IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE5 IOCs

Cti/runster/readme.md at Main · Cert Orangecyberdefense/cti

OT
ORKL Threat Library
Original Report

Threat Actors

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYEarth LuscaBRONZE UNIVERSITYEarth LuscaINFRASTRUCTUREevents.msft23.comword1-word2-word3.xyzblog.eclecticiq.com/s…CAPABILITYunknownVICTIMunknown
Adversary(4)
Infrastructure(5)
Capability
Victim

Indicators of Compromise

Indicators of Compromise5

TypeIndicatorConfidenceScoreFirst Seen
Domainevents.msft23.com
malwarenetworkresearch
High
68
Oct 16, 26
Domainword1-word2-word3.xyz
malwarenetworkresearch
High
67
Oct 16, 26
URLblog.eclecticiq.com/seo-poisoning-campaign-leverages-gemini-
malwarenetworkresearch
High
67
Oct 16, 26
Domainiocs.md
exploitloadermalware
High
72
Jun 27, 26
Domainsecure_prefs.zip
exfiltrationloadermalware
High
67
Oct 16, 26

IOC Relationship Graph

IOC Relationship Graph5 total IOCs
DomainURL
Domain4URL1Actors4REPORTCti/runster/readme.md at MEarth LuscaBRONZE UNIVERSITYEarth LuscaEarth Lusca
scroll to zoom · drag to pan · click IOC to open