Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE5 IOCs
Attacker infrastructure, but vibe-coded: tracking the evolution of credential harvesting platforms
Malware Families
Diamond Model
Adversary
Infrastructure
Capability(1)
Victim
Indicators of Compromise
Indicators of Compromise5
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2025-55182 aptbotnetc2 | High | 86 | Jun 2, 26 |
| CVE | CVE-2026-64638 aptespionageexploit | Medium | 57 | Aug 8, 26 |
| CVE | CVE-2026-63030 aptespionageexploit | High | 70 | Jul 19, 26 |
| CVE | CVE-2026-48907 aptespionageexploit | Medium | 53 | Jun 20, 26 |
| CVE | CVE-2026-60137 aptespionageexploit | High | 67 | Jul 19, 26 |
IOC Relationship Graph
IOC Relationship Graph5 total IOCs
CVE