IOC Radar
SHA1HighVerifiedSignal 92/100

93a7a362dc9daf10ad91cc151d7c752ad66dae6f

First Seen
May 12, 2026
Last Seen
Jun 10, 2026
May 12
First Seen
31d ago
Jun 10
Last Seen
2d ago
4
Reports
source reports
92%
Confidence
high
Found in 4 reports. Confidence: high. · Confidence scores are heuristic. Verify before acting on results.
SHA-1 Hash
SHA-1 file hash associated with malicious samples.
MISP Category
Artifacts Dropped
Hash Algorithm
SHA1
Confidence
92%
Signal Score
92 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

14 techniques

Feed Intelligence Summary

4 reports92% confidence
4
Source reports
92%
Confidence score
Category tags
arctic wolfchromechromestealerekz infostealerendpoint exploitationexploitation activityfile-hashfirefoxforticlient emsgenerichttphttp postindicatorinfostealeripv62a03ipv62a12linuxnoteopencti_label forticlientopencti_label forticlient emsosintpowershellremote accessresearchedt1012t1027t1041t1055t1055.012t1057t1070t1070.004t1083t1190t1497t1497.003t1555t1555.003vpn configuration abusewolf

Activity Timeline

1 total obs
Jun 10Jun 10

Threat Activity Heatmap

Less
More
Mon
Wed
Fri
Jun
·
·
·
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
24h
0
Dormant
7d
1
Minimal
30d
1
Minimal
3mo
1
Minimal
Threat ScoreHigh Risk
92
SIGNAL
Signal Score
92%
Confidence
4
Reports
First seenMay 12, 2026
Last seenJun 10, 2026
Verified IOC

VirusTotal

Not checked

WHOIS

description
SHA1 of 2f25ea1b622abf3212141af932c2ec4cbd6b2b5903c2a531121f691227d98cff
references
https://arcticwolf.com/resources/blog/forticlient-ems-exploited-via-cve-2026-35616-to-deliver-ekz-infostealer-disguised-as-a-fortinet-patch, IOCs-MAY4.csv, https://arcticwolf.com/resources/blog/forticlient-ems-exploited-via-cve-2026-35616-to-deliver-ekz-infostealer-disguised-as-a-fortinet-patch/

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

high
First detected 1 month ago · Last seen 2 days ago
Appeared in 4 threat reports