Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE24 IOCs
CISA Warns of Medusa Ransomware-as-a-Service Attacks Over 300 Organizations
Malware Families
Diamond Model
Adversary
Infrastructure(6)
Capability(4)
Victim
Indicators of Compromise
Indicators of Compromise24
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 23.234.93.112 intel-blogmalwarenetwork | High | 58 | Aug 19, 26 |
| IP | 167.88.166.173 abuseactive scanalienvault_ransomware | Medium | 65 | Feb 28, 26 |
| IP | 23.234.106.242 intel-blogmalwarenetwork | High | 58 | Aug 19, 26 |
| IP | 37.221.66.239 intel-blogmalwarenetwork | High | 58 | Aug 19, 26 |
| IP | 185.135.86.185 intel-blogmalwarenetwork | High | 58 | Aug 19, 26 |
| IP | 185.238.231.16 exfiltrationintel-blogmalware | High | 58 | Aug 19, 26 |
| IP | 94.156.67.145 intel-blogmalwarenetwork | High | 58 | Aug 19, 26 |
| CVE | CVE-2023-48788 exfiltrationexploitintel-blog | Medium | 53 | Jun 20, 26 |
| IP | 146.70.172.247 intel-blogmalwarenetwork | High | 58 | Aug 19, 26 |
| IP | 85.155.186.121 intel-blogmalwarenetwork | High | 61 | Jun 2, 26 |
| IP | 23.234.89.195 intel-blogmalwarenetwork | High | 58 | Aug 19, 26 |
| IP | 83.138.53.139 intel-blogmalwarenetwork | High | 58 | Aug 19, 26 |
| IP | 185.238.231.85 intel-blogmalwarenetwork | High | 58 | Aug 19, 26 |
| IP | 155.2.215.69 intel-blogmalwarenetwork | High | 58 | Aug 19, 26 |
| IP | 143.244.47.89 intel-blogmalwarenetwork | High | 58 | Aug 19, 26 |
| IP | 185.238.231.98 intel-blogmalwarenetwork | High | 58 | Aug 19, 26 |
| IP | 155.2.215.71 intel-blogmalwarenetwork | High | 58 | Aug 19, 26 |
| IP | 185.238.231.4 intel-blogmalwarenetwork | High | 58 | Aug 19, 26 |
| IP | 185.238.231.77 intel-blogmalwarenetwork | High | 58 | Aug 19, 26 |
| Domain | erp.ranasons.com abuseactive scanalienvault_ransomware | Medium | 60 | Aug 6, 25 |
| IP | 37.19.21.180 intel-blogmalwarenetwork | High | 58 | Aug 19, 26 |
| CVE | CVE-2024-1709 exfiltrationexploitintel-blog | Medium | 53 | Jun 2, 26 |
| URL | http://45.61.150.94:8000/storm.exe intel-blogmalwarenetwork | High | 58 | Aug 19, 26 |
| IP | 143.110.243.154 exfiltrationintel-blogmalware | High | 58 | Aug 19, 26 |
IOC Relationship Graph
IOC Relationship Graph24 total IOCs
IPCVEDomainURL