cd6e44901692e08ab1d4e8260f5b12772db6817f7a765a6fe7565fd3d4f87edc28e42fe3ec0244a372a410fc9f5ba1645694c62f527ed6ceda8c68a5c3dd92b4032439167e8e937e72803b4bd

CVEs (2)

CVE-2026-88771CVE-2026-88772
Apache Thrift 61-CVE Patch Shows Why RPC Frameworks Need Inventory126 indicators · Oct 4, 2026

Domains (3)

computation[.]runlists[.]apache[.]orgwww[.]cve[.]org

URLs (62)

hxxps://lists[.]apache[.]org/thread/1rpq0d0g6yzjjzl1z27lwmvhzkn6rbrshxxps://lists[.]apache[.]org/thread/1zdvscq7p3hf3z30s26h4tm9dvljm1jjhxxps://lists[.]apache[.]org/thread/33otcgbqd27wf6qq810q56znzbomnhg1hxxps://lists[.]apache[.]org/thread/35831rngzrqky1gvc32t06psgq1b8441hxxps://lists[.]apache[.]org/thread/3wmvtvv56rky5wtszn4zr8w12kg928qnhxxps://lists[.]apache[.]org/thread/52gwhsy947hj9qhgn0dql726z1q927g4hxxps://lists[.]apache[.]org/thread/5hjh0gz8wf6bo7ydxjpqj92m42hwmfo8hxxps://lists[.]apache[.]org/thread/5okpz47dv8hy0s3r6tmrplg3y7jzhhywhxxps://lists[.]apache[.]org/thread/5tjwbbyympbj16lblocv9b12s32sg113hxxps://lists[.]apache[.]org/thread/64y7f0b89mnq4xoqcn4h26to8kskolgchxxps://lists[.]apache[.]org/thread/6hxll1jcnod9gfr225tz7my08lpj3jmthxxps://lists[.]apache[.]org/thread/6kl6g40tpl8zt3opd8fwn6bsgyddzhd5hxxps://lists[.]apache[.]org/thread/7c23sgowkb3ssmolqofqsn8wzsddvf33hxxps://lists[.]apache[.]org/thread/7o985t84551tpo55v6fsd3g42gs3zps1hxxps://lists[.]apache[.]org/thread/7xqf651pvjykw0xr9vw0ooz0bwx7wzy7hxxps://lists[.]apache[.]org/thread/8y04vvxw7ozxxh3c44vhoy7jsd6bonzqhxxps://lists[.]apache[.]org/thread/8zbv1y4wzr3nn5mzmdph7b0n6tm0lc4mhxxps://lists[.]apache[.]org/thread/9353rb8mpoq4ltff88h1j2y3hfy6blgbhxxps://lists[.]apache[.]org/thread/94cvvzzl0rh707bn2j4zt844v547508ghxxps://lists[.]apache[.]org/thread/971572orz86jdwlg58wqv8o50oqqb143hxxps://lists[.]apache[.]org/thread/9d51ygo6hrsdo5ndwckbwt3mnp290m57hxxps://lists[.]apache[.]org/thread/b4rrkrwoyqb9g7hk58d3fx09cbvp1tg9hxxps://lists[.]apache[.]org/thread/bf12g1b11r4x9x3wsy4mgwfgd0t779h7hxxps://lists[.]apache[.]org/thread/bjor9ttx7hk23gzcx60ohz0f20xzvgv0hxxps://lists[.]apache[.]org/thread/c7f9g4027ok0gocyso2y84r2mhgc2xmyhxxps://lists[.]apache[.]org/thread/cxkbblyht7988p2o6yvnmd6536qmt88khxxps://lists[.]apache[.]org/thread/dgy8ox9t4bh1xhf74ovf29ht87x7dno4hxxps://lists[.]apache[.]org/thread/f9w4q6ttlc3k9404x4do25gdhqodtjnnhxxps://lists[.]apache[.]org/thread/hrgcqlms4ksrz4qkqdjwoxxggdty7dghhxxps://lists[.]apache[.]org/thread/hv6b1nyk2p15gy5pmtprwo7z9m46mfcxhxxps://lists[.]apache[.]org/thread/k14jfr1xwc0vtmm2s7xro6lt7q4y6s7mhxxps://lists[.]apache[.]org/thread/k1t5r9sz7k5tn57cnf5khw2ywlxv6098hxxps://lists[.]apache[.]org/thread/kv1zkwlt82lkkv20g29txr5pjnvo0pf8hxxps://lists[.]apache[.]org/thread/kx3xdttoypl8j4dcxmqbq9dwy1w0kr7jhxxps://lists[.]apache[.]org/thread/l2rgp3dqhpy2w347forzdt9g7o2d6k0dhxxps://lists[.]apache[.]org/thread/lg97w2yvg3c6z06l8m5xs3j3v2m6mvj8hxxps://lists[.]apache[.]org/thread/lpcmo2xjfyfww474xdyyfypkqthk9s14hxxps://lists[.]apache[.]org/thread/n9rogg2166hl9y4ycq5njpvnxndr8y5ohxxps://lists[.]apache[.]org/thread/nodwz7gjvogkkh3w1jwbsslk1c7t0727hxxps://lists[.]apache[.]org/thread/nxlmlhgsh7fwr4mo1fkhtkw3v266qhcxhxxps://lists[.]apache[.]org/thread/o5386v7ytbbjv9sx7dbszw46ypod5yd9hxxps://lists[.]apache[.]org/thread/oqr0h2k1cg9hho3oh8trmovmxc04fl5mhxxps://lists[.]apache[.]org/thread/ow8994gb5g8ssmmbkbl48xqb0tpvqyr3hxxps://lists[.]apache[.]org/thread/p96mokqfy16mnqfyon46mf6g8nr9ghb6hxxps://lists[.]apache[.]org/thread/poskkt3p754b2f293g63934hw160o86jhxxps://lists[.]apache[.]org/thread/rbpwlhlxnv2qgyk8cfscp2d2fd3p0ojbhxxps://lists[.]apache[.]org/thread/rflzpdvtk8yhpzg99wkf5yf277nn7267hxxps://lists[.]apache[.]org/thread/rm0m34gt6fh1flvt16wty559hfg191qrhxxps://lists[.]apache[.]org/thread/ro1y0ckzfzcc45yk9qkt1p6t4g2jvrfyhxxps://lists[.]apache[.]org/thread/s8fjltl6c1pkm7vg9v4qkr89b5b74jbghxxps://lists[.]apache[.]org/thread/shy1rrm2g383wlbdb2p7w19c868ntdjphxxps://lists[.]apache[.]org/thread/tcg16jr59z5nry066dw7ym60vl25dxt9hxxps://lists[.]apache[.]org/thread/v60w786pqr7njzz9425grby8yjrgmbsjhxxps://lists[.]apache[.]org/thread/vxnk7cmdtoqjn97b8szlqym1mxx0xtzbhxxps://lists[.]apache[.]org/thread/wdjyf4y115ybgdzz5m3gspo97lcmz1dthxxps://lists[.]apache[.]org/thread/xckvfky30kdnk8vqnhy0wndthvc9nymphxxps://lists[.]apache[.]org/thread/y05tvpv19ow44j16gtbcy9ht7lb0qjpyhxxps://lists[.]apache[.]org/thread/yjz317wq7h86q9k8ws6ton0ojgl8hjcthxxps://lists[.]apache[.]org/thread/zcgm7lx6037lvgvn87rc1tj3p0zhv371hxxps://lists[.]apache[.]org/thread/zf8ppfpl6nqhp53sxnz6osnjw93g9fw2hxxps://lists[.]apache[.]org/thread/zjv6hjmhl4tb4l4l1dk4bmc2whxh0lb4hxxps://www[.]cve[.]org/CVERecord?id=

CVEs (61)

CVE-2026-61373CVE-2026-61374CVE-2026-63772CVE-2026-66054CVE-2026-66055CVE-2026-66081CVE-2026-66331CVE-2026-66837CVE-2026-66858CVE-2026-66859CVE-2026-82458CVE-2026-82459CVE-2026-83632CVE-2026-83663CVE-2026-83745CVE-2026-85086CVE-2026-85087CVE-2026-85088CVE-2026-85476CVE-2026-85483CVE-2026-85493CVE-2026-85494CVE-2026-86535CVE-2026-86536CVE-2026-86537CVE-2026-87117CVE-2026-90440CVE-2026-91135CVE-2026-91137CVE-2026-92834CVE-2026-93925CVE-2026-93926CVE-2026-94633CVE-2026-94634CVE-2026-94635CVE-2026-94636CVE-2026-94637CVE-2026-94638CVE-2026-94639CVE-2026-94642CVE-2026-94644CVE-2026-94645CVE-2026-94646CVE-2026-94648CVE-2026-94650CVE-2026-94651CVE-2026-94652CVE-2026-94653CVE-2026-94654CVE-2026-94655CVE-2026-94656CVE-2026-94657CVE-2026-94658CVE-2026-96277CVE-2026-96286CVE-2026-96287CVE-2026-96288CVE-2026-96289CVE-2026-96292CVE-2026-96294CVE-2026-96990
Antino Backdoor Shows Why Microsoft 365 C2 Needs Cloud-Aware Detection157 indicators · Oct 2, 2026

IPv4 (1)

103[.]27[.]110[.]220

Domains (23)

d2nq35tel3ucuo[.]cloudfront[.]netd32tpl7xt7175h[.]cloudfront[.]netlogin[.]microsoftonline[.]commicrosoft-flash[.]commy-3lyt6wcp[.]pages[.]devmy-662ylt3w[.]pages[.]devmy-6g16qsfe[.]pages[.]devmy-goq6xmbm[.]pages[.]devmy-h3qli6kq[.]pages[.]devmy-qc39r814[.]pages[.]devmy-sv7c1fzs[.]pages[.]devmy-u0up9qri[.]pages[.]devmy-vtsdod2n[.]pages[.]devmy-wgoxp32b[.]pages[.]devoisadjfoinsiduhfnoisdnfosdnoifnsoid[.]pages[.]devosc-cdn[.]compage[.]devpub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]devpub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]devr2[.]devrsproxy[.]cnwps-cn[.]comwww[.]wps-cn[.]com

URLs (68)

hxxp://d2nq35tel3ucuo[.]cloudfront[.]net/4oyE4n4ozLQ0[.]loghxxp://d2nq35tel3ucuo[.]cloudfront[.]net/LtVGUSsyUTDA[.]loghxxp://d2nq35tel3ucuo[.]cloudfront[.]net/TzzyYlYnJ40Z[.]loghxxp://d2nq35tel3ucuo[.]cloudfront[.]net/tdyvHHVcrci8[.]loghxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/5SVIdjpRQjkZhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/5TGrbjCCLa8Mhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/5U7kzhvlYlVFhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/6HJV5qV5BTLshxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/BKvYRxPiGpbMhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/HenUWB51MwpGhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/MKJacn3hFt3Yhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/PbyfSk69AwVfhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/byrdvvZEZZlkhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/cX8MChhuVvzzhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/icWMOGLJcfQOhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/nswz3cb9lhuChxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/q9LgxIaU1CJKhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/qMD71Z95clTfhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/s0p18dgHR4PZhxxp://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/zlKDeyO3HuUShxxp://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/Qw7Womin4X6Nhxxp://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/kVFPxm1uAjOYhxxps://d2nq35tel3ucuo[.]cloudfront[.]net/9q9OlLKCm0an2ct1[.]jshxxps://d2nq35tel3ucuo[.]cloudfront[.]net/HsOw0YU9s11dxyr1[.]txthxxps://d2nq35tel3ucuo[.]cloudfront[.]net/LwqPW64Xl0ti3q7s[.]txthxxps://microsoft-flash[.]com/download/flashcenter_pp_ax_install_en[.]exehxxps://my-662ylt3w[.]pages[.]dev/Institutional_Disciplinary_Action_Report_May_2026[.]htahxxps://my-662ylt3w[.]pages[.]dev/Institutional_Disciplinary_Action_Report_May_2026[.]wsfhxxps://my-6g16qsfe[.]pages[.]dev/the%20May%2027%20inauguration%20of%20the%20TPiE[.]htahxxps://my-6g16qsfe[.]pages[.]dev/the%20May%2027%20inauguration%20of%20the%20TPiE[.]wsfhxxps://my-goq6xmbm[.]pages[.]dev/Tehran_Bilateral_Summit_Proceedings_May2026[.]htahxxps://my-goq6xmbm[.]pages[.]dev/Tehran_Bilateral_Summit_Proceedings_May2026[.]wsfhxxps://my-h3qli6kq[.]pages[.]dev/CrossBorder_Repression_Seminar_Agenda[.]htahxxps://my-h3qli6kq[.]pages[.]dev/CrossBorder_Repression_Seminar_Agenda[.]wsfhxxps://my-sv7c1fzs[.]pages[.]dev/Extravaganza%20Latin%20Carnival[.]htahxxps://my-sv7c1fzs[.]pages[.]dev/Extravaganza%20Latin%20Carnival[.]wsfhxxps://my-u0up9qri[.]pages[.]dev/UO%20-C-DAC%20%281%29[.]htahxxps://my-u0up9qri[.]pages[.]dev/UO%20-C-DAC%20%281%29[.]wsfhxxps://my-vtsdod2n[.]pages[.]dev/Extravaganza%20Latin%20Carnival%20post%20copy[.]htahxxps://my-vtsdod2n[.]pages[.]dev/Extravaganza%20Latin%20Carnival%20post%20copy[.]wsfhxxps://my-wgoxp32b[.]pages[.]dev/Internal_Review_Dossier_0520[.]htahxxps://my-wgoxp32b[.]pages[.]dev/Internal_Review_Dossier_0520[.]wsfhxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/7ChyKauxbnufxp68[.]jshxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/AcPP9fCvdjztmho8[.]txthxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/KOOOT4a76st012bx[.]txthxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/Ub4RJzNIrfleri8t[.]txthxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/VD7F3WxnGatherOsState[.]exe[.]mtmhxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/VD7F3WxnOsState[.]dat[.]pgyhxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/VD7F3Wxnslc[.]dll[.]fschxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/bzP3NcRPGatherOsState[.]exe[.]thlhxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/bzP3NcRPOsState[.]dat[.]mxbhxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/bzP3NcRPslc[.]dll[.]czhhxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/oaFE7PJHk0h_emqt[.]txthxxps://pub-0173d1566dcd4fd49fa25f11f14bfe4c[.]r2[.]dev/vD68BdmB2ky28gcc[.]jshxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/0u25lAqY58or53ra[.]jshxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/2laZiB2zvnx04jze[.]jshxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/8ypvQLxJvggmrz94[.]txthxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/HeiqAW6ZGatherOsState[.]exe[.]luyhxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/HeiqAW6ZOsGather[.]dat[.]sykhxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/HeiqAW6Zslc[.]dll[.]pzshxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/HzjNPgRE9ir92e38[.]txthxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/ThyI9pwewrh_a1pr[.]txthxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/gpv0IRMtvto6e8t2[.]txthxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/hjgzBskgGatherOsState[.]exe[.]lzjhxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/hjgzBskgOsGather[.]dat[.]aelhxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/hjgzBskgslc[.]dll[.]iwqhxxps://pub-abfa7742e315485a98a5fafd6dbfb68e[.]r2[.]dev/wyLwwCu43j1wf2pg[.]jshxxps://www[.]wps-cn[.]com/downloads/flashcenter_pp_ax_install_en[.]exe

md5 (2)

0173d1566dcd4fd49fa25f11f14bfe4cabfa7742e315485a98a5fafd6dbfb68e

sha256 (63)

01b5c6acb20e41799a0e96d9d1d6e1c44791883706b6285e874fcb15cc93b31a077bd873217d8abfbb6482d11966ca34f3fef7ad5166f24fbc5dc3ddefe894a1079acd58a74479ac8b108b618d2a4da8a8bd560a04459cd90e2fec9da502751309ef7c736bccfafefc44d9910d499173b88063b73b221fc0dc9e9105107e5cff0a6fb71ab1362d065c7ec2678c1e73d9a0721b0e7099d392ba7559bb2eec49700b4e5e017c0f0ccac79e13ca5d580a75af67a24ca0763f9ebfdaaeb1ba4fc7390c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd131ac3e0df777910e0a32e43d5744bccb0490750d4c2adc359da41d76d383c46133a46ba41136ca21c93fb08c28446826d8c0d9b7923a16f2d152d595a710098170b0eee60a335f32c1d0c19a0bb8d8bbc0a5b298ea9486b546f58d25cc8a46417b53ffa8e005f0e82491d3f9c0a4984c44da52e1668a855c11a137f627c5b4b1fadc90b61ce536abda78eb387a7f3d745f00c16775d3f762845ccc0fde567da23d5f1af8581ae200615d9a66d539f2043c3248b649e862557b379d7e8b7a3ac2f1513c822af0c6635dd3c69dc38f0b2f6e02012ea36415fff111a5d4d5fae05334f39279ff3aae40fe74340c887ae018c75bc42790586bdf9070adb5889100c3a4c9020eeb5ef22a1ff443e606ccb6705fe287c583121c713d2c9f9f1f2a2af3a94910eb8022592ce030e6861359f7e980fc1b5a6ccd290cbb071d3e95ed02a40e7e77aff603f4c2ef17b3bc8ea836e714d0734a1e5b946e52f95536ec5c91d47f98dfe01759a464e22d5ec55d012dccb38ce010dd73e3ba8d7ffefca12b4b2484ab497072ea09f12187b349f5b1c80754e4942408a009cccb20a2a3c8c65064b614e5c37abaddca162119e42a969945caa681305e246e0ed0060ea9984008b4d0fdce4c098635fe9b296c3a82c74645f9885eb5e383aa44a0fe7e50da3ca3f5168a2696a0ed858f996f388bfe94f952d475158f4ee6206816608936db005ca5555e904101689351a2a1359c9c06da0a57139a9470df7d26823c1b75db550415a35fcd4458e808ab0fa52bb2a92923b60566ee4d7aaadaac7c95cad3d8395625c5c060b272cd4a5c3767edc0e9478bd35b7e1756e183d0446a5491bd65519cb61a8f5add6c35f99c389012dbb2343061fd0b54611b40490b9a7f0b49d707da065f4b9292e91abfa5adf42a03526932930c1c0a436bb186a7948fe67702957886a1dbbfcfe6867ac83d35012b2717084388b4a34707efd0b725466dfd0e8fa56747b1d13bdf06956b5da5f47250fefd5284ebcf7961971732c3d348aa1a2d53375c12795016ae48b1bddd34a9f5adea63a12f58701eae01e1b4ab3d9dfa1513c7969ae5f11fc163049c8eadba06f814f5edece13a707e6087c1c49011a45b8387c2ac9c040b3300bffa7d2e435dbb1bc12e7efd644d2216d603c72121266395c7fa98efba59614cec0b7291aedee98764f8dc037b6cc798c93951a31208e9e328e1d68906d6de92f359945d3a95da1480e72773a3e8dea7682d6bf0f6699f75f971cb2448b5d67dcc1f5eaa10d12e77f213035ad31230dc2ac7a510610a2059d9b7df409c9a89f7536d3ba7b6d43fb6dbac618c8bb52615ba34cc971ad71bbf39fc50cf28f86201fda8306926817b1ede41fdd993202515905dd072f6803542fa0e91085f08956a9a7034ace73cee60cb211f5d96f02bc91a026601bde8f2221a13182699a12a8dd9d07c336dbd8de5e9b086b9b09793b7de2e9761aa03ce1dcad0bd2b45e2416fb1384bf30af068d857e7c06b4226615d66b55b610a34c5670ae1b45fb56b9f1b9cb3ee30d2bb1279c9b90b70bb62f8de305d198c6a4e0585eaea5e9029f9212d05bde10f7806d1f2819be45d167e6fd877b9fb1b11088ac90b31ca75f73a9363b0e35042a41216c3f581eaa0b9cd78cb58f089c2e40babd40b3416726a064dd7f657bbb400adeb365eea7f8bb60783ad2d9da1a1d93768731b75492466462141c56d97b705f0c606faf272577631dc2822aa8d6bda53633b6b8e6e83a73e6e07f8873c364dd2a4b830bceb60758163e2efcd7e387cb604655b90a4e770869c28fd2140acb3ebdc50c113bb6f096b4bbdb9ac87c349c70e85ebd8ddc8f33e0fe43147ee6f1713654996420a27c5d2cd91751ad67124ebc6fe4c8e1239d7276178b6620f47ec4880494be1cb394477b223fc54bffb0947bff50ca14ad0344dc7216f6da29a5cbe4237d886cc5257e8c3a48fb4885a311c9b800cd3509fa82e506cc6f2eeafa0a45d4b8b76a07edadd29779daf00568febcaba7d4cb2f5df16ec9b9c5b796ae55848534e15d4f8b8806f0431108fc7a99a2548ad753a615aedf8e58ffc75b2b7ebd320c0cbe6bcb5cbb885db749a2a85c55d3bfd87201c1299a7f5854929645e6891c6c424d2a690031272bedacba7c5fe73a3ee2eb7703047b37b28dc34e6990205d758a2454b39bc655b460606745fadcb530e2f59d8d5a81583ed482b6c7bf37699efdb2264e452cf7d8cfc0c54dfbd9ab3fe6ff096a0562c0042b09d250bd60272ffcd8d72bd95c563842acf765a8dc8bcfe7e3b0bcd6798634adf8b49d305f3a7b7682e4b76db549682a183c5a186df4bbe809da86bd81463347fa7f922d3e088755a94a331889d32acb55aa8f57778a34f0c1dc6d6daa4d010932c7818ed5f22929c182f58e5f495fabe2fb3cfc835b97f1ef5fe4c0cdcff13cc750c867728b89719f81437bdc49041edd1ae1f3edb4e8fdbd047031c13a17c9f491c9355f44d587584ebe2b8927be8482e6c236c8e1c1
FortiMail Zero-Day Shows Email Security Appliances Need Incident Response17 indicators · Oct 1, 2026

IPv4 (2)

45[.]129[.]0[.]19279[.]141[.]169[.]187

md5 (7)

49a7156a7d043cc8f9f680579db22f865241738a3e9988404239e12243f6d35b61af1c4bce1c2eebc8ff689ca533779164c90a00c7fda4d5c7973ed64c25783a8eb64f25d2a8e18e05aae058629473cfae0ea6502d3fa5f0664bceb73189eb54f90fa81a5f521d785f2b2f765e3ab897

sha256 (7)

4000276a150a165d3c2537d1e19fb393c4de8333076a16655e28059cae82157b703e97c64e61e41dc3aaba580d82bb2aa7b6a11b54ee6fb467ed5d5a3bffdef577324ac428bde86d351fc5fc06f6d64a6bfe737dfb2743df1d4c5ac2418a5b6a7a6cea9f5c9e2e9994d4e3c4da73f86cf5acd05ea5d312c066c9d1dafd69ee388015f34dc84922b03688399d7f9fe7a00361789f7e420c7e2a2cdb23e75cef848953ec7960b09f544a880b072ad4e6cfda7a8303f486251d3478dcfdfbac23b6d6fe51c22b91776f4c961ea58bcac5917f15d560a619d7ce726d3d51795609d3

CVEs (1)

CVE-2026-104286
DragonForce TURN and MQTT Backdoors Show Why Ransomware Defense Needs Egress Visibility14 indicators · Oct 1, 2026

IPv4 (1)

188[.]190[.]4[.]111

Domains (2)

printpro[.]comwhapido[.]com

URLs (2)

hxxp://188[.]190[.]4[.]111/25vtps[.]txthxxp://188[.]190[.]4[.]111/dldwuibjn_chShllcodeTrn[.]txt

sha256 (7)

01d638ddd9d780e934305422bc9ee8fa3a5b3163ba66514ae5e5a34ff24df9db1657b22a553feae422dab77886ac60c06b8fad7cbd2cfaf482ba9066ba9922be5275579f539812ff66d060e12c9b7e99a22c625018f1aae9c5642ab0ba058ccb6bbf10bcbef7ac5102b54c81137859891a3802dbacd888be90f990d50e18b0b4c91852bfb8f1d428875595c14cfada8fb234483adb8c6ba78ca2b5ae2a0683e2e9cd052f2d9514d40235ec04c9592f4274d0a4161b846e59bbb5a1a2c806a1c5f8eabae53e9dc8c529b6e38c58040ff28a07728cb5e896e16fb64e84bed5cd88

IPv4:Port (2)

217[.]156[.]8[.]181:758662[.]164[.]177[.]145:3478
TA419 Shows AI Policy Is Now an Espionage Phishing Target24 indicators · Oct 1, 2026

IPv4 (1)

108[.]61[.]163[.]187

Domains (20)

1drv[.]mscirrushare[.]cocloudsyncpulse[.]comdriftshare[.]cofileswiftonline[.]cloudglobalfileshareplatform[.]comgoshshare[.]onlineheritiage[.]orgheritiages[.]orgmsfile[.]onlinemypublicshare[.]comonecloudfilesync[.]compublicsharefile[.]cloudquickfly[.]onlinesharehub[.]spaceshinjirou[.]infosmartsyncbox[.]comsynchvault[.]cotw-koryu[.]orgwinsync[.]cloud

Email Addresses (2)

hcrediker@mail[.]comhcrediker@outlook[.]com

sha256 (1)

b314a1499cd728ca3e54b7150661fd0c7d2279065fe3f570f0f66c395d744460
2CLoader Shows Why Malware Loader Alerts Need Identity Response25 indicators · Sep 30, 2026

IPv4 (1)

62[.]60[.]226[.]185

Domains (1)

aware-cr1[.]com

URLs (2)

hxxp://62[.]60[.]226[.]185/t0907[.]exehxxps://aware-cr1[.]com/api/beacon

md5 (1)

18c070b8d032336a244440df1115123d

sha256 (20)

0017821181723261801e24abb9d33c739f382889d46dbf46d320c87ac62e5ca606185d74edbdc06f99095e96f74aa2e49a1cda2d02a294c11a9ac35a0231075e066d83b98a2081e0bb075c94376aebc9b0fd6499025cab1762d83bbb4d7576c60a2ef2c360cf6e3e3e5d844ca03fecc31924ba0e8c3ecd8aefa778cae10fb19e0d2abd7d872196abd951f1d7ed6406486499e5d5acc04f28fcd4f45b1851711e0e4d6c385922938ecc1962dbc7e5950b086459b172b70a945414cffe4395aa270ee6df8a309443c86c0bba8b376f39531513d3451b46bebd4b79bb9d5bf8dcb11337ed6fe9c6205b569670a40eab42b51ba69c5c1724d61474e8595acd90ecfb1447ed0893b9095f671e2f35a2a0127890040b5459534813b0f83c3e1fffa0bf1b195181a2603b0b2608d49134af8c170225c2e06873c1fe5cd537db9018807f246717653bc2ae2e09036bac56c9d79940c652972a73f4c6aa9b925c28cce0952ad9b5e1c9952e95cfa55a4255e952962b6208ae1ca610caf1c7c2383be7e74b2c786f7009cc5e1fba5471a88b23b34dce6e1578ee9f664ec62bf48227ba384b2d43d592630ad1e012da63ef7279f95dd4a8e94964e12ca2f996051875574fa630cf47caf9700a74a8ea4a728b8b7c88cb1f8e22261b4ac01575b112c1e224ca3286ff477ccd888479b96d0ffb2bd53962862db7267a4bd1c8d8f8c22fec63d4331fd58d489e9fb888a5e4193d0e36f6ff29063808c59a164d98e2683505497245d46e7064ba4b4cb578659f73ee354ad26cf2cc1e7f59bd3d15028e1e46a38b4c16f5ebd5c633b7a793ffa2cd96daddc5a503d82ed4fbe636109d89164ec02b5edcaa75a28e5cd700bf7643b275fe5d28649aa41a0711f391ec1fca795a4e8a
Zimbra CVE-2026-73570 Shows Mail Servers Need Full Incident Review29 indicators · Sep 30, 2026

