{
  "metadata": {
    "generator": "Bulwark Black IOC Extractor",
    "source": "https://bulwarkblack.com/cisco-sdwan-active-exploitation-edge-controller-review/",
    "fang": "live",
    "exported_at": "2026-07-15T22:30:41Z",
    "total": 45,
    "categories": 6
  },
  "iocs": {
    "IPv4": [
      "104.233.156.1",
      "13.62.52.206",
      "176.65.139.31",
      "194.163.175.135",
      "194.233.100.40",
      "212.83.162.37",
      "23.27.143.170",
      "38.181.52.89",
      "38.60.214.92",
      "47.104.248.7",
      "65.20.67.134",
      "71.80.85.135",
      "79.135.105.208",
      "83.229.126.195",
      "89.125.244.33",
      "89.125.244.51"
    ],
    "Domains": [
      "1a820b09-95ba-44eb-b350-417e8241b725-00-1lgwuuen9b77p.worf.replit.dev",
      "a820b09-95ba-44eb-b350-417e8241b725-00-1lgwuuen9b77p.worf.replit.dev",
      "replit.dev"
    ],
    "URLs": [
      "http://13.62.52.206:5004&nbsp",
      "http://13.62.52.206:5004”",
      "http://83.229.126.195:8081/config.json",
      "http://83.229.126.195:8081/xmrig",
      "https://1a820b09-95ba-44eb-b350-417e8241b725-00-1lgwuuen9b77p.worf.replit.dev/download",
      "replit.dev"
    ],
    "md5": [
      "fece5b954e69b2c6a8d0a1029631a0d7"
    ],
    "sha256": [
      "02654acfb21f83485393ba8b14bd8862b919b9ec966fc6768f6aac1338a45ee8",
      "0c87871642f84e09e8d3fb23ec36bf55601323e31151a7017a85dbec929cf15d",
      "0ed72d52347bfe4a78afff8a6982a64050c8fc86d8957a20eeb3e0f3f5342ed0",
      "17302d903baf182f94dc3be40ab1e0874dd0eb2ec5255bf9131fd53591efe925",
      "18d77c9c5bbb5b9d5bdfd366fdfcf26bad9e64c63ca865fad711bcce8e3d5a80",
      "5bc5998161056b7c8f70c9724d8a63abc7ff8c3843b91c30cffab0899e39b7f8",
      "72f570ce97de3eaaffef33d90b0c337a153fc9690cc34ee207b557d868360060",
      "7aa88a64a527ade7d93c20faf23b54f2ee33ad9b1246cdc2f8ded2ab639affb1",
      "96fc528ca5e7d1c2b3add5e31b8797cb126f704976c8fbeaecdbf0aa4309ad46",
      "b0f51b098842cd630097b462aab0ec357e2c7824af37cca6d08165265da2c2d3",
      "d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa",
      "f6f8e0d790645395188fc521039385b7c4f42fa8b426fd035f489f6cda9b5da1"
    ],
    "CVEs": [
      "CVE-2025-20333",
      "CVE-2025-20362",
      "CVE-2026-20122",
      "CVE-2026-20127",
      "CVE-2026-20128",
      "CVE-2026-20133",
      "CVE-2026-20182"
    ]
  }
}