IOC Radar
IPMediumSignal 46/100

91.191.209.110

Location
BulgariaBulgaria
Sofia, Sofia-Capital
ASN
AS57509
L&L Investment Ltd
First Seen
Nov 16, 2023
Last Seen
Jun 7, 2026
Nov 16
First Seen
939d ago
Jun 7
Last Seen
6d ago
8
Reports
source reports
46%
Confidence
medium
5/91
VirusTotal
detections
Found in 8 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
IPv4 Address
Network layer indicator observed in threat reports.
MISP Category
Network Activity
Confidence
46%
Signal Score
46 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

28 techniques

Network Information

CountryBGBulgaria
RegionSofia, Sofia-Capital
ASNAS57509
OrganizationL&L Investment Ltd

Feed Intelligence Summary

8 reports46% confidence
8
Source reports
46%
Confidence score
Category tags
academic institutionsactiveanydeskaptasnsavaddonbulgariacivil servicescobalt strikecobaltstrikecode executioncommand and controlcommand executionconticoroxycredential harvestingcubacyber threatsdata encryptiondata exfiltrationdragonforcedrivereducational resourceseducational serviceseducational technologyelectronic health recordseuropeextortionfinancefinancial servicesgovernment technologyhealth care and social assistancehealth information technologyhealthcare information systemshigher educationhospital managementicedidin the wildinfrastructure acquisitionreconnaissanceiocs filenameiocs medusak-12 educationmalicious powershell activitymalicious softwaremalwaremanualmazemediamedical servicesmedusamonitoringmsp compromisemspsnetworknetwork iocspatient carephishingphishing attackprocess injectionproxyproxy malwarepublic administrationpublic infrastructurepublic policyraasransomwarercloneregulatory agenciesresearchedrmm exploitationryukscripting attacksservicesocial engineeringsoftware exploitationsupply chain attacksystemsystem disruptionsystembct1003t1021t1027t1036t1053t1055t1059t1059.001t1071t1071.001t1078t1086t1113t1199t1203t1204.002t1486t1490t1499.001t1530t1565t1566t1566.001t1566.002t1566.003t1569.002t1587.001t1590.001theythreatuab medusazensec

Activity Timeline

1 total obs
Jun 7Jun 7

Threat Activity Heatmap

· Peak: 2026-06-07
Less
More
Mon
Wed
Fri
Jun
·
·
·
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
24h
0
Dormant
7d
1
Minimal
30d
1
Minimal
3mo
1
Minimal
Threat ScoreMedium Risk
46
SIGNAL
Signal Score
46%
Confidence
8
Reports
First seenNov 16, 2023
Last seenJun 7, 2026
GeolocationBG
CountryBulgaria
LocationSofia, Sofia-Capital
ASNAS57509
OrgL&L Investment Ltd
Coords42.6977, 23.3219

VirusTotal

5/ 91vendors flagged
5% detection rateJun 8, 2026

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

medium
First detected 2 years ago · Last seen 6 days ago
Appeared in 8 threat reports