Domains (12)

aka[.]msbypass[.]eu[.]orgdnslog[.]pp[.]uamexico-cashpay-test[.]s3[.]dualstack[.]mx-central-1[.]amazonaws[.]comoast[.]funoast[.]onlinepsk1zim[.]abrdns[.]comrequestrepo[.]comtls[.]psk1zim[.]abrdns[.]comtranszimbra[.]linkpc[.]netwslogzimbra[.]linkpc[.]netwsweb03[.]blob[.]core[.]windows[.]net

URLs (1)

hxxps://aka[.]ms/downloadazcopy-v10-linux

sha256 (8)

22ef852f6ebc39ee71235b90648b4b200b385c47d25c79545986493f8c70db69518fe65dd349180191d9b258ab24876aaed6613cd657d0b626d1fc24e03a22b665a7576c389326b6cdf9c993d0be6e5d50fed9655d1cdf2a3a50f2c21c8ec4356ab7de2509038edf580aef6229c1c3db17f4da8f2d7d940818faf617d1938244aea991f694911e321b0ab97534f2ad0291c392c0a43dabff664c563618bd036db594a42b8f1c6f090327bb9a3361c2d3515537fb7ac8da6b9061b9a3f330e159bf28f38122bf20d5fac969cc414daa6a890cdea872d389ca93d2092b6b7773cfdee5af1c0f76b45d28bafd6e60c07bb8e391d98addf81ef8f13d073acdb3c48a

CVEs (1)

CVE-2026-73570

Ethereum Addresses (1)

0x25bdA7Feb3553995AD68a9A8Ed8c731b73a71586

IPv4:Port (6)

117[.]107[.]25[.]243:7071192[.]255[.]193[.]111:9004193[.]42[.]40[.]135:4433[.]209[.]137[.]175:44345[.]32[.]30[.]235:808045[.]32[.]30[.]235:8081
RMM Phishing Turns Trusted Admin Tools Into Persistent Access38 indicators · Sep 29, 2026

Domains (7)

adsaw[.]cfdadswre[.]cfdbunstar[.]harej[.]siojsuyw[.]niyari[.]orgsdfghj[.]rd-team[.]ruswedcorry[.]stefneyv[.]comtrews[.]cfd

sha1 (1)

f34330d4c6e0aa978dc3af40360c14b31ad51127

sha256 (30)

02f2ce03a2650f17bfe6e8744eebbf58522016cbdb92af8f2217b5dd4a1ad55006ad69b9bebad3cc75b594cc5bb1ca0035ea22bb8a683002ca051d948566426b108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dc19035c8e2520fb70b3e2ec5338c14311b88a26cc1fb8304a01494260b6b55af11a534d04bf30894d20764e91f7e94e0a73f060f0abacc9feeedba427995c83a8374c4934b14a1151ea68847c8627c3f1c0b878f4e673bda3f15e4388dfde01873ff5e49fd2f2bd0758467763c44d69e781b7460af84a6e3966e2621bc5bf709640f8e774e1e7a484b78c7ae4336bc47aa9cab20dc8e1e67d89838e807975f9b14188c6588f3dcda881c3f2d12df580051179a999f040b799af506edeb3211a26499d07894f730fb685ee3cbfc1a933e0da93750c1ed25a49b2eb9c32adef156a529543b4fe6a4c21d28be56dbf92fcac91d8df808d8518b4275c973fa547ad635bf8cf29ac6803e7269b045dea48003af7cfe48bedfc081b57ff9e86cb08971b67c979dc13961b09f24f85a801e4c918420adca6117c92efbeeeaa68a6344f556a89de024ca62536de6f5fc10e49896bb1ac330ca39dce30203afdcc45ae237e6cc665057c4a4fe42a309afd3a7fa96cf1af126e9c6e08e56df5105e05378bcc77fb0e75f4396cb57bbbd28f6dc5310369a87abec9e2acc457aa99a0063ed27a857c2f283de799faa74b56e862c0a9f96e67aa1b4fa4a9e46395098365b99de3a03c84ae9e569c04fdd271277f508bba5a299d53c3c0efe0819338d178fe1c5ba93c946c237b981189d2668d938a9d4d1d9681757e48dae8d9d65ed25b5da657bc8b1b0c80512ba0e8ffccfee5b507df16a3355db1143c3ba81ef42dac1baa6cc2c004a56de2a99f5b06ceb58d8a4b371fb60fd66ff5936786fe8d8037ead208ccea4e1acc51ac43ba9da76ada00e7e308cc33d9c5c264dff82d1be83e957b88ceb3f7fe9a618ff29a21b126383c23900fad58d6ae2b5552d7e306e4b6acf4b0d232d82e410de12702a67c58acf927304ee42f3e6d81a9d71eca99f9052126dbd3cb7ded277b49be06e6a1860f7c7e913e252802e9d32453a185e24797bf53efd49cc01641c3045bf3119f9d71e7ffd29bfce32ca4b27cc96340716ed4d41cdcdd434f3ffcafeda538d43226665115ba136ad0fdb43dad8536e1368ca9a17b64e31e5da7c58a7e8f89f9629f095edd7d741a1fb0b85fcb39f3818dbd9497b1e3f094b8263471c7b76dbed03d420736449920368fa0eca2ed6b1aea2645138d97fc96a04c615847f0fb1391f04d9d1aac7f78ddfb7d459168df0a4172b98354e2
Custom GPT ClickFix Shows Why AI Trust Needs Browser-to-Shell Controls28 indicators · Sep 29, 2026

IPv4 (2)

45[.]140[.]205[.]2896[.]62[.]224[.]81

Domains (1)

chatgpt[.]com

URLs (3)

hxxps://chatgpt[.]com/g/g-6ab595ad6554819181b686d4876efb80-plus-5-6hxxps://chatgpt[.]com/g/g-6ab6ba039440819185ed491740b11cf8-plus-5-6hxxps://sites[.]google[.]com/view/antibot172881

md5 (2)

6ab595ad6554819181b686d4876efb806ab6ba039440819185ed491740b11cf8

sha256 (20)

0457414c4504b70115798eee9c8384a8bf9e793461ffb2e0661a6dcc6ed4809f14e3376befd4b7b52de0757b6264da294ac6b0f9e4ff51cb9bc5b19b243fe33520c7befc174a61117770535e809046c75e93c71284bf1a9c6cd532f55b315f5322869e3326fe1de011cd500e666769027126c5c440b76837baf55139f30094e4278e2f3e2f26c18666b89ef774b4af9ce954e36b2bf54a2392608619245d8c483cd1484cc5bf10e22d79784beba58a75d7b126c46efb5e1a85d6aab88444762154c94f85ba6e950903d5ff42c0971c5a9d0741596be26e06afe7d60ec38edf316761aad48a3f987238994d92bca97e4b8550e0150607bd67b47b1b6366a371fc91a22cf3154944897cbcaffc7d20d4596e972d280ee134197d41d8d8eefb0fe29c615db040b88c18ce6b96f30d08797045b7d506f940bea452dc7a6992fdbb8da27cafb84876a3374ef4aba1062345def6cd0b029eaf8e0dc44fa24fc943f3c6ab65bbfc505dbe1cebe6021fb36e2011f6aa1d64f5d87cee1cbee3fc2a0c7907b59a21a8d4c0c11a9ecbbdbe2a2938499c99c5ebb210c9c6db9683c7ad19f4c4b77575413c0f97eaf31e4a44c884c1ecdc0049ec89916ceb0bf3aaaedc0442fec4603646701069ebdeabc96f74e1f947355ace8575560986d8393fcc6b88d0b7d3fda1e6cf886fd530bf62e2d16c39ad23ed12a2c933fc211f1f4876ceaa033ed5acf44658f0dce90bd160f15d8e07a96938c81661d87dc7e9cb0107863bfb90e58831766e8d4313db9f8b85f90c3a840aa0d84cfeac285beefa40e39ad0d1fbe614b7d5a7a363fb1b355a87e2e8d9e8a05bbbca08f2cee3d606bdb5015ac53beff5d63ddf1813962f0d8ad1250cea5486c8bb5dd27c3f432b43957a33e43764
MacSync Shows Why macOS Stealers Need Full Endpoint Response55 indicators · Sep 27, 2026

Domains (11)

apple03cloudstore[.]comcaldav[.]icloud[.]comcom[.]mxdocsend[.]appstore[.]com[.]mxgateway[.]icloud[.]comslack[.]apple03cloudstore[.]comstreamyard[.]appstore[.]com[.]mxtoria[.]apptoria[.]apple03cloudstore[.]comwaaako[.]appstore[.]com[.]mxwarpcast[.]asia

URLs (15)

hxxp://caldav[.]icloud[.]com/published/2/MTk1NDMwMDMzNTUxOTU0M1aHCZ-nMxiyGzBTzPiodOf44DtKJ6PpjftAG28_ui2NCYMpL_vu4pF4ddsJ8ysg0QI7pR0VEIEbZYdilVZRw08hxxps://caldav[.]icloud[.]com/published/2/MTk1NDMwMDMzNTUxOTU0M1aHCZ-nMxiyGzBTzPiodOf44DtKJ6PpjftAG28_ui2NCYMpL_vu4pF4ddsJ8ysg0QI7pR0VEIEbZYdilVZRw08hxxps://docsend[.]appstore[.]com[.]mxhxxps://docsend[.]appstore[.]com[.]mx/dcc737d157ef4271/CoreUpdate[.]pkg[.]enchxxps://docsend[.]appstore[.]com[.]mx/dcc737d157ef4271/Helper[.]pkg[.]enchxxps://docsend[.]appstore[.]com[.]mx/dcc737d157ef4271/stage2[.]enchxxps://gateway[.]icloud[.]com/caldav/1_MTk1NDMwMDMzNTUxOTU0M0pybtJB186GzhogprwCQUjY3oZNiDFHH8WVo6bmgUtI/attach/4GE4TKNBTGAYDGMZVGUYTSNJUGOAALDAFMDOJBGWNUCYJLZRNDCLCO2YMQ3I64RLGMNXVG3KYBPWQOGYIEI7MPBDDYHECFDYVENTXIYFNDCPOVRMCTYI236RCYZAE63V5U3RTUYGUMO2CO7PKCLWMCXE73M7OPTHSGRWH5DXQ4PCUQU4ELZTLW54JSTK2H7VQ6PD26WOA2R7PPIQ6RTJWDEWP34U3HB4YWMXXC6EJ6PKWILSPYRSDEVY6QGMWSIUN6PR5W35KO3D4QZE7CFPUVBAEKI/Loader[.]app[.]tar[.]gz/YXR0YWNoYXR0YWNoYXR0YRhrE8mQ0E-b_dTUSGStQgTQ0ULFxCanei3Ke-EuEyQLhxxps://slack[.]apple03cloudstore[.]com/installer[.]shhxxps://streamyard[.]appstore[.]com[.]mx/installer[.]shhxxps://toria[.]app/hxxps://toria[.]apple03cloudstore[.]comhxxps://toria[.]apple03cloudstore[.]com/hxxps://toria[.]apple03cloudstore[.]com/e3c1a6b00bc31e14/stage2[.]enchxxps://waaako[.]appstore[.]com[.]mx/installer[.]shhxxps://warpcast[.]asia/Toria[.]dmg

md5 (24)

00d12d842596bf5ee1805effb4571d3009425f72de8bba18893dcd6f0411589126a0f7cdb9f7dc5ace9a40af825b15382d69812584269699fade26622e6490c53a1af2b397c6958e6c3ba3c75912d60e3ded1d71a822b53b12c3b67bcaf633f53deeed48fd38f22e369f5c3092bd68a14203ec932bfcc0907f91732440d6d9976791dad263cac6d63ebba6a4b57e7d717212229c85852c3bffaf9740002b2f39781ce50001d4b449600afa347c9b02087df1049cbd56c0bfa4a3364a379b4c2c8d371f8a7a6dcc2655544ae13cbca03d8dc8561349d144d4661bc66f2ec49f9f8e84b01d5ac9624f0b181ade0e737193980e2134679bc0c609f7659882883d779a0043d900a9ac78c886c59c9a328fd09f15fe9c4415cd668334339f705b94d8c53d0ea45dbc622afb7f16ea3eec78bceb760d5c88f13f7ee0f8f86ba3407123f97d24212fa6a21be0c4d211e10f044cf9f70096aabb4d22a6657014f4853a53fb90887592655a8c989e443c640167aafc3ba5ed282d77127efd0b0f2403531b

sha256 (5)

3744f975113dfc552df982dcae699f9154a448e05a743bdfb641a463352bc13ab8b4b88205a8f594b95a841bc37342898f34cad8a5a9e4a22ce69a31a1208650cb09ff86cabde4f8cee2d3cdec370c623bfa6c2b72ae9750fc9a7b299c65d7caff3ab9ef841630364818396f62e696b72aed162cf0b895b6643ef25dad79b51dff664112d3215c5d184689fc836e0dc6c1a47e42c34e70b2c3d356864bc4cb4c
PeopleSoft WAF Bypass Shows Why Patch-First Beats Perimeter Rules18 indicators · Sep 27, 2026

IPv4 (3)

104[.]219[.]234[.]138162[.]219[.]30[.]1655[.]199[.]162[.]157

Domains (9)

a[.]readazurenetfiles[.]netenroll[.]azuredevice[.]cloudg[.]readi[.]readjava[.]iomicrosoft-entra[.]netos[.]namewinmanage-me[.]network

sha256 (5)

2bee941fb40519d0d1ec52bd79a8f63fc65aac6455c8f2d6b668e3360dfdb5d73ba215692665513abfffd4e815c5c45f2d41e5dcc4283a2a3b740930c5c417c3419c571ee38b7e7266d130c4b6bbc4dd0ef44d6e5f3bc02cc2cf73b762f07c8648b4a0827da7bbfce9fb52464f8a659dea7a035189c52c506c0bfb4b1c3fe494ba14419beb2ec0bb94cab6298c14d7fb3e1d819366fe378290c0c2a4d97f7e07

CVEs (1)

CVE-2026-35273
UTA0565 Shows Why Browser Zero-Days Need Endpoint Correlation24 indicators · Sep 24, 2026

Domains (16)

americanprgoress[.]topamericanprogress[.]orgborneobulletin[.]com[.]bnborneobulletins[.]topchinadigitaltimes[.]netchinadigitaltimes[.]tophalal-navi[.]comhalal-navi[.]nethalalketak[.]nethalaltak[.]netoutsourcingwise[.]comoutsourcingwise[.]netpersonclouds[.]comtheconversation[.]comthecovnresation[.]comthecovnresation[.]net

URLs (1)

hxxps://americanprgoress[.]top/chrome_cleanup[.]exe

md5 (1)

177652713dad3c128bd9195abf2b7603

sha1 (1)

668aa5551315ab26b67118fbb29f8e4560a1e1af

sha256 (2)

8858ea412dc306b3558885af18006c5ca24689e8875733b5e13b3c2692e603cbcbeeb7dd5e89261cde032825fd10bb80bad2e3fbf5b91fdc9137ad463ffa8f21

CVEs (3)

CVE-2026-85046CVE-2026-85880CVE-2026-87491
Malicious Terraform Providers Show Why IaC Needs Supply-Chain Controls14 indicators · Sep 23, 2026

Domains (4)

gocommunity.iogogets.devwww.aikido.devpub.dev

URLs (6)

https://portfolio-devs.slack.com/https://portfolio-testers.slack.com/https://portfolio-devs.slack.comhttps://portfolio-testers.slack.comhttps://mediumstar.slack.comhttps://www.aikido.dev/blog/graphalgo-terraform-go-modules

sha256 (3)

b9966e3762e9a0d5d263b8cb3cca07294f81af9714d40ddf4628cb85d74e8ad55f892a5424e88a21a3eb3d7f82ebf04d8ac31cdb19ada25153be4165df977d0fab01686d87565250fc4989faddb877d793667b07ec217a61cbd798f5695d62f5

Ethereum Addresses (1)

0xAD02b5cDE693529d3bdA0266299501ad0193036C
RemControl Shows Why Mobile Banking Fraud Needs App-Control Guardrails33 indicators · Sep 23, 2026

Domains (4)

tvtap-hd.apptvtap-liveapp.combnbnhura.topdefinatelynoone.com

URLs (11)

https://tvtap-liveapp.com/dl.phphttps://telegram.me/ftesterahttps://telegram.me/+Psyt04xu-cRjMTg0https://tvtap-hd.app/http://vpn.doneplay.site/http://ff-de.shutgpt.ir/http://vpn.askarzadeh.com/http://cdn.dlmafi.top/http://216.126.229.216/https://definatelynoone.comhttps://157.90.179.116

sha256 (18)

76392303f28a7e6f1463a5fa04a19faf40d51d7be6619943a914482b0f3c7f0bfa373aaa95ca512ba9595c3ab41bac892c8c79d4a31f5d74c2f3225b629de52e45e16e56c81059f6758dced28a58256287785a8b0815577c1140293589aa2ae1dd6d05ff31f64b9ca8ca9334a804dbee5917d6448acb026de4ca818017a047303b0c49ed1590bceffbefed150bb64545e69e792c5ad63578cc3bca5c5b96f2cb19fef425c3a774e493526126a441a31971db8ac5af84c1d9eef15a272ba02ec154efee2665d3779f1be0d885409e29e6cd07fe944fa82e5d6eeb832264c7409dcb29b6348ae4458b6b506f8de9336d0980bbfaf88b1d68be2771b57090d298891a992e2b36b2a9a77300b0b0fe7e9c20e127c8257fd203bb4b3eaf1e35e63ce7af2decf5c5cbff0c0460ab09ad3cff497c765e3cf61e6c45f4e3b5c6a103312c28a09cd68b1f4212cc61bd2d44d03d55b8bcd7df284bab56cdae8507abc90e3cc6e1235d5cd01a205a191ce48c3d68e9fea620671c0c069593027a0218fad5b095ec481745c64c385c60f6c812585e5060a50e38da44bc1a9f67da3921b1a50f77ead085bae72b6cb1c33c55fbd7763c4d8050798c55af3132c3b904084eeb8aad2b019cf346b8b4e6b2174a95b1d897ce736087bd06066f31a9d7fd72283e9fb714f590380e5be8233cd60a4f212d949aff27b3a980e6d644c84b0120dd25b3648b34fa952a2806d9f4c272f8bfbadc45c0c370c3d7c2ff0c7ffbb015237ce15fff21af95bd38b8c11dd73342a55acb75e91ff1936ed0ccb06af28400ef87d4
CLOSEDQUORUM Shows Why AI C2 Needs Behavior-Based Detection10 indicators · Sep 22, 2026

Domains (4)

api.deepseek.comopenrouter.aiapi.mistral.aicdn.discordapp.com

sha256 (6)

250d4fa37488af9b025333fa17705573d721467b203765bc360890b4f5a90cd7c4dc171f2513fcaf9d5ecc815a94aee4063b213ab380f80bd3ac422dee5205a7c13cea04f598e2b0c248d603a6e31bd13aabb64d8149c1b6a77b64e0b983a86ff5f1f8c3e7b883793800ab6ccf21b3e60bd0730f300b4595fe74a33adc17a63c5191cf625dfc209a347f137b50aea199e82040fd5ee9086fb3e2de73c133f3cbeddbd0ecf7195d38fefae5b9d393abfa79e6f3f94bde19308ecef130a05a42e5
Linux Kernel LPE Quartet Shows Why Patch Validation Matters11 indicators · Sep 20, 2026

Domains (2)

heyitsas.imbase.net

URLs (1)

https://heyitsas.im/posts/lpe-quartet/

sha1 (4)

7bad4bda74dc4713f398d3b7624ff05478e3a568447c9303942c439a117d9b76ce6d6e2116b38ee7e9c238f6fe42fb1b4dba3a578277de32cb487937bd0e9289e2642f6a5c54faad304ce0f41e926d22

CVEs (4)

CVE-2026-80844CVE-2026-81000CVE-2026-68121CVE-2026-74469
Fake GitHub Repos Show Why Software Downloads Need Trust Verification19 indicators · Sep 19, 2026

Domains (13)

albinofennel.comawwwards.comdallikilic54.github.ioedgarcostartqd.github.iohanselarinmusky.comicansamyope.comistatlmenus.comlastpass-authenticator.github.iolastpass.commacperformancetools.comryanpresbrey.ccthreads.comzaffersnouty.com

sha256 (6)

1e6c1766ac78d7adfdae71d361cb132d972771897ae9065503b135cb812d7c3526db14b956e33f69b3397a36387d32e01eb63613acff91069dc76b6ed7de45a8611b3ba687b7f46319a19609605ddfe5225e6d85277d8e923eea3fdb6f7b5b6175018b06c7105a1dca391805d17b402aed35ebd515b92d461236eafbd606cb40aefbc6e04320e9a0e80f2323f8a897c4fdb222a37b0b87d76e850109decbfaddea8c31a86fa785ab514022c278a2f6e571c86aac9283745a96605c44d88382d6
SloppyRAT Shows Why Ransomware Defense Has to Watch the Whole Infection Funnel33 indicators · Sep 10, 2026

Domains (6)

api[.]telephoneip[.]netapi[.]truesmart[.]orgfinger[.]linked4x[.]comskipraid[.]comstro7121[.]blob[.]core[.]windows[.]netwindows[.]net

URLs (4)

hxxps://backup-ubt[.]s3[.]us-east-1[.]amazonaws[.]com/hostfxr[.]dllhxxps://skipraid[.]com/dsVGmQTrzX/default2hxxps://stro7121[.]blob[.]core[.]windows[.]net/dpp1/config[.]pyhxxps://stro7121[.]blob[.]core[.]windows[.]net/dpp1/hostfxr[.]dll

sha256 (22)

00c116e498799dc831c8aeb602349296c4b9325535d674fe2b6e2e091878dcec1439990ff65364a0f608a322aa3a493bc1683cb5fc30cffc44948da29623fffd2f3d95de716f330fad2330d8787ebdbecb3322453bdc41b2113427f9f92d32d23a8994928f512fffcb32e117ac45e0ee093541d99a9dba5f69a264f7f3054b19466f9b8dce77b3a026fe4f833aa4949784fb854bea4137e52609e857d439dec84ecb2d06510dfee1b67f5d9a68c60f6d09ddb5be36cc1766a41d77c5b89d3a56518cd57a303ff7ac2b5c4c8439aa5bcbf9a287d4653de7b76051bde73a94d064607212cfe73c5c84b2dd95b2c0ff37a47f4c8aad08e6d5cbb7c19a62c6b765f9680c3a9f5fdddfcc34856c7a67d21bbdd2b47d70bdfb829ff59cfa0e3bc72d216d50bb50d4e7d6ac36ca6d2761f382be8e1ddbebf3cdf4733cf989ba291f90137bb025b426ae6ccbc170fbca58634b8dd77a61447e48dabe9c2e2fb0d339d8b78774533134d9d1514106c4090a0c5bccab4550facdcfe03f4e02b9764343a99093273ea09bd9df881a594db8cfe1b1bbc54f40f623f44427278ae96fb9b46490971f25f84be88c4fd304d555b5e3da12f6b368e4b9ba0943961ff21ba6fa4d4d9f84cfcf988530941555d1cb7780a091743cf567396201eff7731f5475768f9aa13fcbb0870f2fabb7e0a8c757ee3b763bd4a4b0cdf59eeff981d8e307fcf316bdcf8fe230e23692b658b62b6547374e2234f2a497b19d26637018a1839e6dfdc0ef62a2d5ca11c2eedad3561d5d1d8b6e9847aa6b8613493e5bc233ece3d189cb9930d0cde5bf8e8a7ad08fe2c60b937c7beaf9ab51b03191dfcaba40b7b189eaa52d2d6d4daf29157e8e813247fb2e92797324230ee42c79f7861b2f5c341df534a957edec74d69081665309311b791b6d11a3221fffa67744812d73ad98ebff142fc192daa2a83bc565e5b38ebbe05561f3a19c7fc2d08e38c97e1986bbc5

IPv4:Port (1)

62[.]106[.]66[.]148:443
test2 indicators · Sep 10, 2026

Domains (1)

ghcr[.]io

sha256 (1)

7e1e73513947053f6ee40746fc498b1fb4f285cf175fa8336f08a38e209bda38
THost9 Shows Why Exposed Android Debug Interfaces Need Compromise Review27 indicators · Sep 9, 2026

Domains (5)

api[.]ipapi[.]ishagaseca[.]comhagaseca[.]pleasedonthackmyserver[.]compleasedonthackmyserver[.]comtest[.]hagaseca[.]com

URLs (3)

hxxp://hagaseca[.]pleasedonthackmyserver[.]com/hagaseca/gtahxxps://api[.]ipapi[.]ishxxps://test[.]hagaseca[.]com/ws

md5 (3)

24f344e174546e780332d573d5a27c43bdca0eb738faaccb5b992d0f393b9d9fdfd9c7dee4f4a16d636917de35a510b7

sha1 (3)

03fc9c35d6453ccf7dd5d16ea2d6d272da1e1cae3a8138debf528361bf7093e3aa85a5f84105ebf6c6ee3d72053772bdce063c5b98afe32e739e918e

sha256 (12)

05e26b639f55e53f73c2fd2980c519db347086951d832d58a94a26990d81befe12fb8fe6cd895044e38217dd5945b0ec810f667660fd87dbb21687ea4208458916c3ee7276d52c11d3cc6270af883abe5d7015ea4f8f66fb3b6493144a8633771e6ff4a1dba4d6e4c29f4f7bc06b774104a38c181a05ebed127bb7b914128a2130f4e1bc0cd96d4210765b18533eb0c5343f155a36b1a567132538242487d09c45f71eb7ee96f80a1e865b2249452b603b729f4fc4c6f02ed00cadcdacf8f38454d4ee85175a249dcb576716edf491d09fa05dfdfc492ff710a0cb711f9a35ab5652e2256df133a429f329ba60fe78c67ce63e089a5a3d58e4ff3d058ef7a7087ec965cd61ad4de270b45e7719fdd72b3a37b27c0ba5764a73ec2c1cfc9665599cd3a954e807a3d596401b43e8820ca6ee76119d4dfc60afe0eaaf054e2c2ab5b32bfa02834d43f04b78854e6cc417da2d45a2ca6d2908f33c06dc97c7cc0389dfd708b9debd3c32897b96726a5a9437bcb36f1ad59639f1214a969f8f09e237

ASN (1)

AS399486
OfferLoader Shows Why Commodity Malware Needs Funnel-Aware Defense332 indicators · Sep 9, 2026

Domains (313)

