Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE39 IOCs
AI-Powered Espionage Campaign Targets Government Linux Infrastructure
Threat Actors
Malware Families
Diamond Model
Adversary(1)
Infrastructure(6)
Capability(3)
Victim
Indicators of Compromise
39 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 138.68.244.146 | High | Score 58/100 | First seen |
| CVE | CVE-2024-47575 | High | Score 63/100 | First seen |
| IP | 93.93.112.57 | High | Score 58/100 | First seen |
| SHA256 | c527b94e3d21824a674face4cd9d862e536b60ccbf54573839e3360f99188343 | Medium | Score 53/100 | First seen |
| IP | 141.164.58.87 | Medium | Score 36/100 | First seen |
| Domain | bashupload.com | High | Score 58/100 | First seen |
| IP | 72.61.89.179 | High | Score 58/100 | First seen |
| IP | 45.88.188.140 | High | Score 58/100 | First seen |
| IP | 192.210.183.17 | High | Score 58/100 | First seen |
| IP | 162.243.175.162 | High | Score 58/100 | First seen |
| SHA256 | 76c58fad4f70cf277a15a499b9a2151ac60e7a6b5c7a9ab684843dcc19f0d0a5 | Medium | Score 53/100 | First seen |
| IP | 154.93.37.228 | High | Score 58/100 | First seen |
| CVE | CVE-2025-55182 | High | Score 86/100 | First seen |
| Domain | transfer.sh | High | Score 58/100 | First seen |
| IP | 147.182.224.216 | High | Score 86/100 | First seen |
| SHA256 | 9e45830171eb607cf2c0fc80f5cc9cc3db39bb937032136990383a595f6f151e | Medium | Score 53/100 | First seen |
| IP | 198.23.185.234 | High | Score 86/100 | First seen |
| SHA256 | d73186cea6cf2cf3d48c09139a9d15521365aab675787b4e7a6f81767331c9fd | Medium | Score 53/100 | First seen |
| Domain | magento.ink | High | Score 58/100 | First seen |
| IP | 109.224.53.140 | High | Score 58/100 | First seen |
| IP | 173.212.247.23 | High | Score 58/100 | First seen |
| IP | 88.80.150.232 | High | Score 58/100 | First seen |
| SHA256 | d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa | High | Score 56/100 | First seen |
| IP | 104.248.131.53 | High | Score 58/100 | First seen |
| Domain | filebin.net | High | Score 58/100 | First seen |
| CVE | CVE-2021-4034 | High | Score 79/100 | First seen |
| SHA256 | 27d799ceadb570bfca890d4c2572314afe57eecf14083d30409da15afdfc4704 | Medium | Score 53/100 | First seen |
| SHA256 | b1e82c6b0caea177e8bb71ad826867f509c65f0a43a651b50253e7c726566eac | Medium | Score 45/100 | First seen |
| Domain | gsocket.io | High | Score 58/100 | First seen |
| Domain | wibu-bau-bawang.online | High | Score 58/100 | First seen |
| SHA256 | 2bf7992e6260c1a98c709fa98ec766fb9f27692f338b30b43ac821b824fd849e | Medium | Score 53/100 | First seen |
| Domain | solidmonpe.com | High | Score 58/100 | First seen |
| IP | 185.21.136.6 | High | Score 58/100 | First seen |
| Domain | catbox.moe | High | Score 63/100 | First seen |
| Domain | beraskencur.site | High | Score 58/100 | First seen |
| SHA256 | 1505a3a727f8899b2ad343519f7bf9c438b8b802f8d6b854f5db3b52f857c76a | Medium | Score 53/100 | First seen |
| SHA256 | 44e83f84a5d5219e2f7c3cf1e4f02489cae81361227f46946abe4b8d8245b879 | Medium | Score 53/100 | First seen |
| IP | 88.119.167.57 | High | Score 58/100 | First seen |
| IP | 104.194.158.65 | High | Score 58/100 | First seen |
IOC Relationship Graph
39 total IOCs
IPCVESHA256Domain
scroll to zoom · drag to pan · click IOC to open