TLP:WHITE112 IOCs

From cause to cash: a cross-border look at hacktivist activity

Securelist

Published June 8, 2026Original Report

Malware Families

Diamond Model

Adversary

Infrastructure(6)

Capability(4)

Victim

5W+H Threat Analysis

Analysis unavailable

Indicators of Compromise

Indicators of Compromise112

Type	Indicator	Confidence	Score	First Seen
MD5	6d365de5c5a13006b7cadd6bc6876e84 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	09d0517a1f69feff8186655ae3b567e0 file-hashintel-blogmalware	Medium	53	Jul 1, 26
MD5	1344e6bc51cea35befb4adff7a25899b exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	4f41a22b3e7469fb6b45a42d71ec7087 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	08f3a14a2337eb9936c38f5159be007c exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	d8ff7f417d56fa2a3baf3c8933013a25 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
CVE	CVE-2023-44976 exploitintel-blogmalware	Medium	51	Jul 1, 26
MD5	fa04aeedc0d2f5bb6ed357fdae1c1435 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	3a9b0875fc692944c180b165a83a0d17 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	c558e6a9d0a697c757aa6d7782e269c9 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	555a6722436d7cf7de396e0c57d32a27 aptespionageexploit	Medium	53	Jul 1, 26
MD5	80e5bde401d6b0ca96015ae9cfeb6535 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	3b974ff986445e5944c51179d19bd6be exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	a36082c998391a3ebaf05ba4f834172c exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	038cab0c60c53cf12f048272014024c0 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	9741672506f26813c71839aaa6aa3882 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	0c32bfdf83ecebe3a1399d261dc8ff57 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	3ee38b944e5c83922f99641846f7db0c exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	02493e1cb684be6a1a1fc6334a56c516 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
IP	212.46.12.182 exploitintel-blogmalware	High	58	Jul 1, 26
MD5	1c82a94c362a9e98a66ae57d6ff37900 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	dd8fea244afc8223b961f1d9d6ac8c5d exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	841b7d3863b49f62d4faa9949ff5df38 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	9810ea6752112b3569ddc096e1a72e1d exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	bcd3859f4ddd72c4690d76c3b4ef8955 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	60f8b115aec8a13b0069efc84fc645f5 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	08c069f133ac27cbc02a0ed79e4e87ba exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	26100db3f56880110a92a2b4742d6eaf exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	717ab7624c192f6f8dd38994116c28dc exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	129225b3e93c17f131bcc2a982ffb09a exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	e99efd77392e2b4fe4d9bf5728a12b98 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	ede8ce887dd9ab7add0f0fc872d51369 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	84bb66a982710c5536143a07d84e8749 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	1c0924f5711a24821921de5ad822213b exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	bc0ebf67986eea803b4c9633ed3a4bb5 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	a3dba01c76571adc0797801ff30f2b90 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	1d09499cb2d7d70df903b60602a58887 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	fe04d230db612ea24af3826fda667131 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	2d5533fb65ebb50a5a5fd53e62d73b9a exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	78250fa890220821e2b91e31b965de59 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	6d19c8eea11d50c01d20f18382a964d1 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	d65a79ea9257637c77cab6e087468912 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	579e8bbd6a5bcca89b5acd6fb5db32db exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	54a308f734095d54ae0e1c86c849a2d8 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	d13997b1716e4c82ab454285202eafdc exploitfile-hashintel-blog	Medium	53	Jul 1, 26
IP	130.49.155.112 exploitintel-blogmalware	High	58	Jul 1, 26