5[.]xxx[.]xx[.]xxxaa[.]amazingshield[.]xyzachievershelf[.]spaceactivitymeal[.]spaceadditionplot[.]cfdadex-blog[.]blogspot[.]comadviceturn[.]xyzafternoonscrew[.]spaceagreementjuice[.]spaceairplaneiron[.]xyzairtwig[.]xyzamazingshield[.]xyzamountfuel[.]icuanimalrecord[.]xyzanimalview[.]xyzapparatustruck[.]xyzapparelplate[.]spacearchairport[.]xyzatthelake[.]infoauthoritykittens[.]infobabyvein[.]xyzbadgewing[.]xyzbagcare[.]spacebasesfile[.]combasinpleasure[.]xyzbasketballyear[.]xyzbaskethumor[.]xyzbedroomdesire[.]xyzbeliefpicture[.]xyzbellplayground[.]xyzbikesdonkey[.]infobirthdaymagic[.]xyzboardmagic[.]infoboatthought[.]xyzboundarychickens[.]xyzboytank[.]xyzbranchmorning[.]xyzbreathdoctor[.]xyzbubbleslip[.]xyzcabbagemeasure[.]xyzcablecanvas[.]xyzcardgrape[.]xyzcattlegold[.]xyzceleryerror[.]xyzcentscarf[.]xyzchalkprose[.]xyzchawton[.]infocherriestruck[.]spacechesstail[.]xyzchickensmine[.]spacechurchpail[.]xyzclothcrib[.]xyzclothcurrent[.]xyzcoatberry[.]xyzcollartitle[.]infoconnect[.]activitykitty[.]xyzconnect[.]apparatustaste[.]xyzconnect[.]armcard[.]xyzconnect[.]badgeterritory[.]xyzconnect[.]baitmetal[.]xyzconnect[.]beefteeth[.]xyzconnect[.]believesisters[.]xyzconnect[.]boundaryfly[.]xyzconnect[.]bubbleappliance[.]xyzconnect[.]cableland[.]xyzconnect[.]chinexpert[.]xyzconnect[.]conditiongrade[.]xyzconnect[.]coppersummer[.]xyzconnect[.]creatorcreator[.]xyzconnect[.]dresstent[.]xyzconnect[.]dropjeans[.]xyzconnect[.]edgeplayground[.]xyzconnect[.]exchangeclub[.]xyzconnect[.]existencediscussion[.]infoconnect[.]expansionsalt[.]infoconnect[.]fangstitch[.]xyzconnect[.]fogparcel[.]infoconnect[.]foodhook[.]infoconnect[.]forkcountry[.]xyzconnect[.]fuelleg[.]infoconnect[.]geesepurpose[.]xyzconnect[.]giantsdogs[.]infoconnect[.]giraffetoothpaste[.]xyzconnect[.]guitarrobin[.]xyzconnect[.]halllunch[.]infoconnect[.]harborclam[.]xyzconnect[.]holecompany[.]infoconnect[.]knifesea[.]icuconnect[.]monthsmoke[.]infoconnect[.]nosegovernor[.]xyzconnect[.]pagesubstance[.]xyzconnect[.]poisonblade[.]xyzconnect[.]prosesalt[.]xyzconnect[.]purposethings[.]infoconnect[.]quiltgirls[.]xyzconnect[.]reactionbit[.]infoconnect[.]rewardrun[.]xyzconnect[.]riceapparel[.]xyzconnect[.]seashoreletters[.]infoconnect[.]selectiondogs[.]xyzconnect[.]shapeboot[.]infoconnect[.]shoptax[.]xyzconnect[.]stopfinger[.]infoconnect[.]structurekiss[.]xyzconnect[.]tanksuggestion[.]xyzconnect[.]thingbrass[.]xyzconnect[.]thoughtslave[.]xyzconnect[.]threadfuel[.]xyzconnect[.]trailcontrol[.]xyzconnect[.]trickbushes[.]infoconnect[.]vacationthought[.]xyzconnect[.]viewschool[.]xyzconnect[.]voyagelaugh[.]xyzconnect[.]woolreward[.]xyzconnect[.]yearicicle[.]xyzconnect[.]zebratransport[.]xyzcontrolprice[.]xyzcoughcoal[.]icucountrypipe[.]spacecowsfoot[.]xyzcrackfood[.]spacecreamfurniture[.]spacecreditchickens[.]xyzcrediteducation[.]cfdcrimestreet[.]xyzcrimesupport[.]cfdcrowdstri[.]comcurvebite[.]xyzdeathrock[.]xyzdeathshop[.]xyzdecisionreaction[.]xyzdinosaursjam[.]cfddistancebedroom[.]xyzdistributiontheory[.]cfddolldebt[.]xyzdoorsoap[.]cfddrelto[.]infodustprotest[.]icudw[.]xrsdownload[.]comexpansionsalt[.]infoextentrack[.]comfallbeginner[.]xyzfangbear[.]xyzfilescenter[.]cloudfilescloud[.]profilesilo[.]cloudfilexstorage[.]sitefinersto[.]comfingerbasketball[.]xyzflavorwood[.]xyzfleshfrog[.]xyzfleshplants[.]xyzfleshproduce[.]xyzfoodrock[.]spaceforkmice[.]xyzfriendjewel[.]cfdgeeseairport[.]xyzgirlsgrain[.]xyzglassmove[.]xyzgoldsteel[.]cfdgovernmentyard[.]cfdgrandfatherquiver[.]xyzgripcollar[.]xyzgripsleep[.]xyzgunbear[.]xyzhairreward[.]xyzhatescale[.]infohealthiron[.]spaceholemuscle[.]xyzhomecub[.]cfdhomefireman[.]xyzhoneyfear[.]xyzigk[.]filexspace[.]comikx[.]filexspace[.]comilesilo[.]cloudinstrumentvolcano[.]spacekittenschalk[.]xyzkittensgrade[.]cfdkittensrobin[.]infolanderror[.]xyzlesilo[.]cloudliptendency[.]infoliquidtoes[.]xyzliquidwrench[.]cfdlockettrail[.]xyzlumberbaseball[.]xyzmemorycompany[.]xyzmicesisters[.]xyzmifilesx[.]sitemilkname[.]xyzminewave[.]infominuteblade[.]xyzmountainsurprise[.]cfdmouthfruit[.]cfdmqsearch[.]comneedcherries[.]onlinenoiseship[.]cfdnorthbox[.]xyzpartpipe[.]xyzpartyfriends[.]cfdpassengerbrake[.]spacepeacejewel[.]xyzpeacetongue[.]xyzpetminister[.]xyzpictureporter[.]cfdpieplant[.]spacepizzasthread[.]xyzplacespoon[.]xyzpleasurewaves[.]infopopcornregret[.]xyzporterdebt[.]xyzpowerbushes[.]xyzprofitfact[.]xyzprosetoothbrush[.]xyzquincepage[.]xyzraintexture[.]xyzrakepurpose[.]xyzraterake[.]cfdravexoffical[.]blogspot[.]comreadingscience[.]xyzreasonachiever[.]xyzrecessgiraffe[.]xyzrecordhistory[.]xyzreg[.]pcsdkflyer[.]caregretsquirrel[.]xyzrestbucket[.]xyzricestar[.]xyzrifledog[.]xyzringsparcel[.]xyzroadyear[.]xyzrockcredit[.]spacerollglass[.]xyzroofbattle[.]xyzroofreaction[.]xyzrosegrip[.]xyzrouteletters[.]xyzrunhouses[.]xyzscarecrowcare[.]xyzscentrod[.]infoscrewbirth[.]xyzseatlace[.]spaceseaword[.]xyzservantadvice[.]xyzshiptank[.]cfdshirtexample[.]xyzshoesearthquake[.]xyzsinkwash[.]spaceskirtloss[.]xyzslipvegetable[.]xyzsmokecar[.]spacesongtheory[.]xyzspadeleg[.]xyzsparkrice[.]spacesparkrub[.]xyzspoonducks[.]cfdspringdogs[.]xyzspybaseball[.]spacestartmonkey[.]cfdstatementservant[.]xyzstatementtouch[.]xyzsteamhouses[.]cfdstopzinc[.]xyzstorage[.]ggclicker[.]comstructurelinen[.]xyzstryper[.]infosuggestioncemetery[.]xyzsuitsoap[.]xyzsuitstraw[.]infoswimrest[.]xyztablechess[.]infotailsilk[.]xyzterritorycaption[.]xyztexturebadge[.]xyzthrillducks[.]xyzthroneback[.]xyztinsofa[.]xyztoespiders[.]xyztoothpastesense[.]xyztoothpastesun[.]xyztownquiver[.]xyztrampdonkey[.]icutreesboard[.]xyztrickflag[.]infotruckpig[.]cfdtruckshat[.]xyzturnclass[.]xyzumbrellavessel[.]xyzuy[.]basesfiles[.]comvacationengine[.]xyzvelfps[.]blogspot[.]comvelvoxlab[.]blogspot[.]comvendralo[.]infovenrx[.]blogspot[.]comvenrx[.]xyzvenrxhub[.]blogspot[.]comvesselsystem[.]xyzvestthings[.]cfdvolcanopin[.]xyzvoyagemist[.]spacewastereading[.]xyzwasteturkey[.]xyzwastewine[.]xyzwatchadvance[.]comwavepan[.]xyzwhistlebook[.]cfdwhistlesong[.]xyzwormspark[.]xyzwoundsecretary[.]xyzwrenobservation[.]xyzyamsmell[.]xyzyardvalue[.]cfdzephyrhall[.]cfdzippyfiles[.]net

URLs (3)

hxxp://aa[.]amazingshield[.]xyz/33244556546[.]pyhxxps://stryper[.]info/aa[.]jshxxps://stryper[.]info/t[.]ps1

sha256 (16)

06e0afd01bbc6c9d5dc16c3165089b233dc071e1f251abd06235d1b9166cdac525558ea78c4aa0fdd0f45fafcaa546d3115dc5806809d144a5801a40e48fd4c52c6e11027b011042c9a118fc20728f8f4ebb6be8795cc84cc9a45622c297d3543052bd320a34e12ee694811ed0578797477dfd480c664491e509ed15ce1a6961553ce594c9c6afdd4794fddc28c194e3bc3c1b052310e5099c58ac15bab7210462d49d0c78207ec2452cc8a30501db771c9edbae89889e41a7dd227551243e8e7f792c45de1e28fd42ac44c9444f157a2161742d130bac336c0e991aabbb112c9b0d9cbc0fd4a7bae8b78a15dfbe63052779414ad725845732c4a0083008da69aaebc8c07de485be6d1bfa956668c5e18aa1ff5588dfe84672e20ae90b4560f1b367762140ae7f5098230b8a5da738c9241f286281ec9439dd6ca581fc87989cceb30a5eb9ad9d9c6712c80726df16f96f99d9fc0753be241b00b4d636eb576ecf184d04ca31fb2b6b7efd85399c29c1136b539153e137ceb3877b1b905791ded8d783f8e050a6e394f3c0aa5e2bc73a38d822e55fbc39c0648cbff566de3cdfe05bc22afbc5ddd50b49c85ee169dd13318000d38286de2b8bcff98217256a8dfc485882626512e7ff82a1d7cd8e8fb3e9751b026d97e682d6908aefff1f2d73fdcc95b7791c0d6590dcf1a412dc9fcc92ad2095818d1b78368b31efad012007
Teams Helpdesk Impersonation Shows Why Remote Support Needs Guardrails6 indicators · Sep 5, 2026

sha256 (6)

0d2fc28af246f62f27e49207d1f64e236ad9ea029412b27877d1ae6c098e86e34cfdcae6dd1d6d98b870c8f0654d504f2bf10479a117dc297de789c249dc389d69e10e0cb7bb2137ebea12971adb02c662cf5543a4f8c9530812bcbf7b183a23a135fe4df18c711097e69b4f27ea32a74a955160bf2fb12da841f21866d95d87a4d145a6347e47d40b3ca48af5c6dba01bf019d0110e31a44bb70fc77d1d1676cc6d0f3f47afeba018173604e34f527e8413d3a54ffb35caed529bff49055ec5
PaperCut RCE Shows Why Print Servers Need Compromise Review20 indicators · Sep 5, 2026

sha256 (18)

02526fea432069eb90279c4e300ea44bf46eaf432a95b05e8a59b55a0c5c001b03ce77aaed2c8dd8e28b76eb314ee3f5c18b4f13968e5edcb7be469a8faf1c59083e52d55a27724f3f8829537937f80b3977568c27d933cb8f89b61ddc1be9d40c915094bbf9f6e768e0d12dc9a8005a52594cc0760262010c1cc03861b472aa2996de9a85cc5f071df126539d8af8c12b72a46146021a06e15e53aceb5f83c12b6abda60be63d42053f3625c52b65ab45ed29b1226de7944b8724520d579ecf51585ee73b70362da3739b8ec77f79336a5c5db9bddcde3fd49ccfe953b529a161512014718d1fc2d655c298b7a78bb3ec2ee411470cb57c7df6dfbbebc782cc68858979b4db69e7c4dc41f2d50ea2642a087855601bdb7f33d8a294c259fbdb6f320956b05b7b29fa2943f6a1af488a48c8a69b42a09d1f0e6d2f6b8183fe239375a9c3cf84140a1d8e21b72d3d2c57d85d4de09ea9ae1dc021b64732427da7939962a7e660e7bd90dd50e28bce2a337562140813f885c42cf792a2877d05e69f12cc0b4cf009f01c1daba3d227e5a122c163e919517d25b01d4cada235d630b655928dda17d138aea14f8a150eb0ff509d7676b33b1b569a9f853319ffd7ccba81e871ca20d688dd26fc950abaa49fb5ccb71a6dce3be97736256f644c0633bcbe7b2c2d6463b146ec870c9e584e4e404d15756ce822c9277539848d870259cc010e42b0e94fe67a973a9b8303848f1ee9028b06d78ae9256daf43611b225eebfea162e52b9f2768b15077647b78d3808473932c4c951f6e82ff9040ca8ced

CVEs (2)

CVE-2026-81578CVE-2026-82078
Ted Backdoor Shows Why Edge Load Balancers Need Compromise Review19 indicators · Sep 4, 2026

md5 (1)

c8c68e629bba773a10ac80012d10bf19

sha256 (18)

009a1e2d7a582a24e50cf2ffc2a005482c8e38f22bf5ed416053855f8d054e1e09739441ed4599bac2f8159028f772f71e4b25c8badfff95574e56d7384f3dbe12810854c8b2c391b23e2e18b013e873d0369b0637aa3cf993136c07188ba3b82f02b09d61d432134e994ad671258f523bbf289ae6091fd4eae192c60bd51b6f4bb923eb040aa13ca8fd409c31ee4729c60ddff32e350efe1c5a4a9168a065f55db1b6d52faf60b4f32d6fd0c7c938e4d05d29a14c32ded4a9668357c08b6a916cf1b5e92a9c0756f597a5ddefb38eba32961c52efac7ab2a0aa52c639a8fc537007a78d50a993cb174c685eba96eb442c9507e38fd9d8e5dffc712f613ec11072e70936f0dbe459142a1d867617c35f8d0cce5d18c6a49e1090a2a5adc8e55883f7d565b0465546027052b597af46eae3a199e7a91fcc2ab9363411473491308f30b57928934ae67478d0e690c91d046e35a638da098d02922a4a88a0fdb66c94630b96f628c96a6bff7904b40ffc9ad67c86f8a4ff6080c3b524831c93f402a1d8af3a6acb731f07f72040eccb3450c1c83d40e29f736c2a63d35388660be4a8bfab4de81a1acb04aacdf757346946b0f5e30f0c9f402004016d0e425119c7d53c760c23b4405eb04ad0f20ead375440344b3bdf1fb7854ed12e40d155eabeed72f4cd8d467b5c5d95ae6aeca4aaeea14d79565d379c1ca5871a714727be16fea1bc36632c71e5a839803469ef60ac47595d36b2c50934ac109ade6df06e61feeea9d0bf6ae7396d28271baa51ae50df5169ce5d32a516865856f91abc50b3
NodeRabbit and PollCat Show Why Developer Workstations Need Recruiting-Lure Controls12 indicators · Sep 1, 2026

md5 (12)

0962f56d7ec69f4f2a0162dcbe22116b1ea83e4e4592b01e4acab63eb867bee5291ac3abe73c5158e59a437b75d5f0aa366515822d5ac1cc500711ef57a2e32e795e053a990a1569ffdcb57f48f6d085810f8e3b88eb05f710c09552941d6f56be086789568441d0d7e4679aee51f566cbaaf0900a13f28e380f49adecec932ccf449f1992c2819e62ac44a0b06ac2e7de5af16a3757ef700b01dc34d67079aee259c5edf158aac4cfe14f77ddd0b196e95a4366686e3f786ea3c056fab5b0da
JSCeal Shows Why Compiled Script Malware Needs Bytecode-Aware Defense105 indicators · Sep 1, 2026

md5 (49)

03f4e47b9c2283c32bb8f8f042ce6e4109dbfac09f9cafdbc7d225eb144f0e690b8015cbb1ffdc6efe6a306ff5b1115f0d1fce0cb2b9dec26a10f0822aeffb191026743185dfa10e9ddc21b5a4c578d510c576a57fc040eddd84d631786b8dda13823095b8d31013ba41a5c98ce69b591b7f4288b12373c8d6488fde69c8ce0d201f28b5e62e52e269757930f941c7742477fd3e348c51bf575ede398253d0b32841170a19c028c16990cdcc6fd499bc2fe27eb8c99626e8c02e4bfd02aca96230f23bb28ce56584f8f098ff0035b029376ec4dbc3363fa7131367e4c6327a46454fb012cdd0736e4ed41fabf0916f46462195f7f8033df7371e899fe9bc51de469c60508d4470bc1cc5e4a70d0e7112499184635d56a9827d2059256a35e530533d0b93ea03cd5bab4eec0f0ebadd03576e94d705bd50811dc9525a45732bc3581e2e2265d0c1509b3799c5a90393746626b8caf2734c83a93f78d31b70358468ac84a8470d1f365f0bb2f37b6256d56e023b9b3097a2dba311cb06a91fe259710cc97e64618c68ffca72ac405a48a17650ec266b414d097101da12c43846597b659fa5c93af29c4e11d8c8be4370588fb3e6acb2024601eba0ba484091ff3d91038aebe528a065c3e995a418db6826975319142460fc43e3dc5e495d2313c9a2aa25f0d5b23a2897576e4cf9596a7ca308fa1524c9d5b8dc55d2b296a2629ba6f5bb2b8a3e1abe332dd40e50d78aa3af105a6d4dc10b2bfefd75e917245523b2dad3f88b7f6870f83eb1ad852b7f7ec605371a8caf11497f1879597292e338c8db5e53572e68349c76107f03544491cd7afa032d5f5be0db037edb617f438bd064dfaaef30c057b832c79996c35e89d5b4137135cf121e3ea07b1c81fe1108de10c6b3dc4619f59bc9c80a0aa15e6ae26687982d924ffebef6fbf2d9d43350e27ae65977287bdfb7b0e15fd3603f85e57f6ca6543616f75f7811273616fe47e711a90b5ece5380e1acaed56827e8d5e81b35b76b4d97751c0724bc0c7f3b83e8b5448b4f7b013e8c6191b20d3f8291fa0180946b9a6ad373b7a8f983e2e597fd4494c555adda2eb54b88f5c9c08801

sha256 (56)

058ae4136e241f116d8c5b1a1cad15b53090797154539faa35706568fbd85d9b05db78bff1a48a674e70368b96a550a5f9f93271eb261ab63b36ee37e0e8b9f806dce0f294c62f2a2393c812ff711bde831bf420a4df484bcf5b6241fc0f00d009f803f69bde280adbd4e584ed26a01affac9721db8c5730275d385f084b422a0c31453e74a3b763c7aea550b4f5f194e7656226012b243221eb93fa22da118e0c72513efdae9785894b6e925590d0b59b652dda53b8cd882037a87e672a4a5a11e85a8306057945accc65395b780377c07d4ec9ae52d78185554bf1957e3caa18347a39f174c97947649b3f1de55e8409ff805e808f2101e5953a956e9ee99f192342a5e4fcfc5e8ec430427e1dfa773fd324e3d7215047f36f1114ef930f4e1b0efeb1d988b7bc11014ccc9fdff141fc16425d659f553f6cc69468724996671f5acba97db6d514e4b35ba0601c5269697e8ab3bb99d097db25ec7e7446459422833568125bcc55000503cfe6b470925b7d095ff7592bef79fe52e0573123cc2c29b4089845b010428f8be48e62f165e0f7f8a48e58200629c6020c7ac2cab72cf2d22d1317df6c49171be61ef35c4f6c3da17785fa73e68aa95109075f79bd2d42aa747f7ebc3280b14d30c6b71043545888946d9d6acd6abbaf454584146231b38e76ccaca6f38168b4fdd9cbdedd8efa7e65fe6090240e281bd3152a6feb36d34b6405a33fcb95e1323e2ca8c688af02b315fc1bded19fa27bd1c7ca6f1c395f4c1562a1a8caeba254ccbc7d278b8194795ff5ad3824cfc0c566273835f03d800b7dbdcb6874e29ddd2e9a1313f3d82b323e89a720c632c708098a7ca0e943c57c60a8008e617b16dc6dab29372347ebe144f043200c106149c3106438ba484da78b0fef35711f86876f7c1c77264b8e4295d7393369379c384c05337ec5504345099ba4c77cbb4224101794e525f2bc9adb40904159195c17d7e345085e57f32b3942d5543177f07e49fc84f1409a49b5df7d25549e543607c223b8769559c9038227c634f4e512afaa98f2ca998b0aaac83437c218686c51acbda7873e5a024ae97242be3b1b954f845f7a87a1411c47830f81a2b54f47ec2cf741e2a05b4edd9bffdd7909b8b432eacd463d59eb23eba151c9e218161ab15dd72d55ed5f071a36c0a79ddce92824a49fd8e9bd048b87cabb635671073402365afc342a5fe810cb5b34c8fd07c7eca301b32ef2d3b86290828d67edaad8444db811f20b6075cd41edb59c43c13aa3591e054cdb127b17bf34e036dae591244ea2f8868f684aabefe516539cda48c65cb08014e6eb645b4f1e668d159fe0c18cf74eb4076b498ec73d32860202b6a6ff8d21f8b5216c3903e066136f9d69ef2969955a78742ad2dd3d2444bd3758b6e46dd76f9c43dfaae03bdffc3598ce7d8ab3cd3ac57e1c82cdcff73ac69fee3ba71d67353a062103f1bfae4f263d03b3b84e48d7827f3e73b2e0ebea3eaffa3685e0a162d10fde388282060d9e35b173b74367691682f8215c7e68f4a6b656b7dc6638982a6625c662ce6d6a05330eefbfde2637ac84db0663b6aa8df2ac04470288fd5528f5537fb89d78a2e01cabdce371a686e888b1d75d330cf6be9a7f48cdfd51c48125a86f9bcb6bcb736fb8399e0617d6808abffe0d13d3b93ca3469045e4cebbee25b3631e6bba13880f04b7c8acac25368b3ed808822479eb62d78d819db35362e4e79138ac82310d30e0c351a17992b68c674f58b157a7319b564bb774e7aeb35135d615511838e4a553fe7ea9e9475994191824bb5062622663e2434d2b749a8c936eb573aaac23594dee8dda30473195b39a0bad021f33e08df042b02d3267faee7bbc3e3080dda295c35b464dd6079615f60ea3cc1c65eb8fe6d77bb85fe6b455503193eab02310a873fccadd332e9b5359dc99501ef2a4667d265e9b032f76dc28c97437a463965e2168d20e5c389f673e3b361f438e9986f2a7b2423d3d02dbecea0c220163566850ef6ab56626acdaba94e9975e8e03fa13bae7f0f93f165f42226aeecea3af5a4e0111bdfb7eaec3e252c429e150c42976d6badeea31e48a0356ecbd27796df83fc6d3de16eab73c3d732bb6bff8b9088cc0dcbadb35eea0802056324f1b6295cb9277c62755c12ac711b4ceaa17a4e48b16fca7dabd615e4eaf35bb65fe9131ceac1687095ac13fcb214a576401cd624dacf248480c38b8bcbb85e5d3da52cc204a61395d14c288e79ed9d1fb654a341b92d878a3165a09fb21dfa826f3559b46738fdbbdebcaf8bfc90e4300b8a18c3fe3a4badbe44c106830e7432d8eea227857a790ec91cfdb3bb9edea8de7c7a70275a2b8689619276f1e5f2b8805e67ceab1ee252f6ddd2bb7316be55446aebfa31d05e57e936eb9a18d5d9c20d60d87493100d05fe6f6c670e65765d10a5ca0205a6ece3a3e6c7c730b0a8534c5adef4a3cbf06eb9cfa02e707af9a353f0e2d7a77489c11c2249a1d9dbccf74070130b31834e8d7c3
Fire Ant Shows Why Trusted Infrastructure Needs First-Class Detection13 indicators · Aug 30, 2026

sha1 (11)

13f0c2a598e3aa63856c032a96b110aed963f0e81682b652a15bde732489f22809b0b7594c228fd31aa6ab2006b5d9199aa87bb0bbd995aec698ac4f36005f5e4398a1c62a2a9271eddfcc1b44b1ad005ba1242050b5b447052b210788a5a25593d6987d6ef7d2985edf743ebff413a9298a127e9475d72f7dab017f14628345d47bd4eb69cc49224f3054a7955cd45a2f6f226a2fdf44b329af1c8dde90cb38b149fa3a34bd585e7a674a4fd9538437bd06f514be6b27f429324a4af05a310d8ec9635e37c68a94c164bfc953c66e58b11fc280e69fd43b8f255839

CVEs (2)

CVE-2021-44228CVE-2024-20399
TerminalFix Shows Why Fake CAPTCHA Lures Are Network Access Problems12 indicators · Aug 29, 2026

URLs (1)

hxxps://linked-log[.]com/

sha256 (11)

026478003fe354134c03acf6890e7d3b153ba08a836eca42350db48f213872ab032b529fac61e550f5dc9489686f519b82d64625fa05a8d9ecf8ba8be9b2ad2218c2090e8a0ae0568af9b87e59eaf8270f23d2909600ed9db91a9444fd8b278f342df92235c9dec81203b837addaa38bb85b64b4a48fe71b5303ca86d991991e5d43abf5c36ea203176d3300ff14af27b4be81810ad2679b3a62b255e3d6e1c89a7b4dcd51d9251c177d323d6aaecdfc86674f69bc1af048dc872926d22aaa24b8d107800403b9197e5b7609ceacd8e4cac1b0f9a1d156e6dacd6c3f7794b36aba77feed86bcda49308746421bdc684a432dd5d68c363975b2a3c6831bda3f07df8221a933b38284ebdcb8bffc2df62123c9f5b5f421dd0b070e13e668b3eabfeb1b4be34d05b394fb74efdeb95faecd1d1963be6ecc1b9db2b4757b491f01f0ededeacf30e493dd632d477fe770ba419aa2848f685ea049381a0a8d2cc3e84d
PackClient Shows Why Phishing Defense Needs Execution Controls10 indicators · Aug 28, 2026

sha256 (10)

109d5c9a9581a4ccabd092ffb67bbc3a8e98e807239cd41141fac46fd107a7b735712dc8aa497371ce48a36975781dfc3a120ce5c99dc209637b05751bf4e8e938ec1f5e23f65b10ae3027beabfa0bf7f9fb686355a9e33c7e7e44e6a998e04c7108ff29916d064216aa2ece7fb395f1e3a73d12d19895bffc0bd46806cbf85a7295090c2cb63ebc43f932451971c41f9d015d2741e97ae3d9855f5ae87cff94832e68e12ebf62b60cfe2a7b45e5948fcc364a74c8d73c3748b267617bcfb24283d16cd963b1926a9967e6928340f099abf983ca496639cfddd9d63e327db3d2aa8cda8a9a7835a72d1b832985c5976873d2c6e791524039b809ce4441d3f69fda90b1219dcf1bf23e604b182b7737e188825df7205ea7b172231de66aeba293fa2ca62a47819417736d4edc59692bc920fb571d7eae468918f2fffc8920da53
PaperCut Zero-Day Exploitation Shows Why Print Servers Need Edge-Asset Discipline12 indicators · Aug 27, 2026

sha256 (12)

