Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
espionageThreat Actor
Active Threat
UNC5174
64
IOCs Tracked
2
Intel Reports
Associated IOCs50 total
IP19
156.59.13.38
2026-10-09High221.2.22.145
2026-10-09High27.210.0.1312026-10-09High74.125.196.113
2026-10-09High27.150.112.382026-10-09High103.56.52.61
2026-10-09High27.219.79.2262026-10-09High38.181.79.152026-10-09High27.150.113.12026-10-09High27.150.114.1152026-10-09High123.132.37.1882026-10-09High119.165.225.1292026-10-09High27.199.77.1132026-10-09High103.56.52.1422026-10-09High148.66.16.2262026-10-09High27.150.113.1832026-10-09High27.210.226.2542026-10-09High39.85.164.62026-10-09High103.215.77.2142026-10-09HighDomain11
microsoft-defend.club2026-10-09High
microsoft-symantec.art2026-10-09High
micrcs.microsoft-defend.club2026-10-09High
catserver.properties2026-10-09High
e.md2026-10-09High
cfcert.store2026-10-09High
sqlmap.py2026-10-09High
id_rsa.pub2026-10-09High
encoding.default.ge2026-10-09High
gost.x64.so2026-10-09High
catserver.store2026-10-09High
URL11
http://microsoft-symantec.art:8848/sl2026-10-09High
http://103.215.77.214:8080/3.asmx2026-10-09High
http://microsoft-symantec.art:8848/swt2026-10-09High
http://microsoft-symantec.art:8848/?h=microsoft-symantec.art&p=8848&t=tcp&a=w64&stage=true2026-10-09High
http://microsoft-symantec.art:8848/slt2026-10-09High
http://microsoft-symantec.art:8848/?h=microsoft-symantec.art&p=8848&t=tcp&a=w32&stage=true2026-10-09High
http://victm.edu.vn/3.asmx/Tas9er2026-10-09High
http://baidu.com2026-10-09High
https://ctrlaltintel.com/research/china-vietnam-campaign/2026-10-09High
symantec.art:8848/slt2026-10-09High
edu.vn:80/2026-10-09High
MD57
1415c48ad7d8848191b0cd7a122a7cfb2026-10-09High
c82698395e6a30cad74c0bc0a6cd51af2026-10-09High
f5de3ac3f12a2eee62a58d7ec77693dd2026-10-09High
bed7058beeeefc3efeb8b408ec68e5fa2026-10-09High
2058842e1799195a2f3c9971e4dea24e2026-10-09High
40b96d9df310d5f448c0908c3231ff4e2026-10-09High
64aa88125366a1787919b5ec61befa1d2026-10-09High
SHA2561
4a74676bd00250d9b905b95c75c067369e3911cdf3141f947de517f58fc9f85c2026-10-09HighCVE1
CVE-2025-551822026-10-10High
Threat Profile
Motivationespionage
Last seenOct 2026
IOCs tracked64