IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE2 IOCs

Explorer COM Hijacking Attack Loads Shellcode From AES-Encrypted Steganographic PNG

CP
Cyber Press
Published July 8, 2026Original Report

Threat Actors

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYAPT28INFRASTRUCTUREunknownCAPABILITYunknownVICTIMunknown
Adversary(1)
Infrastructure
Capability
Victim

Attack Flow7 steps · MITRE ATT&CK mapped

Initial AccessTA0001·T1204.002
1/7
User Execution: Malicious Macro
ActionExecute malicious macro document
Victim opens a macro-enabled document (readme.docm) which displays scrambled text, tricking the user into enabling active content.

Indicators of Compromise

2 indicators

TypeIndicatorConfidenceScoreFirst Seen
MD577014b3e77529079f041b5b9e73a013bMediumScore 53/100First seen
MD5b077401fe3d9642345d4c3deafa60aa5HighScore 85/100First seen

IOC Relationship Graph

2 total IOCs
MD5
MD52Actors1Explorer COM Hijacking Attack Loads Shellcode From AES-Encrypted Steganographic PNGREPORT77014b3e77529079f041…b077401fe3d9642345d4…APT28
scroll to zoom · drag to pan · click IOC to open