Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
financialThreat Actor
Active Threat
Hive
4.0k
IOCs Tracked
199
Intel Reports
Associated IOCs50 total
IP50
91.202.233.214
2026-09-15High162.248.225.165
2026-09-15High109.73.193.242
2026-09-15High46.151.182.205
2026-09-15High221.207.101.175
2026-09-15High15.204.95.2282026-09-15High67.219.102.244
2026-09-15High5.101.86.98
2026-07-04High5.101.86.1052026-07-06High178.16.54.248
2026-06-23High88.119.167.143
2026-08-17High84.21.189.225
2026-06-20High107.175.148.682026-07-09High195.123.240.2362026-09-15High139.159.203.442026-09-15High137.184.163.272026-09-15High8.152.2.862026-09-13High158.247.194.144
2026-08-19High38.181.42.1602026-09-13High18.118.196.2442026-07-02High146.70.41.1742026-07-30High35.220.177.232
2026-06-24High34.92.131.122026-09-15High47.115.193.522026-09-15High189.34.188.6
2026-09-15High83.229.126.652026-09-15High195.88.191.412026-09-15High34.64.98.2012026-09-15High198.98.53.342026-09-15High122.114.10.1992026-09-03High8.134.11.72026-09-15High116.198.233.1792026-09-15High45.77.89.29
2026-09-15High193.24.123.1602026-09-15High112.5.58.1812026-09-15High47.99.196.1782026-09-15High123.58.64.572026-09-15High103.236.70.1582026-09-15High84.32.188.1042026-09-15High111.230.196.2002026-09-15High89.58.30.492026-09-15High45.10.164.1772026-09-15High46.151.182.192026-09-15High115.190.233.792026-09-15High47.98.134.2522026-09-15High138.226.236.52
2026-09-15High77.242.250.36
2026-09-15High217.154.212.252026-09-15High185.242.3.832026-09-15High51.77.54.76
2026-09-15HighRelated Reports199 total
Inside the Hive
Group-IB
New Windows Defender ShieldCrash 0-Day Lets Attackers Read Arbitrary Files as SYSTEM
Cyber PressSep 9, 2026
PrettyPrague PoC Claims Avast Antivirus Zero-Day Enables SYSTEM Privilege Escalation
Cyber PressSep 3, 2026
CVE-2026-81578: Exploited PaperCut Authentication Bypass Chains to Pre-Auth RCE
SOC PrimeSep 2, 2026
Microsoft’s August Security Update of High-Risk Vulnerability Notice for Multiple Products
NSFOCUS Security LabsAug 18, 2026
Play Ransomware Scores Just 13% Prevention as Evasion Techniques Bypass Security Controls
Cyber PressAug 10, 2026
Oracle SQL Injection Attack Escalates to SYSTEM-Level Windows Code Execution
Cyber PressAug 6, 2026
LegacyHive Abuses Windows Profile Loading to Hijack Administrator Registry Hives
Cyber PressJul 28, 2026
LegacyHive Windows Zero-Day Lets Attackers Hijack Administrator Registry Hives
Cyber PressJul 17, 2026
Spirals Attackers Disable Windows Defender and Kill Backup Services Before Encrypting Systems
Cyber PressJul 17, 2026
Leveraging cyber intelligence for threat detection
BI.ZONEJul 17, 2026
GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration
SecurelistJul 16, 2026
Inside Kimsuky’s CHM Tradecraft: Multi-Stage Execution and Selective Payload Delivery
Synaptic SystemsJun 29, 2026
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Threat Profile
Motivationfinancial
Last seenSep 2026
IOCs tracked4,028