MD5	663a479d6d24c767f1d3229a0a91554b exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	f88d2b5c3b885ad5a9c1c44551bccc60 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	10824d14c814524155f2b529cf5fee43 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	1bd1ca848b15530e39792b4fe6f31367 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	83f66862c0cc40da20236fd6b47138fd exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	d1c51b92939aa168f0951a8368841373 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	e14cc9a959bbe16c48b8dff063b311f3 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	f2dc794bf93887e281ad89209493065a exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	9f37fff7e5d22f83fc1c0872ad5332f9 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	cf682a6fee80a78be578b1edd82627fa exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	c7eb6da3aa216816079a1b785097552a exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	36b3be503c6e34613ff50cb28e0f3ddb exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	fa3c222f6b53d6a2e35a54600f6aa011 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	76c819185e3c8b8557a2c3986ab80a7c exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	cd0c5b9e4e47df4231d02ed87ff49f26 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	ecb57d8793514aa02314417265b1853f exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	2a09162d72aa416e18bab46070043a13 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	6dfef58ef68fb7965a23da8be3141af9 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	5e81f72614db42615489266be11b1d09 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	56be07e46fd452315008ed246ebbf52b exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	18618f4b468ba4e64c2e1072a6da2134 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	f2af797ac45b9f578c53cc49e5797397 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
IP	45.150.109.2 aptc2espionage	High	58	Jul 1, 26
MD5	56d1de3159adbfda20aca593c99901f9 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	334abbdc99d359aab2ea371dd4eda5f2 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	3f4fbba101b209b00e70787fd5bab819 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	4c8a0531653b5398a35c6b1b80ff1350 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	3137958eb830186826d486afd9222aee exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	62123c39477389d500e74e82782adea5 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	b974141ff9ad1efb60dd9e16977266ca exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	b8a13e808b5b5f1836d3e559755139d0 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	7da855b2fd9b52f9088e64d656164637 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	2f40bcee90abed0898e92521da17e52d exploitfile-hashintel-blog	Medium	53	Jul 1, 26
IP	185.221.153.121 exfiltrationintel-blogmalware	High	58	Jul 1, 26
MD5	3d9cbc944f9a9e127550ffb4e8394965 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	1742a9fa35e253614b76ac0f687ba02e exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	61647db645f7cc221046999ef1dbe1d1 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	68e310de44c3165ffffa25bc495d6fc5 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	06bed0a0906e52c764b3b7016d6a4428 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	6cf548445c39aff844be96d73c89e376 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	389a1bbdbf5c91bd1c179227f5ae0923 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	1ff222457f5e0e32adfa8341f260dde7 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
IP	138.226.236.52 aptbotnetespionage	High	86	Jun 2, 26
MD5	8db0adf8fd6dc6195d7ae55e37e49f97 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	0b1870d57221eec6f3bbef648e71a724 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	96dbdc2651d829bf9ba35674dd4bfcae exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	53ba13cc6066adfd67f8098c0a5b8dde exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	c183033d86d2e052b8eb0deb2136ab29 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	7d35b4961914ad83a57f8832d8e870d8 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	5398b7eaa94f0ee570b1c5642b559047 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	cf54f6cbdb4dbf1ce6fc2e5be4ca3b20 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
IP	45.112.194.82 exploitintel-blogmalware	High	58	Jul 1, 26
IP	85.137.253.186 exploitintel-blogmalware	High	58	Jul 1, 26
MD5	1e1edf879b2dc6c9892a22bfa5985db1 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	911a21aa999c324dc960d3498eec528e exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	d78adab5e16c26d4cd14fe38f77e29e6 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	d74262f968dc3f378c4021a89d16a292 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
IP	77.72.85.62 c2exploitintel-blog	High	58	Jul 1, 26
MD5	242038139842ec79ec1044c64eb0804a exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	b36968b98046d1b033d84f292e7ca1cb exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	c12ebe625737ed0908b045e811f14ecd exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	87d48fbccb4aaee95222e215ecb7ebec exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	da55b5612a80ef20ec75b68151e7ff4b exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	2db94ee3ec69988588702bd77999a5d4 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	008cd423ca45134d3343f66cced1d104 exploitfile-hashintel-blog	Medium	53	Jul 1, 26
MD5	d08056c2ac28933d6843658c2c8c574f exploitfile-hashintel-blog	Medium	53	Jul 1, 26

IOC Relationship Graph

IOC Relationship Graph112 total IOCs

MD5CVEIP

scroll to zoom · drag to pan · click IOC to open