Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE8 IOCs
ChainDrop supply chain compromise: Anatomy of a self-propagating worm
Diamond Model
Adversary
Infrastructure(4)
Capability
Victim
Indicators of Compromise
Indicators of Compromise8
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | npm-cache.com botnetintel-blogmalware | High | 86 | Aug 4, 26 |
| Domain | js-mirror.com botnetintel-blogmalware | High | 86 | Aug 4, 26 |
| SHA256 | 54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668 file-hashintel-blogloader | High | 56 | Aug 5, 26 |
| URL | https://npm-cache.com:443/router intel-blognetworkurl | High | 58 | Aug 5, 26 |
| SHA1 | e1f2395ee43e45a1556ec6438a88c31b83493103 file-hashindicatorintel-blog | Medium | 53 | Aug 5, 26 |
| SHA256 | fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1eb file-hashintel-blogloader | High | 59 | Aug 5, 26 |
| SHA256 | 9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc file-hashintel-blogloader | High | 59 | Aug 5, 26 |
| Domain | pypi-get.com botnetintel-blogmalware | High | 86 | Aug 4, 26 |
IOC Relationship Graph
IOC Relationship Graph8 total IOCs
DomainSHA256URLSHA1