0782c1d691b485160b498887b0b196bc2a228f51f398b5271b91127c804fc3921d15e25718ed21d9aab74cf1fa30510fadb3c065a4444e6fb488a29f83ca12291f8e1eeda1d9c34be6e7d608a2c78e420a85f72112217d8e3759a8d97cdf73e82bde20ef100494cba154c38ae39020d5991b469765edb3472e56b5387b82d04330595f7cb15218187de91547bbdea88eccdcfa37857d6f35e37c035272b82f94530bba5bed0510add6be6d04c4e03759c5dc29d92f536481d1f013915bd837ee5483518f8c2b6668df2d9135436c66548dc96fbeb5f6f6f809f643a7128b88067b5d635557c19baa234356f270da32da37c14ba03aac9f32694214e3585862d39294606825e928d59fb175caf73ccd6ca693d776d645808092f26c964e7cd8dda9a71d111f2233634b91e0e08fe6b6f74a09f69e73ca09df1e9189594d1b1295eaae9cfb9fdd774d4260b50e7d4c9de70953f7a87eecc76635994d8913f41742f5e8278245b6e73901de23d86032207508d6b6e4720d90406cf218566a63454f
AI Infrastructure Is Becoming a Control Plane Attack Surface13 indicators · Aug 26, 2026

Domains (1)

oast[.]fun

sha256 (4)

3af9f25a4d45bb4f1ec5627cdbc6703cf3b4be75a892162d299d80ddfb266f423d24ac736635e0fa0c5c459c9e18ca09d1ec9a1751a4503130934395609bd7e049fdcf32bfe837899a84e8938f0d07ae96ddd218a280a09eb60df8d64597bd8ff64b88e9318bdf23f2dd119a0ce1dd1bdb3c8cd2e0e1e23ba3ef2e19072b79cc

CVEs (8)

CVE-2025-68700CVE-2025-69286CVE-2026-24770CVE-2026-28797CVE-2026-42271CVE-2026-45312CVE-2026-48710CVE-2026-49869
Signed ClickOnce Lures Show Why Hiring Workflows Need Endpoint Guardrails9 indicators · Aug 25, 2026

md5 (1)

4d6abbfc7c052cbafaa53659971ac471

sha1 (1)

12730a7dd9af98f14441d476c10eb346708c1194

sha256 (7)

112a2a6496d2235c7a73e53bdea9775b16bb1848be7a5e96436fdee81bb383bc487f15344db40bca9c8cd853d76cd3e56f15422c9db73e4bc2c2b6c0bcea28067866058c7dff4bcf691492ec4d4348f4c813226b1cfcf2adbcb5431eccf9b0b5839f6d29d0a0a79bb5ce0a8a0326f3dc8f291ffb87e2c55f68c23a5ed69dbf7299c4dcc677942513ff39846aba051d1baeaaa5ad083dabc9e3f9b49a522b0a0aa7dc0a626d84e17f16d5fc1096e4478298b2a4b61b42a1cf25043cccf846a50afafa019e18d44a47c615da188d7d56a15364ded87a13e3c405b195b4f48314cd
AI-Enabled Malware Still Behaves Like Malware12 indicators · Aug 25, 2026

sha256 (12)

1619bcad3785be31ac2fdee0ab91392d08d9392032246e42673c3cb8964d4cb720ed21bfdb7aa970b12e7368eba8e26a711752f1cc5416b6fd6629d0e2a44e5d4fb58687a364c3f6d6f7e0ca03654f9dec0f8832a499d61d40b0d424db1b1b145226ea8e0f516565ba825a1bbed10020982c16414750237068b602c5b4ac6abd66dbf939c00b09d8d22c692864b68c4a602e7a59c4b925b2e2bef57b1ad047bdb1ef7b267d887e34bf0242a94b38e7dc9fd5e6f8b2c5c440ce4ec98cc74642fbbb932056cae8940742e50b4f2b994a802e703f7bc235e7dd647d085ae2b2baf7c233aec7917cf34294c19dd60ff79a6e0fac5ed6f0cb57af98013c08201a7a1cc398b3e06ef860670b9597daed85632834fa961aea87164b8ba8bb2f094a14efdcf536edd67a98868759f4e72bcbd1f4404c70048a2a3257e77d8af06cb036acdd15ce869aa79884753e3baad19b0437075202be86268b84f3ec2303e1ecd966e622f3b743c7fc0a011b07a2e656aa2b5e50a4876721bcf1f405d582ca4cda22
Russian Auth-Flow Phishing Shows MFA Can Be Bypassed Without Exploits14 indicators · Aug 22, 2026

Email Addresses (1)

bounce@chamber-ua[.]org

sha256 (13)

125752ad7c20d715920a3b2fb0fdde660f07b3f2b053665cf38c2d6d9de86e1e1d9299799a7b8da67c44ebec064d64542c27645f8e84de4a22ca3f6cbc843e3c1e3ee845fde739fcd3ca9ce62c7f142a7c501d11db4c4fb294d4939f12d0f91620e20b074967ed6f6e04d609ccec5ff7492665ef25f894c90c2ddc92fa47ac3828f622028e690c943f7fa9aca426c07cab52b5aaba757ef8a3328609c0b3bec32c7f4165967d6f7737b3fef87959846920b57a5368b531ad1427c7214d4c41a2403b624e35777cbc07dbe66398b21bba70396a20b859c880732338ce1dd1f41f5b8d50c2e8cc3038b7c6e6dbf1219f6e814930a1e3c0053143a1191ae67f8ffc6f7090895c1c3dee30de6b3f098ca3a788dc198646e5293a8b1210430b0add97a06a8fd1b6fa1924199a4540cf16d089217ce8f78c617739946f145fd1fc88c1be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42cc5826032207d623a7f6caec8465af7364eccc355f9a48897da2a54f3e4420265ca3be5885afb3eb3bb19341e2653212200c568f3f900e0b2f04de9ba209aed25
StopAndProtect Shows Why WordPress Sites Are Attack Infrastructure22 indicators · Aug 18, 2026

sha256 (22)

0080d0dd72eda4850a02e51c0e5c6f768423dfe970cafae2ab52ceee75972b4010babb15e08f9fbd72cce11713a273b971c910dd5bdb989a3f6ff4d9c8e372c011a635d70444605ede1de0aa227a9fd7cfa4554e75bea93ce18b639ca571a42e23cbabfe3ca3a7f1eb365f772d6a4ed8095cb8f7755622cc82e804478259dc702adbb2c206be7f23bf77f8f50d1ac0f809511c0b4591421931f81a6eaa42c68c38602b76f6c65644b01fa4d81708251c159a883253cda8876396dc7212324ab93ba161ca7b8dcf389ec3236c9ddfb943e9d1766181b1b81a227649cad46132a83ed8f2cc8da4853fd770ff38f0cbce6d9d4a84e75a828fc0cec3e3ec60db94f94dee2fe98d4da75ffb259c03b50202212dafc85691429a28641a8068eddea50465550f6d0ffec8421f703cdc7273d9c0563b3d480fe6702bad294a18afe72143712e557373fba45bdd66d52e395b8af7ccf7006e6e82d4e1db0736e738d0d4fb7d3604d0728b242c72bd144b8661ebf63c1042a4f5dd441bc8c8507c701df20c8337bf29100a5871b1275227006dc2a43b21b751e5ce7e2032364fd78af59ac58d1e23630a6695fa9c793d73832f59436c98bba30ed81c16d01b549bd17feab49765b1342cc7eb982a73bb1f94c6c500b63dc817073b76ea926c1097078d3527976cfa57e1efacbe517b7e3441e9473d275ec1d9ad8ab69ddf8ae3a966aaa15399bcb531d6dd3c93d3f28f03d6e4659c865a4ffbd2fb514e809017f3446a940bb3dff910b350ace27d64cbd79405cb154a1967e366d7b88170c3e8303b1d08adb79b9b027f76579555069a7506d946648a8cb3126c0dda837dc9fee0e5c79489cab7f141fd6f2c58055b3731ef6a64b8a2d4d88a974770b047da19c0904322f0cc8aa2bd7bf74ca0bbc5cb03a7b18eae73094b450d11654528c05685fe12e0c9f042240c3de00c46dee625916bf246b7e87481e4081a6a97208b091409766e41
Signed ClickOnce Shows Fake Interviews Are Now a Credential-Theft Delivery System9 indicators · Aug 15, 2026

md5 (1)

4d6abbfc7c052cbafaa53659971ac471

sha1 (1)

12730a7dd9af98f14441d476c10eb346708c1194

sha256 (7)

112a2a6496d2235c7a73e53bdea9775b16bb1848be7a5e96436fdee81bb383bc487f15344db40bca9c8cd853d76cd3e56f15422c9db73e4bc2c2b6c0bcea28067866058c7dff4bcf691492ec4d4348f4c813226b1cfcf2adbcb5431eccf9b0b5839f6d29d0a0a79bb5ce0a8a0326f3dc8f291ffb87e2c55f68c23a5ed69dbf7299c4dcc677942513ff39846aba051d1baeaaa5ad083dabc9e3f9b49a522b0a0aa7dc0a626d84e17f16d5fc1096e4478298b2a4b61b42a1cf25043cccf846a50afafa019e18d44a47c615da188d7d56a15364ded87a13e3c405b195b4f48314cd
Evooo1Bot Shows Why Exposed Linux and Edge Devices Are Still High-Value Targets21 indicators · Aug 13, 2026

sha256 (2)

4c0886349e9d348569fffe1b7a31e474d514508bf0cd6f1e5dd99c2a73525e4df13cb360768363d3424e2192c7805b8c8015eb8706dbbbcdead6aed8cf390109

CVEs (19)

CVE-2007-3010CVE-2016-6277CVE-2018-14558CVE-2019-14931CVE-2020-10987CVE-2021-36260CVE-2021-46422CVE-2022-26134CVE-2022-29464CVE-2022-30525CVE-2022-37055CVE-2023-1389CVE-2023-34362CVE-2024-10914CVE-2024-29269CVE-2024-4577CVE-2025-10123CVE-2025-1974CVE-2025-55583
Lazarus Dream Job Campaign Turns Fake Recruiting Into a Windows Zero-Day Intrusion44 indicators · Aug 11, 2026

sha256 (40)

13d10bc99f7f7abe7ee0902be87920b73b2ea41bd9683dbfcad340dacbcdef791de949c71efcfb0ffc41f33d38833dbc4b082075b1a540fc68c18c535d7ad86c21c3ad4838c4324bc5f081021da5fb2e9073d0c9304087811c21eb47c9e22762231b1ef8b95bf77887d5377e2a60f649035e78f543af1b82877db36a5759d85829e24c007549e51319ff3aee011da6f9f93568e8c85a5ad69c9e53bd3f4533a22b4987c07a3d9a9a5d1a9bf4efa3d1903e775090b611710edafdc92874265ca82db25ac41a66aa523c79e23e00443573530dd7bd82b8371bcc87bd7232e141eb3601060c62edeeaa49def6a13be6e126e1024ce011faad4e2d9f585ccf6bd5a6396192d92d17ace1a521f1351eeeba2825e60badd0d799cc5c338e4934b3c82c3a02d0d798e8d35555776886d92b20ff38a101c9ef7e0eebc8ce5d259516525a3b6378df8442e63a6ed7317075913e4720847a510d95022d4a8347b2637c245d4c9b804d6155b29f1e27a9ffe531e10bc42a7bdab42f905b50146bf2026768d94dd792c9f672bbdcc8d363d745994efe90f4ffc5fdc2c059c8e379a48ad6a68a4ebdce2f47c23ff8c9e8e80c8b5239c7a5764da31cd3ab8f0505926890adc1054fd32432341dfcf54d0517a6bbc38e5d265be70933493e4183c2a340cdde9a2d5278ee922838352f1480a73e971161017d643a80b7ec22bf725897dfd088696d590fb6ae19480d694e08ee85859cad8066f2f87e7e5abba2960c6d115e1615d668d4fba7b1300a59cd6212c08910a260cd71b40cd9f51cac933030a68faac0bb6da9b1e6f3315ceb77dd14a937a26cc3602bf6a7e2c2ecafb3c65ce5319837be72dccae85e062f541fecad9ec7a18a3123e7ae5ac5d53c91709b53a46dbbd289743172aab606974b054a64561534ae66baa3a840657f79d7c6fa18350e8d45d175b93a7103b0562f6497d30052c0c5cf7aa58c1bf0e9297022b74469a7f096f182268052f94df6f4870d02e57b18d4c54136cc7a8c8d80ad162631f99462c9438ce6c29f92dc45b1474417cbdff4ed0c18e58fa63e3a071ee9f85aa9d2aac07c92106b0c62a0a42678232f8273f030b2d3c8e92efce81b98b9eec70cfe98afa1a0578a2b7821d7e2c573530648f26d7a0d98b373ab24fb7f0c792736761e542da45144d22cac70a45d71cf4dffa4efbc373658779a56cf1300d6ac863d6cc7e2a673ae661593c0de9bbb815593b816a6853dad6d55ad5042d2ef1875cd13d6e7a738059ce07c951c31ab2da3d93d8f69bff32f9b7d933dbf5943441b9cc99075acb97cec84e08b89f41967a24e965d1fd2c51751cef158f7aa35bb4306b87b97b4082d21070d9ddf53fde4ea22524d09e41ec9826ce63cef3c6235e458d21afbba96c603e44046de703c67b2c3b7e4ca974afef7b437a0244418bc4edc781bb7c2aa28bb5e2a749c693712008276f311edd912f689371ef9e8a1ee5fb4167461cc4e06aa378a190f71384c03023bb3d18a6d66e297d46701220e132963d2e222d578c28c9afe7457a0d81f6701332ef8197e8f7468de654935fb29a50ea66459db3d69b7eeda2e35e23006bf4b7e206281fce809584207214fc213f9bc30376dea7056f2bf36c66a61ff787ff5be975a85f534c3c5ca178791dac2504db2c619f7e620134ca935067797ab957317b346ce0df84a4e9b9ca54a6acc9b75afda4dfb3fc5626f68677fb1269a2fefbe70e719211b4065e836ab92e06a8210139a2dfecf12088843801215898442bd1ff3e266f29d14e29a94780e857f69c4915d6b

CVEs (4)

CVE-2024-38193CVE-2025-49113CVE-2025-60719CVE-2026-68820
Aeternum Shows Why Blockchain-Based C2 Is a Practical Defense Problem32 indicators · Aug 10, 2026

sha256 (6)

1505eda3da68e2ff9919b55a31018bd30a991236f041aee835f3bc4e430ce5054e24bbd0fabac6c3efcec943046afbfd332b2c0108a13becfda23a0e26f9ff5f5bfb25b8255b61e5ffdf6804451534bcfa9f1dfd225e6c8cdcefb5f50d84689881bb80d9c5a97dc41b65f6248c131963c91346eb4fb672836b3d53ae67564d9fea1b6ff3a0c1a749b9f09d66789973321d63d8896b48f7345193bdad512950a2f2a326cff405299e4ebdfaac955c52fc7e496544eaa0921ecad4816cb3ae3a27

Ethereum Addresses (25)

0x04E25a563f159308FC3E15fE9Ccc9D2CF623D0cc0x16dA95799CB8aB203f83e01AFC030B1217198Da40x1D50703722729dD68e89D819F69eFc5Fb206bBe70x27c7c36981c1ed5cFA2DCDb4B43C27A6BaF6bEa80x4dcE7d4b1229F3705BDB70341484cF2EEE36432e0x55b4F951d5Ac035C21B170C73C0A930a641b718C0x6da31EB2A016074ffd5519326573E78E2677E4C80x737791081A398151195a753Fb49f9c1b8bc1fCDB0x75cD25791A60ab3451E2d2feB5ec46c6f541C2B80x7D2D8A4A6E8D89cf5C151C4f68A521490D9779B00x8d2BaEc2687F59eE1EE7BFd322D33325f5E004ee0xC37fB924cF5996C9e676BBA399bDfc5F936B35720xC41342908f98E813862EDFe47Ac3af676F8098C90xCE476E6f4d83a7a086Cbcdf0FE2E8f221e47e81C0xD69A36439FffD145ADAcacB94fDe6f8b3546a3610xFDB8b139EeacD17ea7c10c256eA77Ba6Dff18D7d0xFdfB8c4e827c2d053749C8F2f2058548dde0d0730xb0874252a7359AA701F3F144A1f03A6e0DA8aE6D0xb3EF2D08Bf25a7daB9d8b98d64E564eA1f6Db9240xb8fB2bfb182A172b29C365AD6CF743449975C4180xbD6e817Cc510EC3DA5651B5a3AC595d34C0CF1af0xc7199C1dbCd82c4E002327Aa3EC9158F434a6aCE0xcaf2c54e400437da717cf215181b170f65187abf0xf9438b4E3200AE1611eD3d03310c803FDdf676720xfbC267200f9e5749045f32dbB55BB16615f1CE5F

Monero Addresses (1)

82pNS8tBnvZ5cmV1iU9cXdQmhGz95P18fZpASBrxtaSF1ToTmZtf3HGHrdXMt1Znuu8BLU17koPs2hTXxTajdTviLcgbbAi
July CVE Data Shows Why Patch Priority Needs Threat Context81 indicators · Aug 9, 2026

CVEs (81)

CVE-2008-4128CVE-2013-3307CVE-2016-20016CVE-2017-17215CVE-2017-5259CVE-2017-7269CVE-2018-0802CVE-2018-11511CVE-2018-14558CVE-2020-22653CVE-2020-22658CVE-2020-25499CVE-2020-36847CVE-2020-8515CVE-2021-24139CVE-2021-27137CVE-2021-29441CVE-2021-3156CVE-2021-31755CVE-2021-32305CVE-2021-4034CVE-2022-35733CVE-2023-25717CVE-2023-4346CVE-2024-42009CVE-2025-12057CVE-2025-12352CVE-2025-13486CVE-2025-28137CVE-2025-32432CVE-2025-3248CVE-2025-34152CVE-2025-49113CVE-2025-55182CVE-2025-6389CVE-2025-66376CVE-2025-68686CVE-2025-7443CVE-2025-7852CVE-2025-9491CVE-2025-9528CVE-2026-0257CVE-2026-0740CVE-2026-0770CVE-2026-12569CVE-2026-1357CVE-2026-15409CVE-2026-15410CVE-2026-16232CVE-2026-16723CVE-2026-16812CVE-2026-1969CVE-2026-20316CVE-2026-25089CVE-2026-29014CVE-2026-29059CVE-2026-3055CVE-2026-31843CVE-2026-33824CVE-2026-3395CVE-2026-34486CVE-2026-3844CVE-2026-39808CVE-2026-39987CVE-2026-42897CVE-2026-45659CVE-2026-46817CVE-2026-48282CVE-2026-48907CVE-2026-48908CVE-2026-48939CVE-2026-50522CVE-2026-55255CVE-2026-56155CVE-2026-56164CVE-2026-56290CVE-2026-56291CVE-2026-58644CVE-2026-60137CVE-2026-63030CVE-2026-6875
BINDCLOAK Shows Why C2 Detection Needs Message-Level Visibility28 indicators · Aug 3, 2026

md5 (10)

087499849115eb28c4364581d2b28d0928b47bdf16d7af6f8ec21218eac9145a3f60d53a2b5737d77e058d9e33cbe9eb68926e6c958562deaae35de3d9f59de378a4f8574830bf7fbaf63d7da09be2b87a14a99d70d42d3f7bf72f843185fc077cbc51ada1a4aec88660ec32c408114b97124a93766be732e8fef5a56a5346a2b776eb638fbb535708fb92b12fcc1731c99f29ac08454855b3d538960bb2f34f

sha1 (9)

1099bf51e53bd5fb32401edb4e0be841d8486b192377c47cfde148c2140faa7105628174f9c4d56d577b1cc894636f4ac5ad670b0079b9b7ade137c386ee99f293a30720bcc898a4a8e391f93fb9be95c1f16e31ae71372ee45fa6fd6927c7b887a4e3f2ccb2002fe8f5cc1f511d52309625b52d1c507421ee287d6a09295502ab2407aec336f9f0d8477d68f46c01a5be2e08e36d4ec3302a8650a6ed25ec14fee6806c96f87bf1e240a2eb6fd7e045101d58d3

sha256 (9)

0637069c7052118fd5c0f1113541bdd35e5f71cd9689f2516045da152c6fa8d932529043d15e9111ba284f1d8a9e4b3f58e071c6b69c8f271d4d02feacd44e663b0c658ebaa2bae80af97f390b9b2bb20a2f815eb584b2251255e84da4fa669d3b3eaea783fd6dab90f0408274bf8a9c49adbdc70c0efd70658d65b0e1684a3f5c2fe953da53da66fbcbb3be0fd6b63907c10714c337f287b2fc258857bbff6d789fd11285642861190dc074c1e9a5957073f1a2afebd5160f9cc907f7f320bdc84542ac30cbe9bb8bd648bad323c37801023bf9451c1c0990452466e084340fcac1f37beaa814461f7709a073aeec468c74e5d70f7d693a9e367ece4a3a78bedb11ff3f37a8b2aa25c480871504b886a6364167ecb501eacf7345f6bbf9582b
SonicWall SMA Exploit Chain Shows Why VPN Appliances Need Incident Response, Not Just Patching16 indicators · Aug 1, 2026

Email Addresses (2)

abuse@ordertld[.]cominfo@helprans[.]com

md5 (4)

54d21399b8b52b48a0fef68450593e455cb00bbfe818ee3e85fb99ab1db1af7c5f3a55201c511c9ff9be4c16c41028a2b6df166291f80ee89032d769c99714f3

sha1 (4)

04d4a9fbb32e967200eb98be014ca914a03bfa6b5e5b716f2385c818ec61198be1a2a07a4560eac5b4ee1f50fbb49f0ff5fde3d026343bc23ee08d51c2b0ae0a1f42a139abe4dd612676066ec1426394

sha256 (4)

1e1e68bbb899450a57274a8b12082ed4e2040a2aae77014f20431689d2b4edee81a9af3846bad3a1107164ff7cf0a08e020b31a3b32fd17866e17d4c1565f7f28c470301dcb7278f73e622f1950073567b34011c64b60cdfbb0f89803923a5a3ea9154e374e4f77bc2cf54282e23543573980342a85bc888cb23f20b8bbba081

CVEs (2)

CVE-2026-15409CVE-2026-15410
Astaroth WhatsApp Web Spambot Shows Browser Sessions Are Distribution Infrastructure5 indicators · Jul 30, 2026

sha256 (5)

6168d63fad22a4e5e45547ca6116ef68bb5173e17e25fd1714f7cc1e4f7b41e1a1aa786e02fb9a37a71e0f76b052ab284ba877f2aaa2fb28f05d60487389976ac7c62303ee1a37fd7a6e2db9c590ba75c647bc4d22d7dca50cfa8879222ac9e1d89105c4d567a95f674ed6eac538e32e288b658a4222a3d52e284a77782af4d5ec43a17685e3a555c2eb5f0a2802e9e45d5a2a5d49a0803155acbd74d9ecdbd7
Autonomous AI Agent Espionage Shows Why Post-Compromise Speed Matters21 indicators · Jul 29, 2026

Domains (1)

java[.]io

sha256 (12)

0f8c905aa25c86f85454acb7e77bf5c50220c2a82e5b69a33741e55c8a85f2fc2a4cb412efa93fed7c3b3b3e49d6247b11a95ce9fddf71d9fe9db8e5f0068e0d5633bc0033fde3aad929d6cbd47c554e264180360b017aae04687c2d6d83f753576c70e12be8b2e8e7c35a5feb082e90621989adce8e64400126918d37f13e4958338a93fee4e008ea28e459c4d1598313d1524763ab13894ab63bf2bec4302a9ff4b6d3b7dbb023bad65d2538ade745d46b763e5a12116c9c83aa2f6f5d96aaa9447ae174f4aa54f760b7d7cc985c1a970f31e151d3ff66fac247f99ba1b509b65b7ede835ebba36294d52d7780065523340ee09bb8b209ef2dc495e53dfd53d252ee7b348b7e43e432d8fb154465838f5cd5fb564905323460e6f0a0c7d1e2dbbb8a11a239da11cbaf99f847a2d032f34d3b522e13b0fd4ef7b2649da7123bec7e9ab43a0cc65d29f0b84a93ba88c43d01fed3dec5c968525dc73c03cbfda2ff662b60f6a142f99292fbdd65dd1ccd79dc9628686ddf5935c92f7fb1b62a81

JA4+ (1)

d5dbb3783b4_7d5dbb3783b4_e1926048963f

CVEs (7)

CVE-2017-7269CVE-2021-3156CVE-2021-4034CVE-2026-31431CVE-2026-43284CVE-2026-43500CVE-2026-43503
Fake Payment SDKs Show Why Dependency Risk Is Credential Risk56 indicators · Jul 8, 2026

sha256 (56)

1314fc888ca5b3ea91a04e1f5b63039ffc7fc3832b8d809a28ad549c6f9d4f231bae9f2fb9866422f07345501fa2cb4c3a99f2652c8c9decdc27ffbf9714e7bc1bfa32548676d32b7639d3171e2f9feefba5026dc336968c91f4ae2b152c54101d567795a366b9edcfef7f1fa2d398b7cb41890dd3b2f3f1f9803de0cdba0c891df8c579ffcbf5527b1856bd1774601a5188b380e442c5a0fbd400bd86a4501b2303a74a5fac917279f1078e03a4bfd6afbb89462f97d7344ed10e6e9e9e92b72b7696575278e6e223cc44553c687e45afd04df7eb32efbf49b39da64b7959822bc8af4bd2f539630f7800f3491b64c7e2bffe12e955d0d4f03a4f6a4b0018bd2cbfc4e4b1de5e68ab81fba7e1b0c711b4d26197b48ea4db6819c9cea223b0ed2edb3f162f9676196e818d9b795d599ba119a961ffe98c4866351735980d213d313853a82bce61052c00e6a6af85b5069e007a76122c727f31661bc636b12f14390bca9d70efa42cb792f7f677189821a24527cd4298ab2acb954df0abb5c1c339371ac7061168dd3d890061267b3875bc4b30dca5e28d40dbc27a4396439ff13a0dd3479eaf85b65e5abd63d6451f98506faddee47cf4bebd9f91296abb29f0447484c76a06918d7f6f6c6f95ee2bced6dd2e9b282c6f5b92b2b7c0976381d54a4b5c1bc1e948c853cb0978c07c7b8d1540c7b1ded95f8d5ad25c126cb6c7b050cb7550224d8d227a0625e7f53be86924d8e057e403b6b91b83ea20df8340485242c5086d75a492d14e474de7c8f34b18ec0a8a9ce6d77eec8675a9572d9d2352a57c502e40b3f9897d0ca32bba6f844b4113f5c017627ea9eba660eb47f4055c4faef80c83c7ec0925a4aacb4bddabe82b91066ac41305907ba277cd7b3b855cd62e708ae4393c99579ec1433571998299bf7e2fde9bafeb9a79f8bdf065e9615805652b2f006e69512b90d0d63883d7ae1ede69d86384fd77bd46235b2369616b41657e9afaa9354fc1a106393373dcbf8aac8455b7d2cbbb44463434528e61b61dd25cd8dcc43cd78418f3e3eb3fd9002d9e49961eefb12c1022ce4c3b6367e4d6a4f53098e48bfa6ecceeaa754592bc249b83404bcfb8542977ae36dac467eb3bd505ebfffbd73fc3ef0b2976c375df732f0bd0496ed6653c3e2be5a0e56dc672e3bab8bcf80c66b2f95150067fb47429d4cf65eb95215e5f3abc7cade56e251c3d2bde8fff0487c1eecd359c4a544a09fd708755020e4b1c53ad6b8dd1727fe9c1dfa39d6590012e0593c9837c628fc2cd22aa0f4e486b7ed1aec026978a58e3ed713c1c70f421ab56a18cfb6a120c960d227e495b511c2552f25f188b8a70a5c1075f2dea4db94633ddc64b0d03d0385fdeda7c226acc944331febf439727c804c4354e481d2ff9d4934bd1b2518293a9ca34a14f5c7ae9d0cd30ce949e9655f54bfac8a937d78ac506722bae1468ead4cc9ee95b35e0f8ef17ee13d99fd06d823d54183cc91625fdc6decffe8db2863f6499a955656ebdcc089792cfa0313822513f9b89479f666888a4784a3fc99b4cc4566213dcda66b03b47120ca677c02e545941e43f8b21a5761b035e911b53e2c065fea219e0f3462f282fd8af66bc2b516d1ef71af9b6ee9f8f5af0a99fed562b34809cd55071b94c2d1304b04daeacd1d1c9020cce2a97fa7af83dbedf4e6d17dd12c0f337f32240399785b157a66826d27512c3618817fee924e53d14cabb2c4c7f454affde37350f55f0b29973eda4d0c090608c15a976688cad0b2114fdc0dcb89ad37515287ba13aadb2ea8d69f6792a87327ffde2ee4551bb6b99617f53e1ba71bf9a70f45dbc57eac2a361a7d8feb95be97c957fc7652d348f4fa9a987bde5f09883f46b65c460f1c2a69a33b086364ca51b030b6b15e99be46ce8255ddf62839a4fc7f2b34023dec2e4483abea830ba8b8230540ace51788d0712bed9006697ddddb9cbf133c151c51c0b6c7817443b021aff44d4416c09fd039849db81860b9b5144e789fa3987c6af37a6739f0d919ab7049caf3a85831cab44bdbea27e0d9de7adec80334e2bc8b4d17c1f0aa7c50f2fa23d7c328482a4ad2c4da4d600f358ebdf200cbefd83cd7255730b6a7a3895d622d37d0e8f984d2d280689acef56ff195d663e7723adce09810adca70ebec87bc455380ef629ceaa2a0d926149d9115604060167682cd1889d81cfa99d52017732da9dc52127d03893037874c8671943cede4b8d1bb2d4ed2d87942fbefa5d7b7f19fb6f2e9bc293c96bf577bb97ed3ca56185abcf25dabb47d75f2efa6a5540661484efa989ccb338f24938b23152f14f3e424b0cb5e076e13a7e112d364f03bd1ead7abaa83249d544491621254860ab0a73adc9b9eae055c5736366811d2a4b1f78ff206486e7f7445040122efbe023ecd2d20bccf43cb68850a2506805d60ff466f54eba331e1cc2a513b329f5121e0c39104418f7d9865ea3874d2b135eeee0aa0d12fc108d89e1dd706e4e40eb7605b76d35ca
Vidar Stealer Campaign Shows Why File Size and Fake Signatures Still Beat Weak Controls105 indicators · Jul 7, 2026

md5 (4)

