IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE41 IOCs

Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties

SE
SentinelLABS
Published September 18, 2026Original Report

Threat Actors

Malware Families

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYRoyalUNC4899INFRASTRUCTUREregistry.hashicorp-aw…213-111-146-132.cprap…hashicorp-terraform.ioCAPABILITYCobalt StrikeRoyalVICTIMunknown
Adversary(2)
Infrastructure(6)
Capability(2)
Victim

Indicators of Compromise

Indicators of Compromise41

TypeIndicatorConfidenceScoreFirst Seen
Domainregistry.hashicorp-aws.com
exploitintel-blogmalware
High
58
Oct 9, 26
Domain213-111-146-132.cprapid.com
intel-blogmalwarenetwork
High
58
Oct 9, 26
SHA1c491d477dbe0ae04e9aed9dbe237144c03f73ec4
file-hashintel-blogmalware
Medium
53
Oct 9, 26
SHA1930e5be6d34511bedbfb0d762bd08fffe64e9630
file-hashintel-blogmalware
Medium
53
Oct 9, 26
SHA14ad92bf92ee614b05c340ce17bef7b6ef5a25e82
file-hashintel-blogmalware
Medium
53
Oct 9, 26
Domainhashicorp-terraform.io
exploitintel-blogmalware
High
63
Oct 9, 26
Domaingrenight.com
c2intel-blogmalware
High
58
Oct 9, 26
Domaingame.galaxy-royal.online
intel-blogmalwarenetwork
High
58
Oct 9, 26
SHA119af09ebe8b7ad03419677dda515507dd099bc39
file-hashintel-blogmalware
Medium
53
Oct 9, 26
Domainns4.galaxy-royal.online
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domainwww.anesthesiaschool.com
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domainwww.freehealth.lat
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domaintinklify.com
intel-blogmalwarenetwork
High
58
Oct 9, 26
SHA102df07a173ab03b82a4fb6a08973fff8b1467f28
file-hashintel-blogmalware
Medium
53
Oct 9, 26
Domainapp.heyhay.online
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domainhashicorp-aws.io
exploitintel-blogmalware
High
58
Oct 9, 26
SHA2564b2d3e8ccce8920a6d01e7d02b84236545a20e5f754b3eec253f8b416b731daa
file-hashintel-blogmalware
Medium
53
Oct 9, 26
IP45.11.59.140
c2intel-blogmalware
High
58
Oct 9, 26
Domainmactroubleshoots.pro
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domainwww.mactroubleshoots.pro
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domainstorage.hubpage.cloud
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domainmx01.galaxy-royal.online
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domainwww.tinklify.com
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domainhashicorp-aws.com
exploitintel-blogmalware
High
58
Oct 9, 26
Domain185-66-91-112.cprapid.com
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domainheyhay.online
intel-blogmalwarenetwork
High
58
Oct 9, 26
IP176.97.114.232
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domainanesthesiaschool.com
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domaingalaxy-royal.online
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domainregistry.hashicorp-aws.io
exploitintel-blogmalware
High
58
Oct 9, 26
MD51cd6d13ff15adbf7a42025d10ec99b4a
file-hashintel-blogmalware
Medium
53
Oct 9, 26
Domainwss.sytes.net
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domainvaimage.com
intel-blogmalwarenetwork
High
58
Oct 9, 26
IP85.137.56.245
c2intel-blogmalware
High
58
Oct 9, 26
SHA15728b11d30586bbfc1d8bd12df1c722a06e767a2
c2file-hashintel-blog
Medium
53
Oct 9, 26
Domainupdate.heyhay.online
intel-blogmalwarenetwork
High
58
Oct 9, 26
IP85.137.56.10
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domainwww.heyhay.online
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domaindela.servehttp.com
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domaintechnicais.sytes.net
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domainregistry.hashicorp-terraform.io
exploitintel-blogmalware
High
58
Oct 9, 26

IOC Relationship Graph

IOC Relationship Graph41 total IOCs
DomainSHA1SHA256IPMD5
Domain29SHA16IP4SHA2561MD51Actors2Malware2REPORTDon’t Call Us, We’ll Call RoyalUNC4899Cobalt StrikeRoyal
scroll to zoom · drag to pan · click IOC to open