IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE54 IOCs

Darksword/coruna Open Directory Finding Report

OT
ORKL Threat Library
Original Report

Threat Actors

Malware Families

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYCleaverUNC6353UNC6748INFRASTRUCTURE183.154.173.30https://t.me/YATA0000218.25.85.177CAPABILITYCobalt StrikeGh0st RATVICTIMunknown
Adversary(3)
Infrastructure(6)
Capability(2)
Victim

Indicators of Compromise

Indicators of Compromise54

TypeIndicatorConfidenceScoreFirst Seen
IP183.154.173.30
c2intel-blogmalware
High
64
Oct 9, 26
URLhttps://t.me/YATA0000
intel-blogmalwarenetwork
High
64
Oct 9, 26
IP218.25.85.177
intel-blogmalwarenetwork
High
64
Oct 9, 26
IP47.102.192.23
active scanactive scanningapt
Medium
64
Nov 12, 25
Domainfc.rsqqq.top
botnetindicatorintel-blog
High
86
Oct 8, 26
CVECVE-2025-31200
exploitintel-blogmalware
High
60
Oct 9, 26
IP154.217.250.206
exfiltrationexploitintel-blog
High
64
Oct 9, 26
MD52d2aebba0bf3d7d694194a7ab93b0a96
file-hashindicatorintel-blog
Medium
57
Oct 8, 26
IP59.46.4.117
intel-blogmalwarenetwork
High
64
Oct 9, 26
Domainwumian.cc.cd
intel-blogmalwarenetwork
High
64
Oct 9, 26
URLhttp://199.30.90.154:18090
intel-blogmalwarenetwork
High
60
Oct 8, 26
IP156.239.230.120
aptc2espionage
Medium
63
Sep 30, 20
IP112.213.108.85
intel-blogmalwarenetwork
High
64
Oct 9, 26
IP202.146.222.253
aptespionageintel-blog
High
64
Oct 9, 26
SHA2568973e80ab494c02463d4123f76fc5e2dca2ea2c097317d246323d75c1f2eb791
c2exploitfile-hash
Medium
57
Oct 8, 26
SHA256a50c4da5c92636b2b1f170cdce3bd967a213886a8df5656cf3519214fcecfac5
c2exploitfile-hash
Medium
57
Oct 8, 26
CVECVE-2026-31001
exploitintel-blogmalware
High
63
Oct 8, 26
Domainu.fit
intel-blogmalwarenetwork
High
64
Oct 9, 26
Domainnorthlab.cn
exfiltrationindicatorintel-blog
Medium
51
Oct 8, 26
IP185.189.45.40
aptbotnetespionage
High
86
Oct 9, 26
IP203.91.77.253
aptasiaespionage
Medium
54
Oct 8, 26
Domaini.131422.com
botnetintel-blogmalware
High
80
Sep 23, 26
IP199.30.90.154
botnetintel-blogmalware
High
86
Oct 9, 26
SHA11334417664270db20af705f422878c53c8378203
aptespionagefile-hash
High
61
Oct 9, 26
URLhttps://censys.com/blog/darksword-coruna-open-directory-finding-report/
malwarenetworkrat
High
67
Oct 13, 26
SHA256c391bce7b09a0ea263e4b2c1d1bde0327c180723fa3299b006485429564c61ee
c2exfiltrationexploit
High
61
Oct 9, 26
IP14.128.47.81
intel-blogmalwarenetwork
High
64
Oct 9, 26
IP154.219.127.147
intel-blogmalwarenetwork
High
64
Oct 9, 26
Domainsiekeltd.com
aptespionageexploit
High
71
Jun 27, 26
SHA25654a4166ab33ffe02b41de9c943e783d20129b6cc22f56b7fe7d564fd02bde006
exploitfile-hashindicator
Medium
57
Oct 8, 26
IP101.35.158.183
intel-blogmalwarenetwork
High
64
Oct 9, 26
IP154.219.127.94
exploitintel-blogmalware
High
64
Oct 9, 26
IP43.134.165.205
abuseactive scanapache
High
75
May 16, 26
Domainst.onlinefc.top
botnethkhong kong
High
86
Oct 8, 26
Domainiplcz.cn
chinaindicatorintel-blog
Medium
51
Oct 8, 26
CVECVE-2025-24201
exploitintel-blogmalware
High
60
Oct 9, 26
Domainescofiringbijou.com
aptespionageexploit
High
71
Jun 27, 26
IP182.239.114.223
c2intel-blogmalware
High
64
Oct 9, 26
Domainhdios.cn
intel-blogmalwarenetwork
High
64
Oct 9, 26
SHA256864d68e64618d6bfc26d75d6f780ae0b7bfed3698cc8333818ed32519e560d1f
file-hashintel-blogmalware
High
61
Oct 9, 26
IP218.25.85.178
intel-blogmalwarenetwork
High
64
Oct 9, 26
Domainexploit_server.py
exploitmalwarenetwork
High
67
Oct 13, 26
Domainmanager.g.northlab.cn
exfiltrationintel-blogmalware
High
64
Oct 9, 26
Domainccwu.cc
intel-blogmalwarenetwork
High
64
Oct 9, 26
IP59.46.4.119
intel-blogmalwarenetwork
High
64
Oct 9, 26
MD5c73dfcfd60a0c7ebcc03352d433349bc
file-hashindicatorintel-blog
Medium
57
Oct 8, 26
URLhttps://66ds.lol
intel-blogmalwarenetwork
High
64
Oct 9, 26
SHA2567ff5bb16cd5f8c92bc4fec72bba162662f202af075418db5000a1b4f81489fc2
exploitfile-hashintel-blog
High
61
Oct 9, 26
Domaing.northlab.cn
exfiltrationintel-blogmalware
High
64
Oct 9, 26
IP166.88.95.90
aptbotnetc2
High
86
Aug 30, 26
IP23.148.212.237
c2indicatorintel-blog
Medium
48
Oct 8, 26
URLhttps://censys.com/blog/darkswords-panel-sprawl/
malwarenetworkrat
High
67
Oct 13, 26
MD509d0b8d58a71653cd1c89c64c866f2e6
file-hashindicatorintel-blog
Medium
57
Oct 8, 26
IP154.18.187.160
aptespionageintel-blog
High
64
Oct 9, 26

IOC Relationship Graph

IOC Relationship Graph54 total IOCs
IPURLDomainCVEMD5SHA256SHA1
IP22Domain14SHA2566URL5CVE3MD53SHA11Actors3Malware2REPORTDarksword/coruna Open DireCleaverUNC6353UNC6748Cobalt StrikeGh0st RAT
scroll to zoom · drag to pan · click IOC to open