1aae8bf580c846f39c71c05898e57e88c10333c92889b65c3590ef2b3819b420d42595b695fc008ef2c56aabd8efd68ed8b31f8c03e0c76ff245ed05a15ffe6c

sha1 (1)

ab92f731ab20774dfdb95664ee41a2fbafe2a284

sha256 (100)

03e6f4f49cec3af38bbec9ed64c195c7a85a630ec989efb3669f04a2993c1dd7097a87cfa4a5186aba3bba096866692951bde59c6f0c2e8c1c4a599246d14da80a6a67a2fc4d79ec1cd8afc5b8b7a5e69a406e53d57a7334e097c5d0644de5f615489bcd6e4602b41c9a787ec8d7ab027d5e45d400938048bb1c702ad5937980169a330353e53a409e0109c914404354741ff1e1c64e501738dc05e58ea92abc201594c9d173bba6cb509407ecba378c19b93da0a81a2182a913c480e6dbb54e20bf39e1e67152039e70a01ad9e7b23c08d23d2a724ef9c44903f3d4353a22752a02ec4af5ed591afdf1236a443e3b68642ee133f38a2857d1eada51246ab4982b7297a5f502a2e9a59066f0a370bc5a8b28addd0e27975db3d770f801c153972c0b344af415b787b396c8e23bbeb112bd471a1ca1d12cf357c48e2ee1ae068c2c6e8f86c05781af12b323311e83e011f1a603928e2086c48e2ca59e33d90dbe2e11a16f94484e0f43eb4572f800f26f0b4a1314cbdae3c44c1ae35f376906d82f1400a91c853d61622f4d21ed97d96ea1093c0fa1586669bea6f6baa331251f314ce675c040c63b825f213965f5c76a3bd09bf70e138708367e2a84e9e84b3032172e4d8d2ab9fb29b36c9b279117be6ff611b5b91ff7b1c42501a5ec969f2b330efeebba3782994612fdfe20ff96c930af33a83b88a342b6622461511921b235b51bbe42edd15918b015eaa1b4f0e6b5c94f186d71d887e39f1da69a4dec3f35dde1b2482b12582820a861e7c46f10721af6b75052fc872c05d2230a4e8ca13c3f12531045b7eedfe25e0f291d4792b0d8c8366f8de043e2fa8ecf34ccb9133db33b0423bb9278db267a7adb036ecbd6aeebd7909d06d824919708b1e12e1b3e906ae47e9836a591f44d4b743e961d634a404fa8fd8bfae64f1d54c853be2b43920ef7d2742d140a1ab2a1ef172c716903474c73561377dc4f1534d2c5f58147d6d1a38534ba897a5a1e293e3d5df303bbd8e0526e756ad08887ffc1417bef488d941b7b4428b0f4a0e5495e3857b9b96215fb3e7f164b06640d59096425e64bf770a59d367b532dec32668f86003b17d93918dba5ef5fd2b19c53942524364f456142caf590d98fb11ca247800bb417766714527e5a4707ac2f5d0154262653d263b292be387843fadb7131c2d538b4262c81f5b95cfacafacf2d5446c06e5494909e0f5221db75e933b28981b2d0e118f227b7d8a5980d88b500b76dfc2e54dc05ab56244444f86d69b8274a6075906f7ba2307b08e08d3884abde255495559f46ceb801a3540eace594476718e1486b5b4423cfb4ff64530ff8fb4a38155838ae6c748dcbdfa13c6529c654cb821897d29835d3e7e05ca23fb2f3794f0259b9153c4c9e155c976db1a2fd4d1b28fa10bb9c4dcafdc4758b352c037e3d865b6a466b65d479b77a03b15a95ac097b45e23ff7ae5ef6282985b2a503deb6915d7324d8b5a25f862ef8223c6766d0e80af3ad168e17312b265e13a3a68e0ded613e5314a7ded3155cdec49fd34e852e181f4651d78bd8bf3adad2f4dbf22b0d62877a5096828c4bc2fca7cbee7d38b11a0c90fd0d3fc8c37981581e9988c919634e89d8592d7c9e2bc1c098217a813947b44a4f80bc569e9a15c1e8b0864b9167569adec99fd38b114ae07e2e549e6c16f75368f3c5373022c84934ed1c8e8468ced9d7c1b1ff8ffb5f56c7d3f849d4fd16a1b95324426811424b40043d6d2569946018ddda1058ce5c2a556c78a747838865c47074dcb165effb0840cb1cf56b7ff061eebeb9ead8812c410247768a7ba90786aeeb1bafa6412cc5b08237b56d49233b1fca22f3823e856e4c16749e9c45f384ea57055fead16df35b21722671c79e8bf71ed257435ea9b8b91e118ba03ec681860651190f7d7457804313ee739cdedb20de39aeb1f15dc8c2dbbf15fa993250fd879bf87443ff9aeaf4997b74df77b6a83d89fa137fd285a2efde36b1d62c00b3be81cc93df7d1e6e94837b7720e83c02a027d70ae201c393c1956aa2fa8199879a3a4c4fd1d20b03022cfd77469615c5f548063922b469a8c0a4116511395d013e5a798e123e9c119acc4b7828e17e674507ab13dfd84b31b361fa19b9cb27ee130620ba9211feef746d317e49da0ae2f81e14841f356b4d69f0480c2d9ce3fab5a3fa91b0036d9a36fa0f7ed4a256e1d281cb4f194d13ff554fd4fb280dafde0a67a18115ea038ea6c87d8b40cc7d173efd27fb60f3d260acef28f58d67d1f39597e1d611db311a305f628dbcde2a28a0b3de201214d7e3bd43acc97561924daa247c05c4b0536d42be85901a43b42f997710147295a0625e20c935207f8c531daf5311449ec119a37dcc914c18a04a2727bba9cecab78a1d516ec3c7a3f667e0e5a6081aa0e9206a69fe94db6fa14b4e487dffba709b87e8a7e25483300ed409de243b19fff7cf2f097895cd48130247525d8a7e966bd3fa07e9d6c39ebbe3058ecccb336f66bb8e3d1e9656d3301f63ef6114289739a1c44082206298f787238fc6c190ad87eab2475196bb418128deeb2b9d2e4b66b98cae07b238b326b6456cc9b86802e67c504a0398cce1e69873de25e5139aa848f469bef2af345a8a49d15000b5b5e72b5828969b3df1b6c1b98c201de09a7719066f7bcae6b66a3173b703a617f53fddf67d51a1039de7ec690d64db9d7d91f3d777d308e49e958de4154aa0b62ded7820f1fea17a972a05afe387ed32aa2986d5be8bca2f22619d0aedfa834c6963abfab3bfa4f979b4a5d7bc8bc455dd4c09b44e51a389576fccce35a2c8da3ce680237565a64843ebfbc39e96ec7613003b1b5c3a9b878874ea15a05e1d34ce91781ebfb6a785fc61fc4ff7cff0ddb540bf7ff12111ed0d6031f78f48387a6c16cb3c5451aa0083f662f055e8d911c5de3a8f3a31b3c84cacc7dccc30c98f2be14dba4102aaa2bc1128d8b8b2da76262bf87ede19bac053cca6576efba6aaa71c9438c304b58814fb3ce5a085014ee6e8d89f7cc1380b234b97170fd5f3398031281c6a77b6912c23cccc4b0964d55608916297f6978f0b38c80a4beac472004a786fcef7b830f043076a12748b6a2dc0810ece85439ee77434d991ae7d84201b09ead756b8b5f6991a3a61083461d5269245bebf28b90934c328848ba8c1e084a5a6216cb927d265fa29e471c1ae0d31516e480c09c0fb17f480ad08ea8d5b73e84b7a1bb9b6893fa6b04ee8daa29e515c08239ac5204af1a1fa2bc10006eede1b41329bbb30cc2b302d9a6963109b201b78d4163bb6c2d7bc8bf5a66e9a744b62fc2717bd3230e4ceaf32ad2248ab069b164bd2144401967ac69de0a4cd1734fe429d9cc25799facb3e788830bcf614f33411d3bcfc0edd4a2200e160b5eb4ce700039fc328b78c21060e2203ac517833fce41572b91878e187f85fa434cd6914659834c39fedb662259bd76b11616966c41ff1fbda58d9b129b9c1bd818700eea92b29c7a4a547eb7f6b0b4b75bb6dd8955244bb2618ba234ae740cdedd7c2d30e3465c7c37a973b14edd5b6b2da4a1497c593e43640735ff54aecc9a3288fa5e548e3ca8a00c9d36c64e5dcf562c7ae2b8df4bd6455fe0b41b32ee3a2a528ddc2d155ce379de03e35e0ea2c88744c29b9e2678165214065f9b957177002c6bbe69084d18369be4487d7cd0e4bd3dd0da720672e56e13ca43627305e26767e26925551d2148a458da46e81702136aa915312d360805f083d1f37ff5531db9fbdb8ad6dd384c403c084967d8c967501ee6332b050af04ef424f13a3f5a88d155389d98cd6446f2803444bd2200d48a01a9ad7d487e67e8e831c9cd13f89cbfec17fd4e2d7745513034af14617436ad6b3fc125fd0343218411d0c79bda56b0dadc86b2bd78082dc33c6dca98316e865efa9829c6eb5a97c2ca3cd4ea6c2123a5f6ae45bd7b56818c829960b692de9ad5a14e52669d953e9f074f7218c3fe34ede4a11a0d7c9c9469c513c05aa431fae34f414f91fcf3f794d3e76b6e4d0b92c4cd3ff2ed8ac0c08e4c698017558e532974cf749135d3d49757f05001e6127dc6e07cf17d8c1f96107a3349e62b3ab9afc60f62af9c89b6961b637a26b71e1230f2b3b8adb2a872f712fbdb1e347d06e29a9ed8278d86710ffc14ff04422be76e47124f4dccf9f008b42a04f7e69d3bbf7b5ce81e71308545d6176cc4763920a424e5ac1e5341edb7c039c456d46c39f194be86ce4b41725d7ad12d297d18aa99cddd675e88c41a6f769cd760e323b4f7c01835433cd4059cd59630cb1a9eb1181b350ede9e5e748ec5c0b811c8e60b0e55059edb4d2df86ff3ca45969e57d5fecb11a38f0dcb7e407de85d8de8e2221df8dddecac8aec88af8975c9f07e14100f6edb88f13f9cef5cc020bf673c7f4e19c93c312a043867f46796a8f01927a9a14c2533f760bc16a585325ba9d74917f9e0994d3a4164c1141158c799b619d2c823e818
UAT-7810 Shows Edge Devices Are Becoming China-Nexus Relay Infrastructure80 indicators · Jul 7, 2026

sha256 (77)

0352f3e338261d98895df4c7b7a76b296485b2290c72bce56603351d167d060103926e3da998f32ad898b640bd15cf145768f9e849e6f18d81350234254c424e08701ed7975bf4f5688c2724d27ab497764200ad6f4dc53d3cc03b170378ced00a8555a71868749be8c905ed53296ce335af50a9262772b5e154ad3f9c35c2e40a8cae96e25e85c612b0736fe886f9b124ad70ec425bc2ec1a8a4135b25436ba0af4c52a1d13e4132a1843ce7727abcf0ddd4d1ca6a4b17cdf599ec3f355c24113acadb3541e75af50e02d5be56c2238b93d8f154ce5514be1558e6ee59a14321660536f448b8b9f086ce9ea3ce4e9deefc59a76711ea53ee6d8f08fc8c1bb9916971f9706d70ac4925651c7c8719b9d77aff63e4c0a618129efc32c2c46b9891b5649b479fd625de5c8120873644b5eb669cc89cd504582c18e0ae350fd882320fcba222f74dd68aaeb1f0ad30cdf702a828ee164a182b30d05d600c35b72d929686c933cec1e274467e2dae264625ae6f754824bb7f550bc9c3131f625562c29c7fccc6ef8cbfe4da9a169c7c74bacaea1fb515a1fddef91ab1b1522f76e4c2e0e43776e2e1a37d882a1b2ebb7d337ee88950177e43831dae645a367824feb2ebc1b6cf543e2cb3f22d9a5b54b6676bb71dde98df7532f8791297734e44fdd3169a6dbcce684e2c5a2f166996b58ffa673df6e58b8edf2bdf3e66271c8c69e323c3a91be60ebc3e06e942bad04899a15911cea23269e43d07829164b2ce5d4324d95024fc8da5c92b5a1f4825aed5a2a91c9ca8fb6aa52abb332a4c9cf425733c10b77e1da9f0679023d55fb3057879d15609db9c1d46ee5c3ff1240a3d0523878dd5c8eba1e5b53ab2e07e7b5482e95a3fd3e98268bcd7861318bc99023763b89d183eb014e29d9d0d4e45fc2b784a7fcfcf31dd48fd3bde30f8d956383d13d296af7f29c0425655bd1cc0be48fe4aba52ee6760a89e805ca2589f4ef4d773fcaa3038e365b6ab0b121e2cd319c56b74e37381943a0da0e8dce407087cdb84130f49fa81a699a667cafdbd6d1f6e781edd686c947eb8ae27134f6dc2c43d7425bf771c8c9f740b1ae9803dcb4fd45af4d6a6f171fcc72fc7d511095ca82ce52b871429833e1dee348263844efb531f6a3fcd321f88dc8a876caaee912cedd534a4a5bff2609a2d6e088cb87465c08c2d69c6aaa7d2ffcbcd491274b8505f153ac2b231c23d41234e55b1f7ed89f86234f785adbbe820959655d7b019d7df957bdab2ba4b05ec0338c06632599393d5b14227f31a43fe950ea8fdd474287155c3f190571645c4641dcff2c07a4c3ab9acad06aa9607350a385729d8d6139f15db2ce9acd50f96d566e8d139f6490abf2bbf7a9293b876eeb4598fd2c37c5155dbfa033676b5caacfae902734ce462cd871181eefbe299250ca8ac7e139719e5e225ea2648a8cba0fd94ec7fd8ce5315f5d0cc2922bafc9db3c8c41280e917c5eab4c61baa67ae2838a36c2e6ff0476a8f2117b96a7027b830c8cb46ce78efc5faea1650cac0f3ffd2dc1fb220182095a46e34158967d37c2a942e85e2ca97b604b53f87d6c070bf387e80c70a6df8d272fa3fc143148d41f13e59d52ab1f1362d4ec87ed21f0d15cb769b0b2a5577cab41fc2cdb1e7e796c5bdff09264dd9a6366d59b573d50fd23ff650923c4a8c1c918518a02d0a56f12c23533c45f439d65feba2c971c214e71303ad2e0fbf62b45ebcaa784cbf3d0dab62786cb4c046968445a37a9943a267a8b2100fba2678353d6ec88844505ccbba659e586c7a1056917c0f9eafefe42e33e791b75a7e503ff8b081bc10a98449e4076787dfc6c166cda1e81667f869940401f05a55c8dea94dbdf3ceffb93b5f320a6462cfea44d6dbd507ca7cecea861f9cf704b3c5c37f5bd5392886a8c2562088892b7703fa5745538dea8ed9aec4466e67a9d0aecf9e7026ff16a792d1d6f306e8b67d3f34c755fcee1337a252203002ecfdf673a08cfadeda8d738bef2d518a08e0626aa4f76d9e2a2ff313f5b91cc67aab1127122baee1c3efbae1087e58a25bc5f1eb0658459ff264a2c81c68a34c4ee6bc109d141ad28b96037d34ff112322a4c853739880425fee707e9f42e0b8d60119ed639b1ad506ea29877d126bdebce379cd22989f0a67bc595ab8bce02c2f95f9292ad06e1868207e809c76bd16f0cab800c068c104da0e66ef6384663309aaf8fb49f549f2785d835eec620b265f8aa11d9f0912adea5339c73cb4a777a3e9f98bf3cb08da6622c9dd3b4cc9b083cb03d10a29a927c37a31b80975c5c5467f112b61478c9493c046281046443525358a5acb09b9e0e5a1eb469b8d20dc23351e08ff5d5731e1cedce0ddee9bbd00a76217f139d52cb4febf3342c34dcc8198dcaf453458be3699ab47dc08616aa7f18daa7faac8eae94d27122f4751bc96d9ea52d30000b7ca37569a2291b2710824ca3396fb5969636eec376ad6c3ece2202b1722219955638e09b6f96d4cfc0598d3b1890b8d247fd1fb85d24a17afeec3815906dfbcdc5359647910b4a153900ec999a0fb9fe48bda9a6c8787981a24f8bbc723a6f6aa80cab5fa53481937382f3c6ce85bafba443170e54ef7fd431ce7f1b5e202719f3fd022e4ef70788904f574d2cdfbf70c6f3a8e913f526ec57eeec50e1306f7b34b037915b7a1cf2968cc46acc58c2ab9adaba93ff094b8f3fc37d906014d870582039d276b7bd03e6fd583d8a15c494c878e28284539419612616d964ab9224cbe27e57f42293d91d02d684e3dbc7c9bfa9ffcd8fb6a2afe656f510c406ddc58ebff48ce1d0fd3fad951b46a36ec92541f273eeb576d39235d0a5c6f18f2574b132a1022598edfa38065783ab98d1f963b88672f3676a7da1580262ba0d4f367cc57a94b551754c20f77a670c43d4861088161fc72b9922abf933b4ea664a807105ec1eab4a173253aa60bfe6d7d5cf7315186a78ab6a7475c338bdf101bc6461930aaa7a012a02cf93f347c207d81201d0fc19977e51104438a5b9cba861f4da20cea3ae9183edf16ab11d98f8d871d76171504597bbda387689e12e7a5e354c360ff135f4df231cec68c761afd973ad5a80c3d7468a9c392db4166857ed32b5d61cd6755766ba8922156dada3dc4f25b2247cfdd6fc96848db30a178baa4419a4c854e86e315b465836102d14dd0fc1a88180fde8367bec7086f99294f36b8332f12994293139ed532d2ebbace5d2de8ae98579bfb940290f60e59a502b3065345aaf765456387989c0488b20e799d72929d7ccc7f6b6109742b8cc482838303207efc989543b6e1ca6d16e9cf235d2e044c2f7814e6bbcd835b9fd9f10f227dacfb9396185ec2013e7df4db4f3fbf4481f30fd840f35568746f54be49eb92b2c9ac95597a7760abb171cb54bf5a57dfae488d9dfe260b32460a1d947fb5af58ceaf2fb0139bc08b4bb79a966

CVEs (3)

CVE-2020-22653CVE-2020-22658CVE-2023-25717
Ousaban Shows Banking Trojans Are Learning to Hide From Sandboxes20 indicators · Jul 1, 2026

sha256 (20)

18fd38988d58dd930f5992d448cc09a9400c1eafba76b820b9a83239ac48cf4e19ac18a50abb48dc0ea9524850acfaec49359e6b3bcc67c6193c2d56da812c711e77992666acbbfa0d01fcefa9cc8fbdac291e0681b35745be27c6dfb159a37521b24f7ee1f6bdbbb670f0394d66009ee0daa8ced57048298da715e88f7a7cdd48723a33bab89f174750576f9a62da35b3b9e5ac31a5a8f1ce9859a1b35bf8b84c9fdc2823da505ef339d43c6ad38499b7e3447736733e42b5ab6b1afcfd42aa4ca2c863d740bb7022776dccabd8ae34bb9998768928042d76ebcf08984eefcb540ee1936e61d2344b5ebc93485589a351ec2f113a9b4940ae16f3baa48073925837e47198a20877e1b04b270c36d9194206ee38d4f32fe3151b3c3b396c4f0d5a2ed557c357ba8f96f2d55a8a00695987806b5df766cd1dfdab0cbed111774a5e06af187b45476ade0d953e834fced6197d0a33ac60c2575877660e26ab15e865c1a998bac48e02b52b1c850cd500e9fb87521e21755c3a4a491243f5f9a7006bc2e11b0917f47d0557288c4f0cb20bd7589185943b989a969fdc6d3704ee739d07a83cf89685651ea8992047ae694c24f6ddef193044357debd15ce07a64fe9e81ade09cc18f0fc09d73e72d2e0bffad02f52fdcc26553e473cee8cabc1567d4eb4ff02df659fdeec17d36b77084627469623bb3c7d16383d257404b52d1c3e2f0c2d4c1552cd81fa012043e4a5ac832582b639b7b6b7eccc0c4802d7a8ad8e6e78eb2e9bd41a4bc62f7ad54d095ea9813864bebe37172ae30a1afa631fe14fadbb8061715128bebecf7bc59132b6bb04fe8cc39b965aa5b8722dffe28d7e7ffb9eb47cc0cb2f43e04a10dc84df13d04bca1ebacbe47fad0b669728de2f59c
Bing SEO Poisoning Shows IT Admin Downloads Are Ransomware Initial Access9 indicators · Jun 29, 2026

md5 (3)

124a48b78060fa851e1cc077ca35713c8c113b3aa82c81eee7c6b4ed0ba9a90fca8646dfc88423bb9fffda811160cebe

sha1 (3)

ab82bf27132323861810c0efcac6d5dd01600dd4d66944e1a57daf04d3e809f22cd01946d593acaffebbaf5f08a8e0782ffcce8beef1f2b4e249a52b

sha256 (3)

186b26df63df3b7334043b47659cba4185c948629d857d47452cc1936f0aa5daa6df0b49a5ef9ffd6513bfe061fb60f6d2941a440038e2de8a7aeb1914945331de730d969854c3697fd0e0803826b4222f3a14efe47e4c60ed749fff6edce19d
Hospitality Photo-ZIP Campaign Shows Front Desk Workflows Are Initial Access Paths22 indicators · Jun 26, 2026

md5 (2)

1708253177576018957611282797243525908558764390958596189327204542

sha256 (20)

04ec44f2618460f5c77c5e56014a512cc03a123c9c5b6b6b1273e2a1681ac2e106a2888c1f07119873ccb051221bd8717281494b33585f4242556e6e5e2279691c693bcdaf1da636eb21c274b21cc2f6c52c62ddd514700783eee83fe13acb0a1f8daffec5945a13a1e9231f4a76655d4c7ef4560d0c64ca3abfe48f38297cbd2e5fd01b7949a45937b853eabcf4b03195614cf84338dcaaa97240d1c5301ddc3f66634f103b80412d1d670b91befab2a74425d2ea76d904c4a7ffae2ae94b4449cc0e0c3ec060fb354cacee244d4f297aaefb6db66e67a21262d6c4d2eae1bd63565f15a99769bbcd527a4d53e5cc259d80e1254463ef9c878c2074685558ae6580de3b74fd635a1d7a887b8f6e5b0c9ac9e90d6e20466ad41489203119cca983e970feb3f10692c164f6889f7a026f135c2433e5bf8e662a6e63a3b81267b789934cb1494cf0327f0ab82fe644c74caf687814379cad116bd7adaca74c102897448688b292bfec6d83b153588076fe59b111c35ac4e42a916238df16a71e2f98825c0c7764f45c891275b2f038ea559e84b340df30b41c2cc77b8d4215c6c89f10e3b6e5745784f26d18c38ce01fba054b19749c17260978ac11472564aee2b7f46b192cd83a1d2487cb048cca645f6e8855b9673d500d50bbdb04eebc6beabd6805782df15e53581096b99bd6bbb81f4d4a5e2d2b30954df63175a4075be9c5baa0c16b0074a1e94b48aa0177e9bfc23746aca8a5b42848a6685da85658b5d14ba95cdce1ef7dc9ad3ac74949ca5db38b27378ee30f30a23cf26f9e875a11da4b72764ae929050353f3da759c839e2a061a8b9a8dd3c3b2e909d4a8a3291cf629311734b7c6e6579f8e1d0e1e3f3bf72c9ac6c301b631ba4df7f393c41b14
CL-STA-1062 Shows Critical Infrastructure Intrusions Still Start With Web Shells6 indicators · Jun 25, 2026

sha256 (6)

00e09754526d0fe836ba27e3144ae161b0ecd3774abec5560504a16a67f0087c4e1f8888d020decd09799ec946f1bf677cac6612b24582ddbf4d8ede425d83849b481b69cd91b09fa7bae7428f646dd89473a4c03393e43da81fe756cde1c472cbfe8de6ffadbb1d396f61e63eb18e8b11c29527c1528641e3223d4c516cf7c3dce5df29bddff5a4ddaea5c4fec14da91f7b69063a6e1c45ed61e5da4fc6c87bf34bd1d485de437fe18360d1e850c3fd64415e49d691e610711d8d232071a0b1
Turla’s STOCKSTAY Backdoor Shows Why Espionage Defense Needs Egress Visibility51 indicators · Jun 25, 2026

sha256 (51)

