Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

TLP:WHITE33 IOCs

Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs

The DFIR Report

Published September 8, 2025Original Report

Threat Actors

Malware Families

Diamond Model

Adversary(3)

Infrastructure(3)

Capability(16)

Victim

Indicators of Compromise

Indicators of Compromise33

Type	Indicator	Confidence	Score	First Seen
MD5	abb2a6a0f771ab20ce2037d2c4ef5783 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	12011c44955fd6631113f68a99447515 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	6f9326224e6047458e692cd27aeb1054b9381c67aaf2fe238dbebfbc916c4b33 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	e1521e077079032df974c7ae39e4737cdb4f05c6ded677ed5446167466eeb899 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA1	52332ce16ee0c393b8eea6e71863ad41e3caeafd file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	829a9dfd2cdcf50519a1cec1f529854b file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA1	d15d45d9d9a8ef7a9f048d74b386f620f3b82576 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA1	2114d655805f465d11b720830d150c145039bcd4 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA1	ac0fcbc148e45e172c9be0acf9c307186f898803 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	f8810179ab033a9b79cd7006c1a74fbcde6ed0451c92fbb8c7ce15b52499353a file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	18f0898d595ec054d13b02915fb7d3636f65b8e53c0c66b3c7ee3b6fc37d3566 abuseachillesactive scan	High	85	Sep 8, 21
SHA256	c92c158d7c37fea795114fa6491fe5f145ad2f8c08776b18ae79db811e8e36a3 file-hashintel-blogmalware	Medium	53	Oct 9, 26
Domain	504ec1c95.host.njalla.net intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA1	68b6d0cc1430e2d4f70e2ba5026d1c4847324269 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	95c96de7dcb5a643559ac66045559cc9 file-hashintel-blogmalware	Medium	53	Oct 9, 26
Domain	504e1c95.host.njalla.net intel-blogmalwarenetwork	High	58	Oct 9, 26
MD5	88df27b6e794e3fd5f93f28b1ca1d3d0 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	27f7186499bc8d10e51d17d3d6697bc5 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	e963d598a86c5ee428a2eefa34d1ffbb file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	c6f92d1801d7d212282a6dd8f11b44fe file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA1	f24fc14f39c160b54dc3b2fbd1eba605ec0eb04f file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	ae7c31d4547dd293ba3fd3982b715c65d731ee07a9c1cc402234d8705c01dfca file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	71f703024c3d3bfc409f66bb61f971a0 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	bcff246f0739ed98f8aa615d256e7e00bc1cb24c8cabaea609b25c3f050c7805 file-hashintel-blogmalware	Medium	53	Oct 9, 26
IP	45.141.87.55 intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA1	4f4f8cf0f9b47d0ad95d159201fe7e72fbc8448d file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	aeaf7cc7364a44b381af9f317fe6f78c2717217800b93bee8839ab3e56233254 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA1	142294249feb536e0edbe6e2de3eb3c3415ecf39 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	a7240d8a7aee872c08b915a58976a1ddee2ff5a8a679f78ec1c7cf528f40deed file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA1	c0e5e4b5fcbd0a30b042e602d99a6ee81ad5d8d7 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA1	5bf41754bfb3a18611b2a02f7f385960ed24f8e1 file-hashintel-blogmalware	Medium	53	Oct 9, 26
SHA256	a4bc6bebabb52ed9816987b77ebae6ef70e174533a643aea6265bdf1ed9b8952 file-hashintel-blogmalware	Medium	53	Oct 9, 26
MD5	5675a7773f6d3224bfefdc01745f8411 file-hashintel-blogmalware	Medium	53	Oct 9, 26

IOC Relationship Graph

IOC Relationship Graph33 total IOCs

MD5SHA256SHA1DomainIP

scroll to zoom · drag to pan · click IOC to open