Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
high threatBackdoorMalware Family
Historical
Cobalt Strike
High severity
23.0k
IOCs Tracked
—
First Seen
—
Last Seen
0
YARA Rules
Associated IOCs22,998 total · showing 50
IP32
91.202.233.2142026-10-15High
101.200.193.2112026-10-14High
46.151.182.2052026-10-15High
109.73.193.2422026-10-01High
15.204.95.2282026-10-15High
67.219.102.2442026-10-15High
185.177.72.682026-09-24High
221.207.101.1752026-10-15High
162.248.225.1652026-10-15High
77.83.36.1632026-09-03High
5.101.86.982026-07-04High
5.101.86.1052026-07-06High
178.16.54.2482026-06-23High
88.119.167.1432026-08-17High
84.21.189.2252026-06-20High
107.175.148.682026-07-09High
139.159.203.442026-10-15High
137.184.163.272026-10-15High
39.107.242.1302026-10-15High
163.181.208.792026-10-15High
Domain8
ks501oz9nm3v05.org2026-10-09High
afxwd.ddns.net2026-06-18High
66ds.lol2026-10-15High
2rxyt8yrhq0bgj.org2026-10-09High
hroffice.work2026-10-15High
bobroviysmex.shop2026-10-15High
library2000.com2026-10-15High
nick-metry.icu2026-10-15High
URL9
http://109.123.243.121/i6862026-10-15High
http://94.154.43.26/main_arm62026-10-15High
http://59.96.136.247:47589/i2026-10-15High
http://23.254.195.48:8099/bx_arm5.p2026-10-15High
http://94.154.43.137/ppc2026-10-15High
http://196.189.98.110:34127/bin.sh2026-10-15High
http://123.9.244.39:39490/bin.sh2026-10-15High
http://220.168.237.96:60522/i2026-10-15High
http://42.228.218.119:58691/i2026-10-15High
SHA2561
1b39f9b2b96a6586c4a11ab2fdbff8fdf16ba5a0ac7603149023d73f33b844982026-10-09High
Related Reports30 shown
Abuse.ch ThreatFox (8324 indicators)
Abuse.ch ThreatFoxOct 15, 2026
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Passkeys Raise the Bar. Here’s Where Attackers Can Still Get In.
HuntressOct 14, 2026
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch ThreatFox (8014 indicators)
Abuse.ch ThreatFoxOct 15, 2026
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch ThreatFox (8034 indicators)
Abuse.ch ThreatFoxOct 15, 2026
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch ThreatFox (8032 indicators)
Abuse.ch ThreatFoxOct 15, 2026
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch ThreatFox (7940 indicators)
Abuse.ch ThreatFoxOct 15, 2026
Abuse.ch ThreatFox (7914 indicators)
Abuse.ch ThreatFoxOct 15, 2026
Abuse.ch ThreatFox (7909 indicators)
Abuse.ch ThreatFoxOct 14, 2026
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch ThreatFox (7988 indicators)
Abuse.ch ThreatFoxOct 14, 2026
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize
Group-IB
Abuse.ch ThreatFox (7995 indicators)
Abuse.ch ThreatFoxOct 14, 2026
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch ThreatFox (7993 indicators)
Abuse.ch ThreatFoxOct 14, 2026
Abuse.ch ThreatFox (7940 indicators)
Abuse.ch ThreatFoxOct 14, 2026
Abuse.ch ThreatFox (7948 indicators)
Abuse.ch ThreatFoxOct 14, 2026
ClingSTUN Turns Vulnerable Edge Devices Into Attacker Infrastructure
PolySwarmOct 13, 2026
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Abuse.ch ThreatFox (7912 indicators)
Abuse.ch ThreatFoxOct 14, 2026
Abuse.ch ThreatFox (7874 indicators)
Abuse.ch ThreatFoxOct 14, 2026
Abuse.ch ThreatFox (7843 indicators)
Abuse.ch ThreatFoxOct 14, 2026
Abuse.ch URLhaus (5000 entries)
Abuse.ch URLhaus
Threat Profile
TypeBackdoor
StatusHistorical
IOCs tracked22,998