0a545dd1b703cddfb3d582c8c70f65f556bbd580bfa836a387121eb837bda61b0d6b083208097d5b3e189891338540f6c64faaaaf268b0bb0b085dd53d5857b41682e8d82016b3f10434d2ebac995fd3b6aa812f079bfd7888652e94a994d85119e6ed42248f9d03beb343a7c09a864dcd3cd671c29e1e5eac93579225224ac91a2ca8b8e0344fe3d80da7352206a470245443e2349a237bc093df934ddc011f1fc23ec18a94a599a34c74ef5f49a1e27acd37a07d5846661702b5e7e81a6a24249a4c7cacdd8e99a2a089a5c0ce904f2eff22e0e40fcfb10f7824dca6c51ecb2623c6e3c1f5a7b5e735a64813bc0e1382ae45831f5fadffb08c0e7b096627f72af7b513c05e76d7da5f75bb0a223c894a706c99ef2c2ddfe4eae542f95a08e034fcbe7e90fc87a4f3766469c19a64f24672d7adb99e0198f5ba10d58911368b3627f582420ad2782d452fe6d13fae42658d1484296351d3916703e25dcadd14391e51354118fb87dc57650cbbd94258c3f7c0a0d6868040b7a473ad626ff25e40a3b969d81ef1ef35dd9ebcc6774e060b1b8949d3d74f38ca6b7d789c95cdb340b1208dda0cd5dd95c6b57764b2cfe7145b3ed9457f498408b4aaa05bf3ef50447f430b46fad5a3f8e8c5aad1f8f7f79af069489c3d9c29224bb9f14f0c7bf445bb8d1ab2c13bf4354294e13d3c9be15de625d807301905b98462f43f93e8934e3bed10a8eff3e9205c1f37f647512464271d5ac65df7ae4709735621a3832055249f296b63a8bcf911b8bc96de43c1ac2b4a56c150a19d33d892a47e57352c626330d22f77d9cbca9d40cc06568041703f194610c4c5a84bbb05a2e4ee74596298f3150ad94a242e649886d47c59c634a4d04b9af5ee15e3bf335c40b5e58e667a8f568a611f2f3d84a366b7946b360e055bece9699c95aad619637ab72a386cee9e838792ac5e2098362d68ce93a9a2c095d476dc16b289fe8509c99b2b8b6da0b4c1a5d0d3fb6e6a2990a82ba51db1f68a3bba818baa46526a29731e23427615140f78d9a0ce31cc9fe8c54c60028a7439cb32526fd97b10afef7145dd7877417df21b4b4e8d86b8bda4afeef93fd36f355362586b2d1f51121a8224416780f6c010fd260d0bcf18a4b6a8d62505adbed50d2e615ed9522c4bfd61c00661813c78b5b6ef28a9c0ed35f2c6cd88fc50880ab91f8777dfe7aaccb1c24b08d581aabf646619ea5f4a72457cd3aa17c5988003d67e6454f45e7cb33613021bac82707cfdf24dcb762f4615f01e1ba4d3dfdec4abe9cd588558d2634d7e6a5eeb9164054d0bf0b7c8820da4f742860940998984555e65820e4fa8dd07b6bd67ec98ce3c6e4dd05887ea619f2bbfeb2e2c2805ed07e85e119b79b828b7ef8be3979fe944147c15a87963b06baf6473288d64c23655a0ba9369c35566272d8efc73a40bf9c75d1bfa6d66f1179f2321de6589f80d3089d992797a9cb0e84f6196ceb064a3efb04ed77e6c57955089ce639e193d166c8ea2216c98c3e9b701ea2cffb287347a5bff8af360ce0e6500c336b6fe6d97920abc26202c9d843ffebc5f89b55f3b8a7334af049ba3f70a9ad3fe78574b1e180c68baf9a7110d104387a636b728eba4f0d6d16602fbad05a591f14391594262d3584b2e249e97f86e4dcc5ac905cb512018cc55512c6a22677c3d6f389c47afd54d7c85797868fc4fcb90e9d1e54270433a94aa3d45d888e4c62299bee3480eb2cb4a5489c7dda69d476c3ed3fd32f915c239872c9e7ed9408b1f36dfcef03aa68f9a396d05c437667cdb43d8fe8f3fe838d5b1a1043096f6f6bb6f524f5f1b0c9f83a081078a824daa0cf3da8a96bc74e265f945f1cc6992c6dc0f9ea36ed1991f7b8d312db79d9bf78c40dfd5cb91d06b9649d4cab500343af80ad1144a9e46641cc406f43dd169003c22e1d16fb635060d23e889b0617d77f0cf06d00cc19b43a2c8b5ac53ac027ac722e2a0f4440f67998a0215d49be31746ea192bfcb4dc4ee532a218f8cf13605714e316b1e13154dc6115e1e0c023f6fe3d17861cae839d4a4a81779b6aad9a24f8e3364ee21cae6725451e8bc9ab9933df0000fd19814170bd132da68d1906d5ffe6d8192960a89d5480868b94088cccdaa1560f9c8a0b0282ced2b7c1f72341b6e83f274bf9914c6cfc0c6b3cdadf089565f49dace4aca93287c22aba9641c8f3f04f43b6f7c2d86109c495179b497f7fb45fd95816623de1b77900f71b4f99edf964353b9ae4bedbe62de6c0d7eafa9fb8b87897bbaea483aedaa8ae191834da
Tor-Based Crypto Clipper Shows Clipboard Theft Is Now Backdoor Activity16 indicators · Jun 17, 2026

sha256 (16)

0020d23b0f9c5e6851a7f737af73fd143175ee47054931166369edd93338538a100407796028bf3649752d9d2a67a0e4394d752eb8de86daa42920e814f3fae820db98af3037b197c8a846dbf17b87fc6f049c3e0d9a188f9b9a74d3916dd5e123c1e673f315dafa14b73034a90dd3d393a984451ff6601b8be8142be6487b4335a6bc44b176a050fd6824904b7604f0f45b0fdfa26bf9500b9e05973b387cfd67fc5cf395e28294bbb91ed0e954fdf2e80ebd9119022a115a42c286dc8bacf57630debd35cac6b7d58c4427695579b3e3a8b1cc462f523234cd6c698882a68c7787a9a7d8ae393aa32f257d083903c4dc9b97a1e5b0458c4cd480d4f3cb5b059d90f54ae36c6c5435d5b8bed40faf54cc91f6db28574a6310b5ffaeb0362e96a7abf1d9d6686af1cefcd60b17a312e7eb8cfe267def1ec34aeab6128c811630b2777b73a4c33ac6a409d475057843be6b5d32262ef28a1f1ff5bb52e3834c5fc824630154ac4fdfce94ded01f037c305eab51e9bef3f493c60ff3184a640502cf9fc891ea5ca5ecd8113ef3e69f6f52ff538b6cccbdaa9559106fc72bc6da30d14b80cbd1a19d4ad0473a0661297f8fdf598e81ff6c4ab24e212dcad2e54b3fd43bf94f0cb0ab97c88113b7e07d1a4024d1610617b5ad05882b1dbab89e15baf3b54984caca95fd496bcfe5d7db1611b08d2f5b7d250b43b430e5d76393f9e0
TA4922’s Global Expansion Shows HR and Tax Lures Are Initial Access Infrastructure14 indicators · Jun 3, 2026

sha256 (14)

0857148fb0bc4aa7adf967ede2307bdb4fc427065d5b6a6db132688a5a8e1eb82d2a251a88632f010fd9671789746908eeccaa5bc5c0a5d25e4649efe4f5b15d3119cf37b8267db8a2dcd11d9a83d5237d7ef1e42388e7c9afa2831b91da8a2d314f4b59535d1b783e1c20c2be00f9e30f8ed27b2e21fad06a73b47ea43279ef40b41979b317406f8abc601677a3b93aaf6ef8ab8ac188b8f383735e388f13b54fcfa88fffacbce30bbe2136753c9ab5a4c092940d2406fd9d44d5118e745b9d584a9448dda46bd590d7a2f86228100d2ae6e0d6d990c1a4459ed5ee28e07ae866a3836b9a17771bce2161f6b73cbc2494a91e49d6aa30d2d53711e8d10de60d8c9b6542f73c5c7fe455b52f5101314407da4f65ff48e7ebf6896605e607c8d09d0a55c545c4147956db2c2667c4ed931a2875309147548b1dfdd216228f5f73a648db354820ea4d02940cb1702b35974513b7aae83f6dffaacaac4ba31f9295a75eab31d7ff06b6864960ad7e633be3f9730ff3d3873e4539c8f425fc632dadde82998ad5fcd63deae030803388e0fb4290d6223fda82368fd25b99b823f0d2e0a6a71c605d9a4076147e9537f82f79f1e1eccadc874595160aa4637ff4088c
FlutterBridge Shows Why macOS Malvertising Is Backdoor Delivery, Not Just Adware9 indicators · Jun 2, 2026

sha256 (9)

021666417de8b9972c179783fe60d4c4ad2d93224e3a0f16137065c960b1b84530448686ec900d5213d74f08f0d2b7924c5336a29445b2a434aba8d8b19d7530363923500ce942bf1a953e8a4e943fbf1fb1b5ed6e5d247964c345b3ad5bfc3448047c34bbd57fe1e24bc538bc2ce9e0ac4c4eb48d3b0c195b414f0379dc0745644fc49fa1006a2a2acace694e5fb83753164e2617051ece6d9dc9ea32329e708421c902364980e3d762ec6dbbe6b0f40577c27bd79b48c57d098328b25331099053e8ddaecca1f960c041c944ca8799fc71dc86a4b50d2639ee4e0d2cb82f479425e8e39fa8a7212cdd07f0917cb3dfde38a90b87297de2c82a5850aff1e4deb60074d1ea2008a581f432f2dee5f84f78668d9dd8e66f75d03c42dabd89bdea
FortiClient EMS Exploitation Turns Endpoint Management Into an Infostealer Delivery System11 indicators · Jun 1, 2026

md5 (2)

338662fd0c4d750a0ba203a32b59f0818c5b72906e8183037532afc3f4639931

sha1 (1)

17e771c78430cc67e71d4547f8996a1a488e9d3f

sha256 (5)

0da123adf9251957a4b850a3f6bd6a753dd4892be176a84a18450e899534cc5e2927bc31b4f8254c6b332fc03110a6373cad00ffa2ff9de427c26bb222017bb22f25ea1b622abf3212141af932c2ec4cbd6b2b5903c2a531121f691227d98cffd91c00fad521e76efa89715cca89db487d5676f2c767c883482f9c8f82bd383afd65051c61a904a304919c04a8c8633c001183ac73ac461cd4d9057946f02bf5

CVEs (3)

CVE-2026-0257CVE-2026-18556CVE-2026-50656
Showboat and JFMBackdoor Show Telecom Intrusions Are Built for Pivoting4 indicators · May 31, 2026

sha256 (4)

2229e7f3cabbce4d67cd79c89fd5a100b20e8a99f4a2bf9aac77a978f49eb52027df475626aafce2ea1548a9f35efb9ad951298c8b11a6adb3ccdfcd5170c677a72427af3c046fd90999a6505b2372dc4ffde122227f30ed21621ecd4f2d3e8be28a96f983b8605decd2ac1db16ebad5fa741a6aa4e585a38ade0e5ad7d6cec0
Poisoned Search and AI Recommendations Turn Utility Downloads Into RMM Access12 indicators · May 26, 2026

sha256 (12)

062bb28765fbaa11f8cc341fa16e2c7f942a122d929cb41f4a0f755b4429f24616562974deec80e41ef57a71a6de8c03ceb393005fb1432f8d9d82c61294ef8c1b2555b09ac62164638f47c8272beb6b0f97186e37d3a54cb84c723ff7a2eee52ee93ccbcd49ed94c65dcf52e7dcb8f0fa0a443ca24c0e0c7f79152efba657b769077fcf940fc5852fb32beed15636756ebc04ac971b7ed71d36251e7ea70a207035c2abeb617e828dfda1b119b8544fa9ae15a1d263d18bc5506acaf381f4969ff07c9fafa9c03fdf69e4abf6806aa7c938b5480e7e258f227db0719ecd6386a460d00ef93c8ce70d32e48e55781af66a53328fc2dde45519be196c265de074c7425fbe6c3a4937934215c54027d4b67202d12ab490682fae03498870d66d06cf3f8160eb5a5580e0c35054847e3ac4d01e9fe74fab8bc12bf6e8a40bf696b2db2d33c4e6e4a5c2263b56e8303c343305a94dde1fc2968304ba260acbbd9f9fe021662a652ba95c8778b991056696ab3c9b0f60d5e23b1e6cf73c3847db6610
F5-to-Confluence Intrusion Shows Edge Devices Are Identity Attack Paths6 indicators · May 22, 2026

sha256 (5)

4a927d031919fd6bd88d3c8a917214b54bca00f8ddc80ecfe4d230663dda746557b3188e24782c27fdf72493ce599537efd3187d03b80f8afe733c72d68c5517710a9d2653c8bd3689e451778dab9daec0de4c4c75f900788ccf23ef254b122ab4592cea69699b2c0737d4e19cff7dca17b5baf5a238cd6da950a37e9986f216bdd5da81ac34d9faa2a5118d4ed8f492239734be02146cd24a0e34270a48a455

CVEs (1)

CVE-2025-53521
Screening Serpens Shows Recruiting Is Now an Espionage Attack Surface13 indicators · May 22, 2026

md5 (1)

edcdba624ddb43c2a1dcf334aa493068

sha256 (12)

0db36a04d304ad96f9e6f97b531934594cd95a5cea9ff2c9af249201089dc864332ba2f0297dfb1599adecc3e9067893e7cf243aa23aedce4906a4c480574c1738bd137c672bd58d08c4f0502f993a6561e2c3411773d1ae57ee0151a0a9d11d43dc62cef52ebdd69e79f10015b3e13890f26c058325c0ff139c70f8d8eadcfa44f4f7aca7f1d9bfdaf7b3736934cbe19f851a707662f8f0b0c49b383e05425074882085db2088356ed7f72f01e0404a0a98cda88ef56fb15ce74c1f36b26d278808c794c24367438f183e4be941876f1d3ecd0c8d2eb43b10d2380841d2283b9cf029daca89523d917dafed0568d11d00e45ec96b5b90b4a1f7fd4018c7da849e4a658e6d831c9e9bdfe11884a75b7c64812ed0a80e8495ddf6b316505acac1b19e06da580cf91691eda066ac9ee4b09c6e5dc26c367af12660fe1f9306eec4bc3b44154518c5794ce639108e7b9c5fecb0c189607a26de1aaed518d890c7add4a7e9f107fe40c1a5d0139c6c6e25bf6bf57f61feff090bee28f476bb3cc3c2
Mini Shai-Hulud Shows CI/CD Secrets Are the Real npm Supply-Chain Prize5 indicators · May 20, 2026

md5 (1)

7f44e4ba6f6a71bd0f789e7f83bd3104

sha1 (1)

7cb42f57561c321ecb09b4552802ae0ac55b3a7a

sha256 (3)

a68dd1e6a6e35ec3771e1f94fe796f55dfe65a2b94560516ff4ac189390dfa1ca8269c01069452afb8a54de904e6419578d155fdbdb9e566bab8576a4266b61efb5c97557230a27460fdab01fafcfabeaa49590bafd5b6ef30501aa9e0a51142
Fox Tempest Shows Code Signing Trust Can Be Weaponized5 indicators · May 19, 2026

sha1 (2)

7e6d9dac619c04ae1b3c8c0906123e752ed66d63dc0acb01e3086ea8a9cb144a5f97810d291020ce

sha256 (3)

11af4566539ad3224e968194c7a9ad7b596460d8f6e423fc62d1ea5fc0724326f0668ce925f36ff7f3359b0ea47e3fa243af13cd6ad9661dfccc9ff79fb4f1ccf0a6b89ec7eee83274cd484cea526b970a3ef28038799b0a5774bb33c5793b55
node-ipc Backdoor Shows Why CI Secrets Need Supply Chain Controls4 indicators · May 17, 2026

sha256 (4)

449e4265979b5fdb2d3446c021af437e815debd66de7da2fe54f1ad93cbcc75e78a82d93b4f580835f5823b85a3d9ee1f03a15ee6f0e01b4eac86252a700298196097e0612d9575cb133021017fb1a5c68a03b60f9f3d24ebdc0e628d9034144c2f4dc64aec4631540a568e88932b61daebbfb7e8281b812fa01b7215f9be9ea
PawsRunner Steganography Shows Infostealers Are Hiding in Plain Sight6 indicators · May 15, 2026

sha256 (6)

0fcb86ae384e9975933314ac2a231f0ff46c0208556bf4a16f096a642d3f505e1b730de72f921458b6b162b105a9521a931f07e19d3cac53207c7a8efbc412f96910d27b9e1dc2229a8c280f5d0cea85146d50274c56a4d9a5b8d1793505b1b98d0bcde739929fe41a6bcaaa62f7cba802af90b2ba8dea6ed1a4821236cdd58893724f1a9ad3a28c171927fc449ac34dc6ca890f915f00210e8b305577388c6ee2308749f6b7b7573009d0cac6616a6aa83cecb1f2933e868776400d122c86ec
Gremlin Stealer Shows Why Browser Sessions Are Now High-Value Targets11 indicators · May 15, 2026

sha256 (11)

1bd0a200528c82c6488b4f48dd6dbc818d48782a2e25ccd22781c5718c3f62f52172dae9a5a695e00e0e4609e7db0207d8566d225f7e815fada246ae995c0f9b281b970f281dbea3c0e8cfc68b2e9939b253e5d3de52265b454d8f0f578768a2691896c7be87e47f3e9ae914d76caaf026aaad0a1034e9f396c2354245215dc3971198ff86aeb42739ba9381923d0bc6f847a91553ec57ea6bae5becf80f87599aab30a3190301016c79f8a7f8edf45ec088ceecad39926cfcf3418145f3d6149fda1ddb1acf8dd3685ec31b0b07110855832e3bed28a0f3b81c57fe7fe3ac20a9f529a5cbc1f3ee80f785b22e0c472953e6cb226952218aecc7ab07ca328abdab0fa760bd037a95c4dee431e649e0db860f7cdad6428895b9a399b6991bf3cdd11938f14499de03d6a02b5e158782afd903460576e9227e0a15d960a2e9c02cf76ba1a4650d8cafb6d3ff071688c5db6fd37e165050f03cece693826f51d346
Cisco SD-WAN Exploitation Shows Edge Controllers Need Emergency Review15 indicators · May 14, 2026

md5 (1)

fece5b954e69b2c6a8d0a1029631a0d7

sha256 (12)

02654acfb21f83485393ba8b14bd8862b919b9ec966fc6768f6aac1338a45ee80c87871642f84e09e8d3fb23ec36bf55601323e31151a7017a85dbec929cf15d0ed72d52347bfe4a78afff8a6982a64050c8fc86d8957a20eeb3e0f3f5342ed017302d903baf182f94dc3be40ab1e0874dd0eb2ec5255bf9131fd53591efe92518d77c9c5bbb5b9d5bdfd366fdfcf26bad9e64c63ca865fad711bcce8e3d5a805bc5998161056b7c8f70c9724d8a63abc7ff8c3843b91c30cffab0899e39b7f872f570ce97de3eaaffef33d90b0c337a153fc9690cc34ee207b557d8683600607aa88a64a527ade7d93c20faf23b54f2ee33ad9b1246cdc2f8ded2ab639affb196fc528ca5e7d1c2b3add5e31b8797cb126f704976c8fbeaecdbf0aa4309ad46b0f51b098842cd630097b462aab0ec357e2c7824af37cca6d08165265da2c2d3d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfaf6f8e0d790645395188fc521039385b7c4f42fa8b426fd035f489f6cda9b5da1

CVEs (2)

CVE-2026-20127CVE-2026-20182
Kazuar Shows Russian Espionage Malware Is Engineering for Resilience5 indicators · May 14, 2026

md5 (1)

82760b84f1d703d596c79b88ba4fac1e

sha256 (4)

436cfce71290c2fc2f2c362541db68ced6847c66a73b55487e5e5c73b0636c8569908f05b436bd97baae56296bf9b9e734486516f9bb9938c2b8752e152315d46eb31006ca318a21eb619d008226f08e287f753aec9042269203290462eaa00dc1f278f88275e07cc03bd390fe1cbeedd55933110c6fd16de4187f4c4aaf42b9
The Gentlemen RaaS Leak Shows Ransomware Is Still an Edge-Device Problem64 indicators · May 13, 2026

md5 (30)

03860d116701cdc9d9bf9c45099bb3d311e7baca7e652995b2364fdab0d362b72cd4eb358c45ca783a20ec854a5a860c2e5d1a352885a6efd84dbc0387cbc79e3b7b4f2d33bdfb8a31b480d0eb2815cd4a94d2b730a5a63e6cd54a9b0bb4ea714e0c37cbf4dde9683943c8a738e5b00a51dec3e170f8a181cc9aea8dcc90c7ab583fe1c1a39f6b873a5c0997bea1f657697f182826495662427ca49edbb345fc71d503709af88821c183a1d0b7ae06ec721606b3659f2c2d80a196ed3cd60053735069890a414869f0113de820ba9afb74ea100b581ec32ea6c2ac2a0030a9f6776e86c13433747299a4e5f9f22e34157aae8fd9187c88dd0292cce1abd050e281a578e065da1ccd8c81a8e90c30927582160a7da5fc4c935e6f48d38a5aaaa6893f735e9a8cc9814dc6eccd5579561c8fceea4fd9ce32dd620ccd580297c7c592d8bd2a6ee7f6d5c84e037066ce0539a023a6b15419600dc3f6b93e11761dfea73526d89e5fb7b57f50d8da340e53e9abd11823ddcc3d746ad8621e677a93ebb5b42ac289581b3387ebf120129a19a6b68e019efb39b85f5a0326e22fd4498abc6b87c79bc71a78da623d031ec1a958d75246d230f22b1da6bbf5fceeed2ef2da9cff1b478b64d47b68d50330e96c60ead0d7a8ae0a6ffb7f0a5873fec4ff5e

sha256 (33)

025fc0976c548fb5a880c83ea3eb21a5f23c5d53c4e51e862bb893c11adf712a1334f0189a8e6dbc48456fa4b482c5726ab7609f7fa652fcc4c1a96f2334436f1af419b36a5edefef387409e2b3248c9223f7dc49a4f7b15ea095d371c3a70b21eece1e1ba4b96e6c784729f0608ad2939cfb67bc4236dfababbe1d09268960c22b38dad7da097ea03aa28d0614164cd25fafeb1383dbc15047e34c8050f6f6724ac3588fb8cfbff63b7fdfcbc7dec1f3c60e54e6f949dd69d68e89e0c89d9662ed9494e9b7b68415b4eb151c922c82c0191294d0aa443dd2cb5133e6bfe3d5d3ab9575225e00a83a4ac2b534da5a710bdcf6eb72884944c437b5fbe5c5c92353c2182cb0bc7528829ef03f1b1745a92bcc47d917eb8870862488f21fdf1a6d648d9b2ce4fcd6854a3164ce395d7140014e0b58b77680623f3e4ca22d3a6e7fd4a175eed927c0a477eafb8aa35a93c191748acaa78ac7aecd8ea3c4cd868887c51b9f246d6da85631131fcd1fabf0a67937d4bdde33625a44f7ee6a3a7baebd25dc607c8990841139768884b1b43e1403496d5a458788a1937be139594f01dca62c2c24937d67fdeb43f2c9690ab10e8bb90713af46945048db9a94a465ffcb86a3ab9e984a759d55af4e84487d1fc44683065cc9a1089d5aa4ad1c0e4e84a63788ba200f776a188c248d6c2029f00b5d34be45d4444f7cb89ffe838c39b8b19860a6177b055a2f5aa61470d17ec3c69da24f1cdf0a782237055cba43115892387d25d0e5880b3b5cd30106853cbfc6ef1ad38966b30d9bd5b99df46098e546c8aa0cb69ca2777001e0f4ba0eaab0841592710e4cc5ccd6b0b526d78bbd8bfba8c87134c1b45e990e9568f0a3899b0076f94be16d3c40fa824ac1e6c6ee892db91415e0b9fe4e7cbe43ec0558a7adf89423de30d22b00b985c2e4b97e75076b1994d6d1edb57f945f4284cc0163ec998861c7496d85f6d45c08657c9727186e39f61ff4deb8afced8b1ecdc8787a134c63bde632b18293fbfc94a91749e3e454a7a19cab7aab606f833fa8225bc94ec9570a6666660b02cc41a63fe39ea8b0adb67958afc982cafbe1c3f114b444d7f4c91a88a3e7a86f89ab8795ac2110d1e6c46b5a18ab3fb5fd1c5c8288a41c75bf0170c10b5e829af89370a12c86dd10f8c7f7b5a6e7d93221344e6368c7ab4abf93e162f7567e1a7bcb8786cb8a183a73dce2e5cc00eff2493f8ced546dc51f9d5ef78c5ee56805906ec642dfa77a1c70dfe696ff713318c53fb17731bd4a6585a02c085b590149b19847990b324a0be6ec368ae0b4369b6ef0da244774995c819c63cffb7fd2132379963b9c1640ccd2efaf8e7422ffd09c7f03f1a5b4e5c2cc32b05334c18d1ccb9673667f8f43108ff736be55193c77af346dbe905e25f6a1dee3ec1aedca8989ad2088e4f6576b12fc75ed2159e0c8274076e46a37671cfb8d677af9f586224da1713df89490a958

CVEs (1)

CVE-2024-55591
CL-STA-1087: Chinese APT Targets Southeast Asian Militaries with AppleChris and MemFun Backdoors7 indicators · Apr 3, 2026

sha256 (7)

0e255b4b04f5064ff97da214050da81a823b3d99bce60cdd9ee90d913cc4a9522ee667c0ddd4aa341adf8d85b54fbb2fce8cc14aa88967a5cb99babb08a10fae413daa580db74a38397d09979090b291f916f0bb26a68e7e0b03b4390c1b472f5a6ba08efcef32f5f38df544c319d1983adc35f3db64f77fa5b51b44d0e5052c9e44a460196cc92fa6c6c8a12d74fb73a55955045733719e3966a7b8ced6c500ad25b40315dad0bda5916854e1925c1514f8f8b94e4ee09a43375cc1e77422adee4d4b7340b3fa70387050cd139b43ecc65d0cfd9e3c7dcb94562f5c9c91f58f
TeamPCP Deploys CanisterWorm Wiper to Target Iranian Systems92 indicators · Mar 24, 2026

sha1 (82)

