IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
CVEHighVerifiedSignal 79/100EPSS 100.0%

CVE-2025-3248

First Seen
Jun 29, 2026
Last Seen
Oct 14, 2026
Jun 29
First Seen
107d ago
Oct 14
Last Seen
today
17
Reports
source reports
85%
Confidence
high
Found in 17 reports. Confidence: high. · Confidence scores are heuristic. Verify before acting on results.
CVE
Known vulnerability being actively exploited in the wild.
MISP Category
vulnerability
EPSS Score
99.97%
EPSS Percentile
100.0th
Confidence
85%
Signal Score
79 / 100
IDS Rule
No
CVE Intelligence
Exploit Probability99.97%
100.0th percentile of all CVEs
Threat Context
Tags

Feed Intelligence Summary

17 reports85% confidence
PO
PolySwarm
Yesterday
ClingSTUN Turns Vulnerable Edge Devices Into Attacker Infrastructure
52 IOCs in report
PO
PolySwarm
5d ago
China Linked Warlock Ransomware Campaign Targets Critical Infrastructure
32 IOCs in report
PO
PolySwarm
Oct 5, 2026
Targeting the Systems Behind the Mission: OT Threats to US Critical Infrastructure and Military Operations
47 IOCs in report
PO
PolySwarm
Oct 2, 2026
Lunex Uses BYOVD to Disable Security Monitoring and Deploy Persistent Stealer
34 IOCs in report
GT
Google Threat Intelligence (GTIG / Mandiant)
Sep 30, 2026
Vulnerability Discovery and Exploitation Trends in the AI Era
4 IOCs in report
PO
PolySwarm
Sep 28, 2026
CLOSEDQUORUM: Malware Puts AI in the C2 Loop
35 IOCs in report
PO
PolySwarm
Sep 25, 2026
FamousSparrow Takes Flight with New SparroWocky Backdoor
30 IOCs in report
PO
PolySwarm
Sep 21, 2026
China and the Cyber Arms Race for AI Supremacy
31 IOCs in report
PO
PolySwarm
Sep 21, 2026
BlueMoon Exploit Kit Rapidly Targets Key Verticals Across Multiple Espionage Campaigns
43 IOCs in report
CP
Cyber Press
Sep 18, 2026
Agentic Ransomware Lets AI Agents Execute Cyberattacks Without Human Operators
1 IOC in report

Activity Timeline

17 total obs
Oct 13Jun 29

Threat Activity Heatmap

· Peak: 2026-09-21
Less
More
Mon
Wed
Fri
Oct
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
·
·
·
·
Jul
·
·
·
Aug
·
·
·
·
Sep
·
·
·
Oct
24h
0
Dormant
7d
2
Minimal
30d
10
Elevated
3mo
15
Critical
Intelligence SummaryAI Generated

The recently identified indicator of compromise, CVE-

Threat ScoreHigh Risk
79
SIGNAL
Signal Score
85%
Confidence
17
Reports
First seenJun 29, 2026
Last seenOct 14, 2026
Verified IOC

VirusTotal

Not checked

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

high
First detected 3 months ago · Last seen today
Appeared in 17 threat reports from 10 sources
Associated with: REvil, Gamaredon, APT38, Akira, APT28, APT33, APT41, APT35, Cl0p, DEV-0569, Scattered Spider, APT37, APT29, APT34, Salt Typhoon, FIN8, MuddyWater, UNC1549, BlackCat, NoName057, Royal, Conti, LockBit, Killnet, TA577, Turla, Hive, Play, Kimsuky, APT31, TA412, Black Basta, Volt Typhoon, Ember Bear, DarkSide, Sandworm, Lazarus Group
Used by malware: Rhadamanthys, QakBot, Lumma, Medusa, Mythic, META Stealer, Hive, Gh0st RAT, SocGholish, XMRig, Remcos, Ursnif, Black Basta, Play, BazarLoader, AcidRain, BlackCat, INC Ransom, Akira, Rhysida, Stealc, Mirai, Conti, NotPetya, Cobalt Strike, Vidar, IcedID, Emotet, Bumblebee, NjRAT, XWorm, RedLine, Royal, LockBit, PlugX, AsyncRAT, CaddyWiper, DarkSide, REvil, Brute Ratel, WhisperGate, Cl0p, HermeticWiper