Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE6 IOCs
APT28: Geofencing as a Targeting Signal (CVE-2026-21509 Campaign)
Threat Actors
Diamond Model
Adversary(1)
Infrastructure
Capability
Victim
Attack Flow6 steps · MITRE ATT&CK mapped
Indicators of Compromise
6 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | fd3f13db41cd5b442fa26ba8bc0e9703ed243b3516374e3ef89be71cbf07436b | Medium | Score 53/100 | First seen |
| SHA256 | b2ba51b4491da8604ff9410d6e004971e3cd9a321390d0258e294ac42010b546 | Medium | Score 53/100 | First seen |
| SHA256 | 5a17cfaea0cc3a82242fdd11b53140c0b56256d769b07c33757d61e0a0a6ec02 | Medium | Score 53/100 | First seen |
| SHA256 | 969d2776df0674a1cca0f74c2fccbc43802b4f2b62ecccecc26ed538e9565eae | Medium | Score 53/100 | First seen |
| CVE | CVE-2026-21509 | High | Score 79/100 | First seen |
| SHA256 | c91183175ce77360006f964841eb4048cf37cb82103f2573e262927be4c7607f | Medium | Score 53/100 | First seen |
IOC Relationship Graph
6 total IOCs
SHA256CVE
scroll to zoom · drag to pan · click IOC to open