0891663bc55073747be0eb864fbec3727840945d0d49ceb356f7d4735c63bd0d5c7e67665ec7f80c18f01febc4c3cd70ce6b94b70e69ab866fc033f519851bef764b57ff95b35e66589f31949eeb229d1d74e4cf63b7cf083cf92bf5923cf037f7011c6b2297a1b967ecc05ba2285eb6af56ab4da554ecae22e864e71155122e2834eb0c10d0e7e0b8f65aa3252554b0e1130467f4301ba65c55a9c373508e35276ca9680f6df9016db12f7c48571e5c4639451d2a51c5c5bb1fd1f0e134c9754f1702cfa359c3dd2b1dac84ff12ba56158b3a97e2941a587cb20da92e7964d59cd24d1fd2aa4d6a5f93b7f09ea969473201ddddd69a1419c6f1511a14c5945ba3217126384add36b52014a0f99c0ab3a3d58bd47e53d00f38623bf26706d51c45647909dcfb669825442804386c0f18ac3d7f2ed33e2d884761119f4024ff8a3c615ac0f29e743eda8863377f9776619fd2db763d1b5be1589a83fc98b82781c263708b2eb3b47b3dffed04dc90cf1c548f40577d642c52241ec76c405e91f329294fb696f55793203abf1f6aba9b404209dcadeaea6a7df69262fef1beeda940881d4d4bdcc5d9ef3ddb42ccc9126e6c07faa3df2807e3506d7ff06abc509692c600b5b69b4dc6ceaa4b15555e7ad4c895c558c7214496df1cd56d1390c51661fbe20b7589e6b61eedcd5fe1e958e1a95fbd1366c90331c8b991e7895d37796ac712b5895dda3b6d8d730153d6151e03549f276faca0275ed9c7b26ec7aaf336b7d2593d980908be9bc4fed6d407c66fc874a1f9d65052d4c67a314da1dae914f1daff7550f14b64c1c724035a075b36e71423719a1f30794b6d99daefd5e27ecb33e12691c4026739bf987a4b6f31edb8db48cc22a1d41e298b38c4a6417e7b955a5ece1e1b085c12dac7ac10e0eb1f5b0d4d7f6f0ce52a59bdfc5757c3982aac2353b58f4c73820428afeb64484d311211658383ce7f79d31a0a848d665ed24dc1a41f6b4b7c7ffac7693d6b37be8519037888b189f13047371758f7aed2283c6b5885cb72f1e8ee5e6e44488cd6cbdbca94722f96ed8aa8af3ea1de8e968a3e49a40afb063692ab8eae8ae5a08aec3013ee8f6132b2a9012b45002f8eaa8afa9b9f9183b4e00c46e2b82d34047e3c177bd08cfb9c31cc944da57458555aa398bb99336d5a1f9092287c0339a8102f91c5a257a7e27625d9d02991d5e0a13afab54533a95f8019dd7530bd38a07191e7c2c36dcad14149d8e455b960af62a2ffb2759738180dd24427b8824445dbbc23c30ffc1cb0d8985447b035c447c1ed45f38fad7ca7a4254cb66899b93c070aac11b52dfc3e41a55cbb24a331ae759ba3c3cd3b23d033cd91253a9e61a4bf59c8a6709c000ba9d482773cbbc2c3544d61b109bc9eb8329e8968cb83234f0de0217aa8c934a68a317ee518a5b4818debf2adbaba872aaffd6a0f64a26449faa9bc513ea7989e3234b395cafb8ed5ccc3755636aa3c46a9643b18125abb8aefc13219014e9c4be8ab6606b76e5a054be08cab3d07da323e90e751e8ad623e14ebdfe82b9627811d57b9a39e283d6128b7252377a3d82c73d497bfafa3eabe84de1d02c4b745a35bad072d93a9b83080e9920ec52c6b5a27b7befdc106c600585d3eec87d7e98e1c136839aeb9faa60f85f6f780a34b8d0faaf45b3e3966fddabb75a9059c2d5803db49e6ed6c6f7e0b367f96bec19401b2f58dc6d2632cb473d44be98dd8292a93c5967f85626795f647d4bf6eb67227f9b79e02f5cf1692a1fc7a47120e6508309765db7e33477946cf19d27c8a7fb7a8bbf1e1000e9318749bcd82cfd488f4388ff4aa268906e25c2144f1433a4edec2da73ae0790e458e878b300b57ceb5f81ac573b46ddb6697447a97198bdef9bae00215059eb5e8bc2ddb94181dcbc723d96ffc07fddd14d97e4849016ddb9da4475c1cef7d5389062bdfdfbdbd1394648e0198fd2b6e1679e36d32933941182d9afa82f6fe53b0483d08da44da9dfe8a84bf2837e5163699bea56cd31d82b853932d50f1144e95b21817e52cfef3a510e3f94df3ea9fcd01621155ca5f2c3bf5bf4436225d8a5fd1715d3c2290d8a50643e726031f4f1785be270ae13f36f6a8cfbf6faaae50e660af5c9fd927027beaa3760d2a84daa8b00e6e5ee21f77738448eec70113cf711656914b61905b3bd47fa4209b6182a4c1609ce34d40b67f5cfd7f00f53fa78e67c0df002c509bcdea88677fb5e2fe6a9b1fd090040b5f584f4fcbe466878cb204d0735dcf4fd429cf86db999572f3d9ca7c54561fdf7d388a4

sha256 (10)

0880819ef821cff918960a39c1c1aada55a5593c61c608ea9215da858a86e3496328a34b26a63423b555a61f89a6a0525a534e9c88584c815d937910f1ddd538822dd269ec10459572dfaaefe163dae693c344249a0161953f0d5cdd110bd2a0887e1f5b5b50162a60bd03b66269e0ae545d0aef0583c1c5b00972152ad7e073bef7e2c5a92c4fa4af17791efc1e46311c0f304796f1172fce192f5efc40f5d7d5edd791021b966fb6af0ace09319ace7b97d6642363ef27b3d5056ca654a94ce6310d8a003d7ac101a6b1cd39ff6c6a88ee454b767c1bdce143e04bc1113243e64e152afe2c722d750f10259626f357cdea40420c5eedae37969fbf13abbecfecce7ae5ffc9f57bb70efd3ea136a2923f701334a8cd47d4fbf01a97fd22859cf7084b0229dce605ccc5506b14acd4d954a496da4b6134a294844ca8d601970d
Storm-2561 Weaponizes SEO Poisoning to Deploy Trojanized VPN Clients and Steal Enterprise Credentials11 indicators · Mar 13, 2026

sha256 (11)

26db3fd959f12a61d19d102c1a0fb5ee7ae3661fa2b301135cdb68629898917944906752f500b61d436411a121cab8d88edf614e1140a2d01474bd587a8d7ba857a50a1c04254df3db638e75a64d5dd3b0d6a460829192277e252dc0c157a62f6129d717e4e3a6fb4681463e421a5603b640bc6173fb7ba45a41a881c79415ca6c9ab17a4aff2cdf408815ec120718f19f1a31c13fc5889167065d448a40dfe685c4837e3337165d24c6690ca63a3274dfaaa03b2ddaca7f1d18b3b169c6aac1862f004679d3b142d9d2c729e78df716aeeda0c7a87a11324742a5a8eda9b5578ebe082a4b52ad737f7ed33ccc61024c9f020fd085c7985e9c90dc2008a15adc98f21b8fa426fc79aa82e28669faac9a9c7fce9b49d75bbec7b60167e21963c9cfa4781ebfa5a8d68b233efb723dbde434ca70b2f76ff28127ecf13753bfe011eb8b81277c80eeb3c094d0a168533b07366e759a8671af8bfbe12d8bc87650c9
Iranian MOIS Cyber Actors Embrace Criminal Ecosystem: From Rhadamanthys to Ransomware Affiliates25 indicators · Mar 10, 2026

md5 (1)

eb5e96e05129e5691f9677be4e396c88

sha1 (10)

0902d7915a19975817ec1ccb0f2f6714aed196382087bb914327e937ea6e77fe6c832576338c2af821a435ecaa7b86efbec7f6fb61fcda3da686125c389b12da259a23fa4559eb1d97198120f2a722fe551bdf646df8e9abe04483882650a8ffae43cb55579a4584a6eef0a2453841453221d0fb25c08c899dcb994ea2b8e6169b76a524fae7b2d2dcd1807db674578d4bdb24cd58bf2dc884eaa658b7aa250cd920ae0f8ea8b5bd42de49e01c6bbd4c2c6d0847f8444dfc740b94227ab9b2e757b8f8f1fa49362a

sha256 (14)

077ab28d66abdafad9f5411e18d26e87fe43da1410ee8fe846bd721ab0cb52de24857fe82f454719cd18bcbe19b0cfa5387bee1022008b7f5f3a8be9f05e4d142a09bbb3d1ddb729ea7591f197b5955453aa3769c6fb98a5ef60c6e4b7df23a52b7d8a519f44d3105e9fde2770c75efb933994c658855dca7d48c8b4897f81e64aef998e3b3f6ca21c78ed71732c9d2bdcc8a4e0284f51d7462c79d446fbc7be64263640a6fdeb2388bca2e9094a17065308cf8dcb0032454c0a71d9b78327eb64cf334716f15da1db7981fad6c81a640d94aa1d65391ef879f4b7b6edf6e7f174db1f653da6de134bdc526412a517a30b6856de9c3e5d0c742cb5fe9959ad0d94f05495eb1b2ebe592481e01d3900615040aa02bd1807b705a50e45d7c53444a4bd1371fe644d7e6898045cc8e7b5e1562bdfd0e4871d46034e29a22dec6377a8c380b57cb7c381ca6ba845bd7af7333f52ee4dc4e935e98b48bb81facad72ba92d28f1d32e3a9ab7c3691f8bfca8f7586bb0666adbba47eab3e1a8faf7ecc0aae017e7a36e016655c91bd01b4f3c46309bbe540733f82cce29392e72e9bd1fddceade244c636435f2444cd4c4d3dc161981f3af1f622c03442747ecef50888
BoryptGrab Stealer Spreads Through 100+ Fake GitHub Repositories in Massive Malware Campaign17 indicators · Mar 8, 2026

Domains (1)

claude[.]ai

sha256 (16)

0434437a073a3f3a49e84d5ecb20c99dd551bacc32bf100fbb8cf67a5064218115de71073f44c657c23f5f97caa11f1b12e654d4d17684bfc628cc1e5b6bcdd51bd605ef84b6767df74bd6290f1468eed5a88264df23fcf70b6a75d5bdcf7d762050468744e44554fac17fb83f1515c95f2f2236716e2b5267a81c2b94205e6a2abe0ef88ba92db79d82cde4c0ed1f382bb347517a54ea82084c841d0f9555184264a88035aa0b63e9aef96daa78a58114d60a344ea10168a8ef5ef36bf8edbd433a13cc70396f80dc29d1150c050339d78964fdc91bcdc3f40c67a77add1476449f528f5ceae8c3f8336d0d8e3e3ec9031d1ad67c31ee7311b67e01d5fdf2254e90d386c1c7d3d1fd4176975795a2f432d95685690778e09313b4a1dbab9997576692df4bf1c7d8927d3a183f5219a81c3bff3dd22971691f8af6889f80c5a07f2315b89fb9a47e1516def136844d617bfcdce19000a1b0436706692dbe166cc40b9913e79c5dd09751b1afb03aaa98658bab61bacf27a299abd84fd44fe707d295720bc0c1111ce1c3d8b1bc1b36ba840f103b3ca7e95a5a8bf03e2cc44fe5ed1745cc49b929e499966d87e163219fe0f24069fe88dfacbd69c0ebab85a640fa767391b99865f8533efc1fe6dfa6175215718679fb00ca85fc13c3bd4ae4b7fe4e5fb28d2c2b3a640112b6b125ce8c4afa8be28342e3bfda097ad9dd2ef9ee
Google Disrupts Chinese APT UNC2814’s GRIDTIDE Backdoor Campaign Targeting 42 Countries6 indicators · Mar 6, 2026

sha256 (6)

01fc3bd5a78cd59255a867ffb3dfdd6e0b7713ee90098ea96cc01c640c6495eb4eb994b816a1a24cf97bfd7551d00fe14b810859170dbf15180d39e05cd7c0f9669917bad46a57e5f2de037f8ec200a44fb579d723af3e2f1be1e8479a267966ce36a5fc44cbd7de947130b67be9e732a7b4086fb1df98a5afd724087c973b47d25024ccea8eac85a9522289cfb709f2ed4e20176dd37855bacc2cd75c995606eb08c840f4c95e2fa5eff05e5f922f86c766f5368a63476f046b2b9dbffc2033
Google and Mandiant Disrupt GRIDTIDE: Chinese APT Espionage Campaign Compromises 53 Victims in 42 Countries6 indicators · Mar 5, 2026

sha256 (6)

01fc3bd5a78cd59255a867ffb3dfdd6e0b7713ee90098ea96cc01c640c6495eb4eb994b816a1a24cf97bfd7551d00fe14b810859170dbf15180d39e05cd7c0f9669917bad46a57e5f2de037f8ec200a44fb579d723af3e2f1be1e8479a267966ce36a5fc44cbd7de947130b67be9e732a7b4086fb1df98a5afd724087c973b47d25024ccea8eac85a9522289cfb709f2ed4e20176dd37855bacc2cd75c995606eb08c840f4c95e2fa5eff05e5f922f86c766f5368a63476f046b2b9dbffc2033
UAT-9244: China-Nexus APT Deploys Three New Malware Implants Against South American Telecom Providers45 indicators · Mar 5, 2026

sha1 (1)

2b170a6d90fceba72aba3c7bc5c40b9725f43788

sha256 (44)

00735a8a50d2856c11150ef1e29c05acebce7ad3edad00e37c7f043aacb46330023467e236a95d5f0e62e26445d430d749c59312f66cf136e6e2c2d526c46ba103eac9eb7f4b4bc494ef0496ee23cabbf38f883896838ed813741d8f64ac9fde06b23d84fd7afd525dfd7860ebd561dcdd72ccbeb51981d5d9a75acf068d0a2a075b20a21ea6a0d2201a12a049f332ecc61348fc0ad3cfee038c6ad6aa44e7440c7e36683a100a96f695a952cf07052af9a47f5898e1078311fd58c5fdbdecc815d937803f90c2b9e277ff94d3e98ff30015ecc7f4623a158e3c98861e5cb27817652d7bb5fe0454023db4fc7f608df0dbe6af237be31258e16ba52f0e895e261cedf01dd4b7e50181d0e781825c66957b862941395d77c8bd7705114f319c801f5635a512a923e98a90cdc1b2fb988a2da78706e07e419dae9e1a54dd4d682b1fcdd5a417db31e5e07d32cecfa69e53f0dce95b7130ad9c03b92249f001801d2c3f2261b00ea45e25eb4e9de2b7ff8e41f311c0b3d986461f834022c08b3b992d2ca7d21310b14f5f5641bbf4a9ff4c3e566b1fbbd370034c6844cedc8f053834d64b3cd9430e85edefcb883973a086dd5de9917e05fabec89b1f4ab9627e9138eeaa4eaad72feb3f8e6993565fcc548d8e7bb93642590f00fa24aacc0e28623c098a687947938e36ab34b9f09a11ebd82d50089cbfe6e237d810faa729f8ff3d9fbfc2c056eac857ba54e5ed134aa45a4b8322ee9f9353ba32e5b2ca71b0e33fcadde4b414a18b2fed56c1ec59d97977123615fbbf411a1c78425445a6e71c3fcced9332301ff70b20c98c9434c858400013d659afa6bb5149cffb0206357d56bead2933e91366e4a0d5761daf5b238a7f2c22e597664ef67b3ecae20ab32666adeedfb739774fcc09aa7426c8fad29f8047ab4caee8040d07c0e84d01161166bdce93de3b02cf9cdadad18ca1504ac83e379a752d51f60deae6dcbafe4e3166ce42258062e902bd7f9e90ad5453a901cfc424f0ea497c4d14f063f3acd3296a2d23cc8746a83e9a3b974788fce0e414706b8e75ff390426dd7e10b19967b36ec070457d1f6f239cb02c5e1576a3660cca98f3a07eec6e4e107f698d7fe555711d9427ee43bc2186b9124f31cba2db5f54ec9a0d56dc2948e1a4377bada28974d1a678bdc4bb9f33321e94e3bd1bc1740472ed734231fc46af720072ecb77e74fbc8360d4c95d64d7acaa4d18943dce2d41f91d080b0b5e435d8bce52861a57b70cd956f082b1029d02b4cb7608893f2de7fa9c500d7d7febdd0f745ac3cb6870e791af14caaf395c56028176a9c3f4c1ff0318ef3112d57ecd3d4a1be2ef99a7225c17e4bad3ffe7f080530d36f4f8aca5c116b913caa91ab9b0cee85638ea313f76fca50fff1bcd6f2c6cbc1268985f8c0a3a05fe7f43c4fc0ac3aff84dca5e413456ce9fc60bb44d442b72546e9e4118a61894fbe4b5c56e4dfad6055e3babc81fc9c998e9dc4ab545f0e112e34d2641e1333bc81aaa131abd061a5b604bfc35f12d00fa4b40c5fbce9e37d704e12a52262709bcbdf09f97890bc40cad5c9a42423ef08bd7f183915780d39530eba5e4e25968c51965ff8bb3026965a28c9fc2af30f769d856b88b3051f19fdb663b3e0a0916279df9bbcba93c6a110c9d5eb979cb8a72706bfa591fa57d4ebf7d13cecdc9377b0192375e2f570f796dfd78b3c6df8f3756a7e310cf7435fdba201dd03ec9f97420a0db683489a01a7c9e34c9159e6e78c59518a14c5b96bddfee094b684f99d4f69b13371284a014e87ebcb2691b7c92cdf2b2ff5e2d753abeea8cb325c16596cd839e6bd147f80e38af36913607356a32ea106103387105c635fa923f8ed98ad0194b66ec79e379a02f3e899789b56429f483e5096e1f473335024f1f763e2d428132338e30352b89ef8066833e47814793d8c58743622b051070dac09cb010c323970c81b59260f84
Zerobot Malware Targets n8n Automation Platform: First Active Exploitation of CVE-2025-686136 indicators · Mar 3, 2026

sha256 (6)

045a1e42cb64e4aa91601f65a80ec5bd040ea4024c6d3b051cb1a6aa15d03b57360467c3b733513c922b90d0e222067509df6481636926fa1786d0273169f4dac8e8b627398ece071a3a148d6f38e46763dc534f9bfd967ebc8ac3479540111fcc1efbca0da739b7784d833e56a22063ec4719cd095b16e3e10f77efd4277e24d024039824db6fe535ddd51bc81099c946871e4e280c48ed6e90dada79ccfcc7deb70af83a9b3bb8f9424b709c3f6342d0c63aa10e7f8df43dd7a457bda8f060
Silver Dragon APT Targets Southeast Asia and Europe Using GearDoor Backdoor with Google Drive C232 indicators · Mar 3, 2026

md5 (1)

9d3f61dcaba90db2ede1c1906a80ace2

sha256 (31)

166e777cb72a7c4e126f8ed97e0a82e7ca9e87df7793fea811daf34e1e7e47a616b9a7358be88632378ba20ba1430786f3b844694b1f876211ecdbecf5cccbc219139a525ee9c22efd6a4842c4cd50ab2c5f9ee391e5531071df0bb4e685f55d2f787c1454891b242ab221b8b8b420373c3eb1a0c1fdcb624dd800c50758bbb03128bdb8efaaa04c0ba96337252f4cc2dc795021cbc410f74ace9dde958bac1d37b485ed8d150d022c41e5e307b8c54c34ef806625b44d0c940b18be7d5b29ce3a2df7a2cfeca5ba315a29cf313268a53a22316c925e6b9760ead8f4df0d1f753e2a0bafbd44e24b17fd7b17c9f2b2a3727349971d42612d55bbc1732082619a43f8f94ca5aa0af7bfb0cc1d2f664a46500a161b2d082b48b516d084ef48534844e769efed3e4f9f04c52dcd13f15cead251a1a08827a2cb6ea68427522c7fbb4f93be0c46a53701b1777ab8df874c837df3d8256e026f138d60fc2932e569a851684a0e356513486489986f5832c948107ff687c8501d64846cdc43074294135341c7256542405abdd01ee288b08e49dcb6d1782be6b7bea63b459d80f9a8f5568c67564d62b09d1a1bc29a494cf4bf31afddcafcf78592b178c63f23ccfcae5ad857df8976523cb3ad2fdf30e87c0e7daa64135716b139ffdcd209b98e165472e4b6540e32b8b7aac850055609bc5afc19e29834e9aa6be29a8ea59a2c97857384462d420bdc9683a4cac2a8ad19353a2aa7d2244c91e9182345777e811e33740a09fcdefa5a5f79355b720f54ff09efa64062229fb388adbccd9c829e9ff074a11a07d167f8f5c0baa724d1f7708985c81d0ac3d0e4d7ef3f3220c335e0097f89a4d5af47bc00a9ad58f0bcbe8a7be2662953dcd03f0e881cc5cbf6b7bca885a03d2e74ae84093a74699057693d11e5c61f85b62e741778cbc5fc9f89022f8c29f9189a9ad75a959024f59e68c62d42a6fd42f9eacf847128c7efe4ef7578948468aba5c851952ebe56a5bf37904ed83a6c8cb520304db6938d79892f0a1b967b5c611d304385807ea2d865fa561c15cde0473dd63e768679a4f29f0e4563a6b5448ba45f3f352f5f4c5376024891adda1ef8ebf62a8fe63424fa230c691db93560c4d18120e113fb8b04a8aa05f66a12116d1fbf18a93186f6314381e97ebcbe2f0a8134c0e7fce18d0394ababc1d910e6f7b77b8c07643434cd14f4c5d6bd699ed720e2bd7085b3444cb8f4d36870b5b48df1055ec6cc1553db3eef7fafc4de1f1a8cb3b0392802ee56096ddb25b6f51c51350ce7c45e14d8c285765300ddaca57f3d5f4986da052ca172631b351410d6f5831f6af351699c6201cc011be3b016f2fc865d0f53f635f740eb0203626517425ed9a2908058f96a3bcf470d
Google Disrupts UNC2814 GRIDTIDE Campaign: Chinese APT Breaches 53 Organizations Across 42 Countries6 indicators · Feb 28, 2026

sha256 (6)

01fc3bd5a78cd59255a867ffb3dfdd6e0b7713ee90098ea96cc01c640c6495eb4eb994b816a1a24cf97bfd7551d00fe14b810859170dbf15180d39e05cd7c0f9669917bad46a57e5f2de037f8ec200a44fb579d723af3e2f1be1e8479a267966ce36a5fc44cbd7de947130b67be9e732a7b4086fb1df98a5afd724087c973b47d25024ccea8eac85a9522289cfb709f2ed4e20176dd37855bacc2cd75c995606eb08c840f4c95e2fa5eff05e5f922f86c766f5368a63476f046b2b9dbffc2033
Chinese APT Campaign Delivers PlugX RAT via G DATA Antivirus DLL Side-Loading8 indicators · Feb 26, 2026

sha256 (8)

29cd44aa2a51a200d82cca578d97dc13241bc906ea6a33b132c6ca567dc8f3ad46314092c8d00ab93cbbdc824b9fc39dec9303169163b9625bae3b1717d70ebc5f9af68db10b029453264cfc9b8eee4265549a2855bb79668ccfc571fb11f5fc6df8649bf4e233ee86a896ee8e5a3b3179c168ef927ac9283b945186f8629ee78421e7995778faf1f2a902fb2c51d85ae39481f443b7b3186068d5c33c472d99d293ded5a63679b81556d2c622c78be6253f500b6751d4eeb271e6500a23b21ede8ddc2451fb1305d76ab20661725d11c77625aeeaa1447faf3fbf56706c87f1e7ed0cd4115f3ff35c38d36cc50c6a13eba2d845554439a36108789cd1e05b17
Unit 42 Exposes Active Exploitation of BeyondTrust CVE-2026-1731 with VShell and SparkRAT Backdoors14 indicators · Feb 23, 2026

Domains (1)

oast[.]fun

sha256 (9)

0ecc867ce916d01640d76ec03de24d1d23585eb582e9c48a0364c62a590548ac4762e944a0ce1f9aef243e11538f84f16b6f36560ed6e32dfd9a5f99e17e8e5066cceb2c2f1d9988b501832fd3b559775982e2fce4ab38fc4ffe71b74eafc726679ee05d92a858b6fe70aeb6072eb804548f1732e18b6c181af122b833386afb98442387d466f27357d727b3706037a4df12a78602b93df973b063462a67776198a7b0900a9072bb40af579ec372da7b27af12b15868394df51fefe290ab176b9f431d5549a03aee92cfd2bdbbe90f1c91e965c99e90a0c9ad5a001f4e80c350cc2bc3750cc5125a50466f66ae4f2bedf1cac0e43477a78ed2fd88f3e987a292cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce

CVEs (4)

CVE-2025-55182CVE-2026-0257CVE-2026-1731CVE-2026-31431
XWorm RAT Campaign Exploits CVE-2018-0802 in Multi-Language Phishing Attacks Using Fileless Injection8 indicators · Feb 11, 2026

Domains (1)

r2[.]dev

md5 (1)

3bc1de741f8149f49bdbafa703067f24

sha256 (5)

3f4c3c16f63fb90d1fd64b031d8a9803035f3cb18332e198850896881fb42fe58665bc1b33cbe6f5859cd6e362af77738ba73a6e6d4b9974c16c8521d84c1892eacd8e95ead3ffe2c225768ef6f85672c4bfdf61655ed697b97f598203ef2cf6ee663d016894d44c69b1fdc9d2a5be02f028a56fc22b694ff7c1dacb2bbbcc6dfd9ba9e6bd4886edc1123d4074d0eac363df61162364530b1303390aa621140b

CVEs (1)

CVE-2018-0802
BlueNoroff’s GhostCall and GhostHire Campaigns Use Stolen Victim Videos to Compromise Crypto Executives65 indicators · Feb 10, 2026

md5 (57)

00dd47af3db45548d2722fe8a448950801d3ed1c228f09d8e56bfbc5f5622a6c0af11f610da1f691e43173d44643283f0ca37675d75af0e7def0025cd564d6c510cd1ef394bc2a2d8d8f2558b73ac7b81243968876262c3ad4250e1371447b231653d75d579872fadec1f22cf7fee3c017baae144d383e4dc32f1bf69700e58719a7e16332a6860b65e6944f1f3c50011ee10fa01587cec51f455ceec779a160261a409946b6b4d9ce706242a76134e32b499eb3865a7ef17264d15252b7f73e2c42253ebf9a743814b9b16a89522bef31b88dd319af8e4b8a96fc9732ebc708358c2969041c8be74ce478edb2ffcd19389447013870120775556bb4519dba9738c8d80dd32d00e9c9440a498f7dd7393bbe4dfe3134c8a7928d10c948e20bee50f341b24cb75f37d042d1e5f9e3e5aa529fe6eff1cf452680976087e2250c025ad40a5fd18a1b57b69c44bc2963dc6b5cb4f0084f3c25e640952753ed5b25d060bfe4f378e9f5a84183ac505a0322286348b49f3499d760797247b94385fda36422795a6df10c45c1006f92d686ee7e6aa93664b4852cb5bad84ba1a187f6457168ce5c6e5545a5b389db09c90038da73d26eb56e5a3426884733c104c3f6257581854ff6c890684823f3aed03c210f76ace3a6892c25512b17ed42ac2ebd057e50c3f301dd045eb189ba1644ded1557f94ed2d5f566c12de5ebe4b5e3d8aa38006efb8dd703073197e5a27682b35bf8f8942cd14f646f59729f83cbd4c357b931cec3c80c78d233e3602a042a2e71b9551b4af789b2db563f9452eaf46b6aa963f473f1734d8b3fbb8c9a227c06d07a070b77c5028d7a5d2895f1c9d35016fa0eb7e480752d494709c63aa35ccf36ca26f2b97ca4e2b4b5d58933900f02131a6ce961f487b4cbdfe68d0a249647c48ab1e8693931f8c694247d96cf5a85197b2e9a6412fd7c068a5d7c38d0afd946fb567bfdaac131a2d8a23ad8fd450a31dc42c7a2ea1c2f00dddb0cc4c8bfb5bcfc446682f33641cff21083ac2ce477dbec6f0c8d41b9ad4f079161548d2435d80d63805e89053716b6ab93ce6decf8450d8529855fab4b4aa6c2b34449cb3b9fbde93e85199240de761a8ba0a56f0088de33f942cf1479ca8530a916868bad954e8680d17fba6425e4a9bb552fb8db2b1e9fdd703e60b31eb803b1b59985cabeceda0525c078f5a216a977bc64e86160af1bad0efbd3bd5a4202fe740756f977af1d2af27b13cd3424556b18dfd3cf83ff8bb2528bf35f8c11fbc4369e68c4038

sha256 (8)

