Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
financialThreat Actor
Active Threat
TA412
117
IOCs Tracked
4
Intel Reports
Associated IOCs50 total
Domain9
msbenefit.com2026-10-09High
publish.openlumakora.com2026-10-09Medium
dns.getaiexo.com2026-10-09Medium
dns.elixnovorem.com2026-10-09Medium
elixnovorem.com2026-10-09High
ms.checrity.com2026-10-09High
fracons.com2026-10-09High
airliquide.lol2026-10-09High
emcore.ink2026-10-09High
SHA2569
ac6806c89e294f390838cb07c015dabec1c8ada06ce5161a0ad50b8a728281412026-10-09High
bc7d24f5cf8937b334966201bdcce8ca9bab6ec5889d40a399d4094dcad733602026-10-09High
f3c64014221a58f3fde88e562662dbd5a1b3dd2b59c86e9e2bc5cb8f671664e72026-10-09High
353b5bd2780c1b0c07c1283d83cf16cf1e9ec226c17b2d09d56848893f9d98ee2026-10-09High
3ec3151d8d1278ed966941ac89ea495ef6a80c70613dd9138cc85fc28c9df4322026-10-09High
7d6f6dcb17a423bdd7715f8a4e34f2939501a761bc9bf7aa005f805ef1f822882026-10-09High
e950d03c58d49e28e31df8afeefca1f3b3d2cd6b697c40adfee1a4f6fe18f0042026-10-09High
87b6b24c06f99900a8aa579caedee1e402015884c925a98dcfb0fb38dfa2de222026-10-09High
295fc584f75e94108c9be945977db33ed80421f5d374eab188587c911dffd9152026-10-09High
CVE32
CVE-2025-551822026-10-15High
CVE-2022-261342026-10-14High
CVE-2025-537712026-10-14High
CVE-2022-311992026-10-14High
CVE-2025-210422026-10-14High
CVE-2025-09942026-10-14High
CVE-2023-360252026-10-14High
CVE-2023-225182026-10-14High
CVE-2025-497042026-10-14High
CVE-2024-214122026-10-14High
CVE-2025-497062026-10-14High
CVE-2023-13892026-10-14High
CVE-2022-218942026-10-14High
CVE-2022-479862026-10-14High
CVE-2021-34932026-10-14High
CVE-2021-219742026-10-14High
CVE-2024-73442026-10-14High
CVE-2024-407662026-10-14High
CVE-2025-537702026-10-14High
CVE-2021-330442026-10-14High
CVE-2022-301902026-10-14High
CVE-2026-215092026-10-14High
CVE-2024-34002026-10-14High
CVE-2023-28682026-10-14High
CVE-2023-343622026-10-15High
CVE-2017-79212026-10-14High
CVE-2023-466042026-10-14High
CVE-2021-40342026-10-14High
CVE-2025-32482026-10-14High
CVE-2026-850462026-10-09High
CVE-2026-858802026-10-09High
CVE-2026-874912026-10-09High
Related Reports4 total
BlueMoon Exploit Kit Rapidly Targets Key Verticals Across Multiple Espionage Campaigns
PolySwarmSep 21, 2026
Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows
VolexitySep 9, 2026
Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days
Proofpoint Threat InsightSep 9, 2026
Chinese Hackers Chain Chrome and Windows Zero-Days to Deploy Backdoors and Steal Credentials
Cyber PressSep 12, 2026
Threat Profile
Motivationfinancial
Last seenOct 2026
IOCs tracked117