Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
espionageThreat Actor
Active Threat
UNC5669
29
IOCs Tracked
2
Intel Reports
Associated IOCs29 total
Domain1
dontpad.com2026-10-09Low
URL19
https://jmcov.gov.py/cxv.exe2026-10-09High
http://gcm.setelagoas.mg.gov.br/files/ti.zip2026-10-09High
https://minacu.go.gov.br/ComprovantePDF.exe2026-10-09High
http://suporte.ourinhos.sp.gov.br:443/files/s.exe2026-10-09High
https://www.mrtb.gov.ng/apps/attvpn.vip2026-10-09High
https://servicos.salto.sp.gov.br/j.jar2026-10-09High
https://suporte.camaratunapolis.sc.gov.br/ti/attvpn.zip2026-10-09High
https://conseg.ssp.go.gov.br/ComprovanteBBpix.exe2026-10-09High
http://suporte.ourinhos.sp.gov.br/files/a.exe2026-10-09High
https://suporte.camaratunapolis.sc.gov.br/ti/1.exe2026-10-09High
http://credeb.gov.gn/r.zip2026-10-09High
https://conseg.ssp.go.gov.br/COAF-POLICIAFEDERAL.exe2026-10-09High
https://procon.go.gov.br/ComprovantePDF.exe2026-10-09High
http://suporte.ourinhos.sp.gov.br/files/s.zip2026-10-09High
https://cmgovernadorluizrocha.ma.gov.br/Comprovantepdf.exe2026-10-09High
https://tisup.camaratunapolis.sc.gov.br/SoftEther.exe2026-10-09High
https://sit.baer.gob.ve/r.exe2026-10-09High
http://gcm.setelagoas.mg.gov.br/files/notepadd.exe
2026-10-09Mediumhttp://gcm.setelagoas.mg.gov.br/files/tes.exe
2026-10-09MediumSHA2569
51fdd83b3737add7f3832bd0ad0b56863c0a8f7cf9bcc16fd787d1ae4b403ce62026-10-09High
3b22605244dbace8f0c07c2c599f88c4b831bb07e9998b869a5da2759d27ceec2026-10-09High
d2aa40cc53b40c6e76ac0677c4a54387b3f27ee94c85d9b2c3a3d66aeef92a662026-10-09High
2214907e696bad85bde1d90c943ef66e413d7a5c6d7596ced25b74441200439a2026-10-09Medium
447e3a131e62bd33b1297739a7b959a92358a97f58554469044636a3c4f244e82026-10-09Medium
de4e533c9062c62b3ba3a5d88eff111156075f2c92d243737edeead6481a9fd52026-10-09Medium
f139b4ca15feffb7a6633ec1a431c5c604b397576b56b5c863ae8fe4fa14db4f2026-10-09Medium
6d4012e0dd3b56a3e52857734fa0d582cdf3c56f0e5decc8005c882d1d1c6ceb2026-10-09Medium
c0db6ddd6222d02ad7490399d33c61ded0076f0037409dc8498924458646d78a2026-10-09Medium
Threat Profile
Motivationespionage
Last seenOct 2026
IOCs tracked29