3dd226d0b700f33974f409142defb62a8cd172ae5f2eb9beb7f5750eb1702e2a4451ee8bc53ea7c148d8348bc7b82aca9977bdd31c0156dfe25c4a879a1d21905b77f83ecefa0e32ba922f61c9efff7f755ba51a010db844ca7e8ad3db28650a71b743c529f0b27735f7774a0903cb908edc93423b60fe9be49a3729982d0e8da6c1a7ce43b029a1ef4ae69b26f745440ecce8368c89f11ac999d4ed04a31572b3cc15c1033de79024f9cf3cd6a6a7a9b7e54a1a57d3156036f5c05f541694b7b494a0ae421afe170f6cb9de2c1193a78fbe16f627f85139676afc5d9bfe93a2c4db903322d17c8cbf1d1db55124854c0b070d6ece54162b6a4d06df24c572df
APT28 Exploits CVE-2026-21509 in Operation Neusploit: Stealing Emails with MiniDoor Backdoor37 indicators · Feb 9, 2026

md5 (12)

154ff6774294e0e6a46581c8452a77de2f7b4dca1c79e525aef8da537294a6c44727582023cd8071a6f388ea3ba2feaa7c396677848776f9824ebe408bbba943859c4b85ed85e6cc4eadb1a037a61e1695e59536455a089ced64f5af2539a449d47261e52335b516a777da368208ee91e4a5c4b205e1b80dc20d9a2fb4126d06ea6615942f2c23dba7810a6f7d69e2daee0b44346db028a621d1dec99f429823f05d0b13c633ad889334781cf4091d3ef3b869a8d5ad243e35963ba6d7f89855

sha1 (12)

22da6a104149cad87d5ec5da4c3153bebf68c41123b6f9c00b9d5475212173ec3cbbcff34c4400a74592e6173a643699dc526778aa0a30330d16fe087bbb530eb77c6416f02813cd2764e49bd084465cc1b272067491258ea4a2b1d2789d82d157aaf90ac4799d17a4343bd353e0edb0a4de248b99295d4dc8c84bf33c05fb3a69bc5e2d6377b73649b93dcecea7e9323d79054f92634f4032c26d30c1cedd7ed577c4a264fee27084ddf717441eb89f714972a5d788d85335e20bb1f173d4d0494629d36083dddcda1c3e92f69e6ca0e4f4823525905cb6969a44ade52a9f004f4359ea0f8f9c6eb91731ed78e5c4d3

sha256 (12)

0bb0d54033767f081cae775e3cf9ede7ae6bea75f35fbfb748ccba9325e28e5e1ed863a32372160b3a25549aad25d48d5352d9b4f58d4339408c4eea69807f502822c72a59b58c00fc088aa551cdeeb92ca10fd23e23745610ff207f53118db93f446d316efe2514efd70c975d0c87e12357db9fca54a25834d60b28192c6a695a17cfaea0cc3a82242fdd11b53140c0b56256d769b07c33757d61e0a0a6ec029f4672c1374034ac4556264f0d4bf96ee242c0b5a9edaa4715b5e61fe8d55cc8a876f648991711e44a8dcf888a271880c6c930e5138f284cd6ca6128eca56ba1a944a09783023a2c6c62d3601cbd5392a03d808a6a51728e07a3270861c2a8eeb2ba51b4491da8604ff9410d6e004971e3cd9a321390d0258e294ac42010b546bb23545380fde9f48ad070f88fe0afd695da5fcae8c5274814858c5a681d8c4ec91183175ce77360006f964841eb4048cf37cb82103f2573e262927be4c7607ffd3f13db41cd5b442fa26ba8bc0e9703ed243b3516374e3ef89be71cbf07436b

CVEs (1)

CVE-2026-21509
North Korean Hackers Deploy AI-Generated Deepfakes and Seven Malware Families in Targeted Cryptocurrency Attacks11 indicators · Feb 9, 2026

md5 (4)

3712793d3847dd0962361aa528fa124c4e4f2dfe143ba261fd8a18d1c4b58f2ec91725905b273e81e9cc6983a11c8d60eb7635f4836c9e0aa4c315b18b051cb5

sha256 (7)

03f00a143b8929585c122d490b6a3895d639c17d92c2223917e3a9ca1b8d30f91a30d6cdb0b98feed62563be8050db55ae0156ed437701d36a7b46aabf086ede603848f37ab932dccef98ee27e3c5af9221d3b6ccfe457ccf93cb572495ac325b452c2da7c012eda25a1403b3313444b5eb7c2c3e25eee489f1bd256f8434735b525837273dde06b86b5f93f9aec2c29665324105b0b66f6df81884754f8080dc3e5d878a30a6c46e22d1dd2089b32086c91f13f8b9c413aa84e1dbaa03b9375c8f7608d4e19f6cb03680941bbd09fe969668bcb09c7ca985048a22e014dffcd
ShadowHS: Fileless Linux Post-Exploitation Framework Runs Entirely in Memory25 indicators · Feb 3, 2026

sha256 (25)

04a072481ebda2aa8f9e0dac371847f210199a503bf31950d796901d5dbe9d58072e08b38a18a00d75b139a5bbb18ac4aa891f4fd013b55bfd3d6747e1ba0a270bb7d4d8a9c8f6b3622d07ae9892aa34dc2d0171209e2829d7d39d5024fd79ef148f199591b9a696197ec72f8edb0cf4f90c5dcad0805cfab4a660f65bf27ef319df5436972b330910f7cb9856ef5fb17320f50b6ced68a76faecddcafa7dcd720c1819c2fb886375d9504b0e7e5debb87ec9d1a53073b1f3f36dd6a6ac3f4273ba88f92a87c0bb01b13754190c36d8af7cd047f738ebb3d6f975960fe7614d63f014aa3e339d33760934f180915045daf922ca8ae07531c8e716608e683d92d4069eaadc94efb5be43b768c47d526e4c080b7d35b4c9e7eeb63b8dcf0038d7d574a17028b28fdf860e23754d16ede622e4e27bac11d33dbf5c39db501dfccdc5a6b08d42cc8296b32034b132bab18d201a48c1628df3200e869722506dd4ec6662d4e58e95b7b27eb961f3d81d299af961892c74bc7a1f2bb7a8f2442030d0e666122c39b2fd4499678105420e21b938f0f62defdbc85275e14156ae69539d66c50fcf14af7f984a152016498bf4096dd1f71e9d35000301b8319bd50f7f6d072023e9829b0de93cf9f057858cac1bcd4a0499b018fb81406e08cd3053ae55b7361c6861fdb08cab819b13bf2327bc82eebdd70651c7de1aed18515c1700d977fbab71fcc454401f6c3db91ed0afb0027266d5681c23900894f1002ceca389a8007b94d367b7dbacaac4c1da0305b489f0f3f7a38770dcdb68d5824fe33d041847846a0f0c76cf5699342a066378774f1101d2fb74850e3731dc9b74e12a69d9f2cfc65b480695aa2fd847db901e6b1135b5ed982d9942c61b629243d6830dd9fdaf64180b7d02b399d2a92f1cdd062af2e6584852ea597c50194b62cca3c0bb3ee445675fce1fccf365a7b681b316124b1a5f0a7e87042136e91776b187f39c679b408275f9624602702f5601954f3b51efbb1acc505950ee88175854e783fe11bcba19ac628ae1d0b56e43646ae1b5da2ccc1da5162e6719d4b7d68d37096e5a6deec56095d0ae702655ea2899c752f4a0735f9077605d933a04d45cd7e24
WinRAR CVE-2025-8088: Russia, China, and Cybercriminals Unite to Exploit Path Traversal Flaw44 indicators · Jan 31, 2026

sha256 (44)

272c86c6db95f1ef8b83f672b65e64df16494cae261e1aba1aeb1e59dcb6852429f89486bb820d40c9bee8bf70ee8664ea270b16e486af4a53ab7039969432562c40e7cf613bf2806ff6e9bc396058fe4f85926493979189dbdbc7d615b7cb1433580073680016f23bf474e6e62c61bf6a776e561385bfb06788a4713114ba9d3b47df790abb4eb3ac570b50bf96bb1943d4b46851430ebf3fc36f645061491b3b85d0261ab2531aba9e2992eb85273be0e26fe61e4592862d8f45d6807ceee4498961237cf1c48f1e7764829818c5ba0af24a234c2f29c4420fb80276aec6764f4567abe9ff520797b04b04255bbbe07ecdddb594559d436ac53314ec62c1b353f1b841d323c211c715b8f80d0efb9529440caae921a60340de027052946dd954305c7b95d8105601461bb18de87f1f679d833f15e38a9ee7895a0c8605c0d055b3dc57929d8eacfdadc71d92483eabe4874bf3d0189f861b145705a0f0a8fe5b64786ed92545eeac013be9456e1ff03d95073910742e45ff6b88a86e91901b5dee69127d501142413fb93fd2af8c8a378682c140c52b48990a5c41f2ce361668d9020aa9b509a6d018d6d9f4c77e7604a588b2848e05da6a4d9f82d725f91b6d3586aa6603f1c1c79d7bd7e0b5c5f0cc8e8a84577c35d21b0f462656c2e1f9867a05d67dd184d544d5513f4f07959a7c2b558197c99cb8139ea797ad9fbece8a7ee2a8e6b3476319a3a0d5846805fd25fa388c7f2215668bc134202ea093fa91e61fd77460393a89a8af657d09df6a815465f6ce22f1db8277d58342b32249958921ea0995482fb04ea4a50bbdb654f272ab991046a43c1fdbd22da302d544a54bcafd9d4ece87fa314d508a68f47b0ec3351c0a270aa2ed3a0e275b9db03ca97f460bfa612f1d406823620d0d25e381f9b980a0497e2775269917a7150f04ae93d9327a91e90bf7744c6ce0eb4affb3acb62a5d1b2dafd645cba9af28d795aea13e5871b683a19a05015ff0369b412b985d47eb67a3af93f44400a026b4b0b2b62703a1ef7d9d3376c6b3609cd901cbccdcca80fba940ce8ed3f4e54cdbe6b53069a380a9dd3dc1c758888d0e50dd43935f16df0f7124c77569375a9f44f5b90ef1d21523eeffbca17181ccccf269bca3840786fcbf5c73218c6e1d6a51a9ba86b6e0199b8907427364246f049efd67dc4eda0b5078f4bc7607253634cf24bb4856a66bf7e0de18522e35798c0a8734179c1aab21ed2ad6821aaa99e1cb4cc7726c166e1947fdbf808a50b75ca7400d56fa6fef2a76cefe314848db22c76ccf35ce47b35f1405969f40633fcf35132ca3ccb3fdfded8cc270fc2223049b80cf8ebfd98da3025dc09d0b3bbeef874d8f9c4d4ba4937719f0a9a3aa04c81bebd418f878fa02729b38b5384bcb3216872a968f5d0c9c77609d8c5aacedb07546d981a16b9da1615514a02f5ebb38416a009f5621c0b718214d5b105c9f552389ddd67dda5d58c7480152c9f6e8043c3ea7de2e593beedf86b867b83f005bf0ccdefe25e400d4925d8a2bb4b1181044d06a8bf61688fd9c9ea59f1e0bb7bc21d8e836873479ff558cfb885097e8783356aad1f2d30b69d825b3a71cb7a57cf930ea0869fa9d5e23bdd16cddfefbbf9c67744598f379be306ff652f910db1ba162ed5b920dad5dcd3f9e55828f82a27211a212839c8942531c288535b92df7f453edc1f7528ca93ec432daca820f47e08d218b79cceca1ee764966f8f90d6a58bdef0e1bb2d389ab8b5f15d2f83cf978662e18e31dbe875f39db563e8a019af577f3e5667d02f95c001c717dfc5a0e100d2b701be4ec35a3e6875dc276431a7497f6761b5341a33188a7a1ca7a904d5866e07b8ddbde9adebdbce4306923cfc60afc2a6138786fae4e33dc343aea2b1a7cd6411187307ea2c82cd96b45f6d1f2a0ffc6c3805bbaef2c4003763fd5fac0ebcccf99a1656f10cf7677f6c2a5d16dbd
Android Malware Campaign Abuses Hugging Face AI Platform to Distribute RAT10 indicators · Jan 30, 2026

URLs (1)

hxxps://www[.]trustbastion[.]com/xiazz[.]html

md5 (6)

15bdc66aca9fb7290165d460e6a993a9b62c906078644edd3439e2d986abd2e2b716a8a742fec3084b0f497abbfecfc0d184d705189e42b54c6243a55d6c9502d8b0fd515d860be2969cf441ea3b620dfc874c42ea76dd5f867649cbdf81e39b

sha1 (1)

bdf3779ddc10f241603be57a90865b680cde8c31

sha256 (2)

19f1a6b9ad1a9654e7c78fa2d37a3ec10192b01b636c5fc1995b80bf6f7dcb36a50cf45d8b119af0cc75679c8307b05e29f2bc85b6d0bd55999dd018639f1c72
Google Disrupts World’s Largest Residential Proxy Botnet20 indicators · Jan 28, 2026

Domains (4)

0aa0cf0637d66c0d[.]com442fe7151fb1e9b5[.]comaa86a52a98162b7d[.]comv46wd6uramzkmeeo[.]in

md5 (10)

00857cca77b615c369f48ead5f8eb7f30c855f87a7574b28df383eca5084fcdc31d58c226fc5a0aa976e13ca9ecebcc88a9bd7e7a806b2cc606b7a1d8f4956628b21a945159f23b740c836eb50953818993ae4fe78b879239bdc14dfbc0963cda8d3b9e1f5c7024d6e0b7a2c9f1d83e5af4760df2c08896a9638e26e7dd20aaec8eb024c053f82831f2738bd48afc256cfe47df26c8eaf0a7c136b50c703e173

sha256 (6)

01ac6012d4316b68bb3165ee451f2fcc494e4e37011a73b8cf2680de3364fcf42d1891b6d0c158ad7280f0f30f3c9d913960a793c6abcda249f9c76e13014e4559cbdecfc01eba859d12fbeb48f96fe3fe841ac1aafa6bd38eff92f0dcfd4554aef34f14456358db91840c416e55acc7d10185ff2beb362ea24697d7cdad321fb0726bdd53083968870d0b147b72dad422d6d04f27cd52a7891d038ee83aef5bba9b1f4cc2c7f4aeda7a1280bbc901671f4ec3edaa17f1db676e17651e9bff5f
Fake Clawdbot VS Code Extension Deploys ScreenConnect RAT5 indicators · Jan 27, 2026

Domains (1)

www[.]aikido[.]dev

sha256 (4)

04ef48b104d6ebd05ad70f6685ade26c1905495456f52dfe0fb42f550bd43388adbcdb613c04fd51936cb0863d2417604db0cd04792ab7cae02526d48944c77bd1e0c26774cb8beabaf64f119652719f673fb530368d5b2166178191ad5fcbeae20b920c7af988aa215c95bbaa365d005dd673544ab7e3577b60fecf11dcdea2

Pre-archive control

Revalidation Queue

These observations have passed their reporting window but are held out of the archive. A review outcome, a pending check, or an unavailable revalidation snapshot all fail closed into this queue. A fresh qualifying positive is retained in the current view instead. Only an exact, completed archive-cleared decision permits a supported observation to move into history.

Archive-cleared means the required boundary check completed without qualifying positive evidence. It does not mean clean, inactive, benign, remediated, resolved, or safe, and it does not change feed admission.

1741 unique observations held from archive · showing 200

IPv4 address

Review hold

96[.]9[.]125[.]52

Reporting window ended · 1 source report

Source report →

IPv4 address

Checks pending

157.90.179.116

Reporting window ended · 1 source report

Source report →

IPv4 address

Checks pending

216.126.229.216

Reporting window ended · 1 source report

Source report →

Domain

Review hold

acocdn[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

asecdns[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

dnsrecursive[.]eu

Reporting window ended · 2 source reports

IOC Passport →

Domain

Checks pending

i3[.]wp[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

images[.]weserv[.]nl

Reporting window ended · 2 source reports

IOC Passport →

Domain

Checks pending

slack-imgs[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

tdndns[.]com

Reporting window ended · 2 source reports

IOC Passport →

IPv4 address

Review hold

149[.]88[.]104[.]19

Reporting window ended · 1 source report

Source report →

Domain

Review hold

dssdfvsdfvsdfvsdgbfbdvdzv[.]org

Reporting window ended · 1 source report

Source report →

Domain

Review hold

security[.]properties

Reporting window ended · 1 source report

Source report →

Domain

Review hold

sendit[.]sh

Reporting window ended · 1 source report

Source report →

IPv4 address

Checks pending

104.164.55.46

Reporting window ended · 1 source report

Source report →

IPv4 address

Checks pending

104.28.162.228

Reporting window ended · 1 source report

Source report →

IPv4 address

Checks pending

104.28.163.162

Reporting window ended · 1 source report

Source report →

IPv4 address

Checks pending

146.70.117.239

Reporting window ended · 1 source report

Source report →

IPv4 address

Checks pending

149.102.229.154

Reporting window ended · 1 source report

Source report →

IPv4 address

Checks pending

192.42.116.12

Reporting window ended · 1 source report

Source report →

IPv4 address

Checks pending

192.42.116.50

Reporting window ended · 1 source report

Source report →

IPv4 address

Checks pending

192.42.116.52

Reporting window ended · 1 source report

Source report →

IPv4 address

Checks pending

192.42.116.56

Reporting window ended · 1 source report

Source report →

IPv4 address

Checks pending

192.42.116.97

Reporting window ended · 1 source report

Source report →

IPv4 address

Checks pending

37.19.210.12

Reporting window ended · 1 source report

Source report →

IPv4 address

Checks pending

64.190.76.14

Reporting window ended · 1 source report

Source report →

Domain

Review hold

broker[.]hivemq[.]com

Reporting window ended · 1 source report

Source report →

Domain

Checks pending

ip-api[.]com

Reporting window ended · 4 source reports

IOC Passport →

Domain

Review hold

meet[.]element[.]tw

Reporting window ended · 1 source report

Source report →

URL

Checks pending

hxxp://ip-api[.]com/json

Reporting window ended · 2 source reports

Source report →

Domain

Review hold

buf[.]data

Reporting window ended · 1 source report

Source report →

Domain

Review hold

img[.]darklights[.]store

Reporting window ended · 1 source report

Source report →

Domain

Review hold

img[.]monderhouse[.]space

Reporting window ended · 1 source report

Source report →

Domain

Review hold

img[.]responsive[.]pstatic[.]autos

Reporting window ended · 1 source report

Source report →

Domain

Review hold

img[.]smartnords[.]site

Reporting window ended · 1 source report

Source report →

Domain

Review hold

img[.]socialteams[.]store

Reporting window ended · 1 source report

Source report →

Domain

Review hold

img[.]worksongo[.]store

Reporting window ended · 1 source report

Source report →

IPv4 address

Review hold

2.26.126.50

Reporting window ended · 1 source report

Source report →

Domain

Review hold

aceofspadesmanagement[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

digimediaskill[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

glmediaagency[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

healthcomfsdpower[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

healthful-hub[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

healthfullyrecipes[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

healthvitalitycare[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

healthyweightplan[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

lifespotify[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

mens-health-online[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

msmanagementgrp[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

msmanagementgrpmedia[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

neumedicahealthcare[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

optimumhealthcredit[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

refreshhealthandwellness[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

sahi-finance[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

visitfinancedentists[.]com

Reporting window ended · 1 source report

Source report →

URL

Review hold

hxxps://healthcomfsdpower[.]com

Reporting window ended · 1 source report

Source report →

URL

Review hold

hxxps://lifespotify[.]com/api/users/b879746e-fed9-4211-a6da-4d8223681267/otp/validate

Reporting window ended · 1 source report

Source report →

URL

Review hold

hxxps://sahi-finance[.]com

Reporting window ended · 1 source report

Source report →

URL

Review hold

hxxps://visitfinancedentists[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

console[.]info

Reporting window ended · 1 source report

Source report →

Domain

Review hold

cursor[.]click

Reporting window ended · 1 source report

Source report →

Domain

Checks pending

doi[.]org

Reporting window ended · 3 source reports

IOC Passport →

Domain

Checks pending

scite[.]ai

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

bestsocialmedianewspapper[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

gitnow[.]dev

Reporting window ended · 1 source report

Source report →

Domain

Review hold

linked-log[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

offlineupdater[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

gov12366[.]com

Reporting window ended · 1 source report

Source report →

URL

Review hold

hxxp://154[.]36[.]188[.]98:8080/Sz9110[.]bin

Reporting window ended · 1 source report

Source report →

IPv4 address

Review hold

104[.]218[.]165[.]253

Reporting window ended · 1 source report

Source report →

IPv4 address

Review hold

208[.]123[.]119[.]215

Reporting window ended · 1 source report

Source report →

IPv4 address

Review hold

43[.]204[.]2[.]142

Reporting window ended · 1 source report

Source report →

IPv4 address

Review hold

89[.]34[.]96[.]56

Reporting window ended · 1 source report

Source report →

IPv4 address

Review hold

91[.]214[.]78[.]118

Reporting window ended · 1 source report

Source report →

Domain

Review hold

cswlink[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

en[.]fofa[.]info

Reporting window ended · 1 source report

Source report →

Domain

Review hold

mqonu[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

r[.]co

Reporting window ended · 1 source report

Source report →

Domain

Review hold

www[.]ac-link[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

www[.]findmyipaddr[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

www[.]zoomeye[.]ai

Reporting window ended · 1 source report

Source report →

Domain

Review hold

45[.]150[.]109[.]151[.]sslip[.]io

Reporting window ended · 1 source report

Source report →

Domain

Review hold

auto[.]c3pool[.]org

Reporting window ended · 1 source report

Source report →

Domain

Review hold

c3pool[.]org

Reporting window ended · 1 source report

Source report →

Domain

Review hold

gobygo[.]net

Reporting window ended · 1 source report

Source report →

Domain

Review hold

horizon3[.]ai

Reporting window ended · 3 source reports

IOC Passport →

Domain

Review hold

oast[.]me

Reporting window ended · 1 source report

Source report →

Domain

Review hold

oast[.]pro

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

sslip[.]io

Reporting window ended · 1 source report

Source report →

Domain

Review hold

yosemite[.]jp

Reporting window ended · 1 source report

Source report →

Domain

Review hold

qt-proxy[.]org

Reporting window ended · 1 source report

Source report →

Domain

Review hold

qt-team[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

qtcyber[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

qtproxy[.]xyz

Reporting window ended · 1 source report

Source report →

Domain

Review hold

www[.]qtproxy[.]xyz

Reporting window ended · 1 source report

Source report →

Domain

Review hold

apidrive[.]online

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

auth3gapi[.]online

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

diegovalanire[.]digital

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

gapiauth[.]info

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

gapiauth[.]net

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

gapiconnect[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

gapidriver[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

gapioath[.]com

Reporting window ended · 2 source reports

IOC Passport →

URL

Review hold

hxxps://diegovalanire[.]digital

Reporting window ended · 2 source reports

Source report →

URL

Review hold

hxxps://gapidriver[.]com/api/rest[.]php

Reporting window ended · 2 source reports

Source report →

URL

Review hold

hxxps://gapidriver[.]com/installer/GapiUpdate[.]application

Reporting window ended · 2 source reports

Source report →

IPv4 address

Review hold

79[.]110[.]49[.]156

Reporting window ended · 1 source report

Source report →

Domain

Review hold

activatemypasskey[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

activatepasskey[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

activatepasskeyportal[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

addmypasskey[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

addoktapasskey[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

addpasskey2fa[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

addssopasskey[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

addyourpasskey[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

assignpasskey[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

createmfa[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

createmypasskey[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

createpasskey[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

createssopasskey[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

deploypasskey[.]com

Reporting window ended · 3 source reports

IOC Passport →

Domain

Review hold

enablepasskey[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

enablepasskey2fa[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

enrollpasskey[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

hubpasskey[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

idokta[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

keyokta[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

makepasskey[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

mspasskey[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

myaccountsecurity[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

mynewpasskey[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

myoktasso[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

mypasskeyid[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

mypasskeysso[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

mysecurepasskey[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

myssopasskey[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

newpasskey[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

oktaenroll[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

oktaportalsso[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

passkey-check[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

passkey-connect[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

passkey-enable[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

passkey-portal[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

passkey-setup[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

passkeyactivation[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

passkeyadd[.]com

Reporting window ended · 3 source reports

IOC Passport →

Domain

Review hold

passkeycenter[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

passkeycreate[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

passkeycreator[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

passkeydeploy[.]com

Reporting window ended · 3 source reports

IOC Passport →

Domain

Review hold

passkeyenable[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

passkeyenroll[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

passkeymfa[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

passkeyms[.]com

Reporting window ended · 3 source reports

IOC Passport →

Domain

Review hold

passkeyokta[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

passkeyportal[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

passkeyportalsetup[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

passkeyregister[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

passkeyregistration[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

passkeyrollout[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

passkeyset[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

passkeystatus[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

passkeysupport[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

passkeyuser[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

pipe[.]ma

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

portalpasskey[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

registerpasskey[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

secureauthpasskey[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

setpasskey[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

setupsso[.]com

Reporting window ended · 3 source reports

IOC Passport →

Domain

Review hold

setupssopasskey[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

sqfepjvmrd[.]xyz

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

ssopasskey[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

startpasskey[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

startpasskeysetup[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

chamber-ua[.]org

Reporting window ended · 1 source report

Source report →

Domain

Review hold

dosportal[.]app

Reporting window ended · 1 source report

Source report →

Domain

Review hold

drive[.]google[.]verify-drive[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

fewfwfwfwfwf[.]info

Reporting window ended · 1 source report

Source report →

Domain

Review hold

finishoperations[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

finishoperations[.]org

Reporting window ended · 1 source report

Source report →

Domain

Review hold

foc-share[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

foc-share[.]org

Reporting window ended · 1 source report

Source report →

Domain

Review hold

foreignrelations[.]us

Reporting window ended · 1 source report

Source report →

Domain

Review hold

globsec[.]net

Reporting window ended · 1 source report

Source report →

Domain

Review hold

internal-share[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

m365-owa[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

mail[.]kiis[.]co[.]uk

Reporting window ended · 1 source report

Source report →

Domain

Review hold

mioisiskwowiwjowuwjwolab[.]club

Reporting window ended · 1 source report

Source report →

Domain

Review hold

miov2iaiaoubqosiqoiajwowiwjso[.]online

Reporting window ended · 1 source report

Source report →

Domain

Review hold

ms365-device[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

ms365-live[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

my-invite[.]org

Reporting window ended · 1 source report

Source report →

Domain

Review hold

owa-ms365[.]com

Reporting window ended · 2 source reports

IOC Passport →

Domain

Review hold

share-foc[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

shopinvite[.]org

Reporting window ended · 1 source report

Source report →

Domain

Review hold

statistic-ms[.]live

Reporting window ended · 1 source report

Source report →

Domain

Review hold

verify-drive[.]com

Reporting window ended · 1 source report

Source report →

Domain

Review hold

wa-connect[.]eu

Reporting window ended · 1 source report

Source report →

Domain

Review hold

wa-connect[.]net

Reporting window ended · 1 source report

Source report →

These are observational, auto-extracted values from source reporting, not policy-admitted feed entries. They may include benign infrastructure or extraction errors; verify context before acting. Archive status does not mean clean, benign, remediated, resolved, or safe, and the archive is not a blocklist. Need to pull IOCs from your own text? Use the IOC Extractor →

Newsletter

The House-Of-L Brief.

Two short reads a day on markets, cyber threats, AI, and geopolitics. A "why it matters" line on every story.

Double opt-in. One-click unsubscribe on every issue. We never share your address.