Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE22 IOCs
Blinder Tunnel Campaign Targets Iraqi Infrastructure
Threat Actors
Malware Families
Diamond Model
Adversary(3)
Infrastructure(6)
Capability(5)
Victim
Indicators of Compromise
Indicators of Compromise22
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | musicdel.ir aptespionageintel-blog | High | 58 | Oct 10, 26 |
| IP | 91.107.156.29 botnetintel-blogmalware | High | 58 | Oct 10, 26 |
| SHA256 | d3561bd4aad003dc3e08157b0891860bb496b80cd6e44901692e08ab1d4e8260 file-hashintel-blogmalware | Medium | 53 | Oct 10, 26 |
| Domain | meetonline.cam intel-blogmalwarenetwork | High | 58 | Oct 10, 26 |
| CVE | CVE-2026-88772 ddosexploitintel-blog | High | 81 | Sep 28, 26 |
| SHA256 | 76273382e4252c1f60a2251141e108942494409c759358320735891762c0682e file-hashintel-blogmalware | High | 86 | Oct 10, 26 |
| Domain | portal.sharjahairport.cloud intel-blogmalwarenetwork | High | 58 | Oct 10, 26 |
| CVE | CVE-2026-88771 ddosexploitintel-blog | High | 82 | Sep 27, 26 |
| IP | 65.109.214.145 intel-blogmalwarenetwork | High | 58 | Oct 10, 26 |
| SHA256 | 7cc571aca6d8715d9aaad3d83e1bcd30467565d583db1dfe73697c5d00a1f875 file-hashintel-blogmalware | Medium | 53 | Oct 10, 26 |
| Domain | drivegoogel.cam intel-blogmalwarenetwork | High | 58 | Oct 10, 26 |
| IP | 38.180.136.127 intel-blogmalwarenetwork | High | 58 | Oct 10, 26 |
| Domain | asdfafadafg.online intel-blogmalwarenetwork | High | 58 | Oct 10, 26 |
| SHA256 | 53f35e49eb9b271fd8cbcd3daacb525328dbf159a03dbd1c7adebe0363daa402 file-hashintel-blogloader | Medium | 53 | Oct 10, 26 |
| Domain | googelmeet.online intel-blogmalwarenetwork | High | 58 | Oct 10, 26 |
| Domain | googeldrive.cam intel-blogmalwarenetwork | High | 58 | Oct 10, 26 |
| Domain | ns1.soroshpasargad.com c2intel-blogmalware | High | 58 | Oct 10, 26 |
| IP | 87.248.129.239 indicatorintel-blogmalware | Low | 26 | Oct 1, 25 |
| SHA256 | 3fd810a3aa0039993393741b32287c367a9a5037a41e826906440887cdd3ed13 file-hashintel-blogloader | Medium | 53 | Oct 10, 26 |
| SHA256 | f5b12772db6817f7a765a6fe7565fd3d4f87edc28e42fe3ec0244a372a410fc9 file-hashintel-blogloader | Medium | 53 | Oct 10, 26 |
| SHA256 | 6e7d9b33f1e72ea1ede71373a604ecdb060dab7d42055179c1eede9ecd1fd239 botnetfile-hashintel-blog | High | 86 | Oct 10, 26 |
| SHA256 | f5ba1645694c62f527ed6ceda8c68a5c3dd92b4032439167e8e937e72803b4bd file-hashintel-blogmalware | Medium | 53 | Oct 10, 26 |
IOC Relationship Graph
IOC Relationship Graph22 total IOCs
DomainIPSHA256CVE