IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE1 IOC

Defender Exclusion Abuse: How Attackers Hide Malware from MDAV

HU
Huntress
Published September 30, 2026Original Report

Threat Actors

Malware Families

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYAkiraSandwormINFRASTRUCTUREunknownCAPABILITYAkiraCobalt StrikeGootloaderVICTIMunknown
Adversary(2)
Infrastructure
Capability(7)
Victim

Indicators of Compromise

Indicators of Compromise1

TypeIndicatorConfidenceScoreFirst Seen
CVECVE-2021-32648
exploitintel-blogloader
Medium
51
Oct 9, 26

IOC Relationship Graph

IOC Relationship Graph1 total IOCs
CVE
CVE1Actors2Malware5REPORTDefender Exclusion Abuse: AkiraSandwormAkiraCobalt StrikeGootloaderMETA StealerMimikatz
scroll to zoom · drag to pan · click IOC to open