IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE3 IOCs

An Open Server, an Exposed Toolkit Inside a Viva Aerobus-Linked Intrusion

TH
ThreatMon
Published October 1, 2026Original Report

Malware Families

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYunknownINFRASTRUCTUREunknownCAPABILITYMETA StealerMimikatzVICTIMunknown
Adversary
Infrastructure
Capability(2)
Victim

Indicators of Compromise

Indicators of Compromise3

TypeIndicatorConfidenceScoreFirst Seen
SHA256c38f49ba68b891bb476510704cddf080798f3c70075e2a517e98e04e833f64fa
file-hashhiddengh0stindicator
Medium
38
Oct 2, 26
SHA2568b6c53e3d57b4c3049f3d0765a44d9a52feb6af78f1eaa5aff19daf1b9665998
file-hashhiddengh0stindicator
Medium
38
Oct 2, 26
SHA25633aeaaa3d57b7785ef2be5b8ccd39d534b8af50e0cd32a5036fdb64601a52fc9
file-hashhiddengh0stindicator
Medium
38
Oct 2, 26

IOC Relationship Graph

IOC Relationship Graph3 total IOCs
SHA256
SHA2563Malware2REPORTAn Open Server, an ExposedMETA StealerMimikatz
scroll to zoom · drag to pan · click IOC to open