Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
espionageThreat Actor
Active Threat
UNC6353
53
IOCs Tracked
2
Intel Reports
Associated IOCs50 total
IP21
166.88.95.90
2026-10-13High185.189.45.40
2026-10-15High199.30.90.1542026-10-15High43.134.165.205
2026-10-13High154.18.187.1602026-10-13High218.25.85.177
2026-10-13High47.102.192.232026-10-13Medium154.217.250.206
2026-10-13High59.46.4.1172026-10-13High112.213.108.85
2026-10-13High202.146.222.2532026-10-13High14.128.47.812026-10-13High154.219.127.1472026-10-13High101.35.158.1832026-10-13High154.219.127.942026-10-13High182.239.114.2232026-10-13High218.25.85.1782026-10-13High59.46.4.1192026-10-13High183.154.173.302026-10-13High156.239.230.1202026-10-13Medium203.91.77.2532026-10-13MediumDomain12
fc.rsqqq.top2026-10-15High
st.onlinefc.top2026-10-15Highi.131422.com2026-10-13High
escofiringbijou.com2026-10-13High
siekeltd.com2026-10-13High
exploit_server.py2026-10-13High
wumian.cc.cd2026-10-13High
u.fit2026-10-13High
hdios.cn2026-10-13High
manager.g.northlab.cn2026-10-13High
ccwu.cc2026-10-13High
g.northlab.cn2026-10-13High
URL5
https://censys.com/blog/darksword-coruna-open-directory-finding-report/2026-10-13High
https://censys.com/blog/darkswords-panel-sprawl/2026-10-13High
https://t.me/YATA00002026-10-13High
https://66ds.lol2026-10-13High
http://199.30.90.154:180902026-10-13High
MD53
09d0b8d58a71653cd1c89c64c866f2e62026-10-13Medium
c73dfcfd60a0c7ebcc03352d433349bc2026-10-13Medium
2d2aebba0bf3d7d694194a7ab93b0a962026-10-13Medium
SHA11
1334417664270db20af705f422878c53c83782032026-10-13High
SHA2566
7ff5bb16cd5f8c92bc4fec72bba162662f202af075418db5000a1b4f81489fc22026-10-13High
c391bce7b09a0ea263e4b2c1d1bde0327c180723fa3299b006485429564c61ee2026-10-13High
864d68e64618d6bfc26d75d6f780ae0b7bfed3698cc8333818ed32519e560d1f2026-10-13High
8973e80ab494c02463d4123f76fc5e2dca2ea2c097317d246323d75c1f2eb7912026-10-13Medium
54a4166ab33ffe02b41de9c943e783d20129b6cc22f56b7fe7d564fd02bde0062026-10-13Medium
a50c4da5c92636b2b1f170cdce3bd967a213886a8df5656cf3519214fcecfac52026-10-13Medium
CVE2
CVE-2026-310012026-10-13High
CVE-2025-242012026-10-13High
Threat Profile
Motivationespionage
Last seenOct 2026
IOCs tracked53