Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

TLP:WHITE24 IOCs

GhostShell (MB-0009): Targeting Ukraine’s UAV Operations and Defense Supply Chain

Synaptic Systems

Published June 22, 2026Original Report

Threat Actors

Malware Families

Diamond Model

Adversary(1)

Infrastructure(4)

Capability(3)

Victim

Indicators of Compromise

Indicators of Compromise24

Type	Indicator	Confidence	Score	First Seen
SHA256	423c98b9a8ad09bbb0aa24e86c23095ef6a26e30b3db07358927929d2fb2ecb3 file-hashintel-blogmalware	Medium	53	Jun 23, 26
URL	https://cloudaxis.cc/gsmft/yueu/fkvqld/tvqqwh/ushu/122.exe intel-blogmalwarenetwork	High	58	Jun 23, 26
SHA256	e4d377b339f96c69c3001b854b22decae41883bd31f2f5a8c20f57d931ae0b44 file-hashintel-blogmalware	Medium	53	Jun 23, 26
SHA256	c83272741d42a7aa738fbad85e21d0565e50cbf3b72f32b835c225965b3cc207 botnetfile-hashintel-blog	High	86	Jun 22, 26
SHA1	11145a2322aa5595d27e25cc977ad1b53ce88dcd file-hashintel-blogmalware	Medium	53	Jun 23, 26
SHA256	cff6007dbb9826d0a08865f47a71b31e90c5067c637ac863e360315da984f107 aptespionageexploit	Medium	53	Jun 23, 26
CVE	CVE-2025-8088 aptespionageexploit	High	64	Jun 2, 26
SHA256	ab5681266f70af7df24383f15de876e411fc18e35cb6f24603b12f580b05ccb3 botnetfile-hashintel-blog	High	86	Jun 22, 26
SHA256	a8dfa5a35f30c1789ce08b7e16660423bb1545fc8ec7411d24cfd41d1439bb45 file-hashintel-blogmalware	Medium	53	Jun 23, 26
SHA256	8de34006dafd990853a45cbe9aaab4ee18c8cd4c1ad0a98fe71f8d63cd60db25 file-hashintel-blogmalware	High	86	Jun 22, 26
SHA256	c91874dc34e991e614060d6f16da7d4680e5eb7d36fba489644863f4c6c8cf66 file-hashintel-blogmalware	Medium	53	Jun 23, 26
SHA256	59842745dafd1537c3e2187f82fae7791e646a74251fe20d6c8ebaadf5720880 file-hashintel-blogmalware	Medium	53	Jun 23, 26
SHA256	a938b7291dbdcdcadb67d560b94bfee366e7f97f06d6f666b25e298c442d8542 file-hashintel-blogmalware	Medium	53	Jun 23, 26
CVE	CVE-2025-6218 aptespionageexploit	High	64	Jun 2, 26
SHA256	b1834634820ae696f0514ca2b6723061f115857232306e573f4d115bc6ead012 c2file-hashintel-blog	High	86	Jun 22, 26
Domain	cdnexpress.cc intel-blogmalwarenetwork	High	58	Jun 23, 26
IP	86.54.25.2 aptespionageintel-blog	High	58	Jun 23, 26
URL	https://cloudaxis.cc/gsmft/yueu/fkvqld/tvqqwh/ushu/update.exe intel-blogmalwarenetwork	High	58	Jun 23, 26
SHA256	3ec6c91d68b416381ac9f6310a9e011f4060369c63416021864a6d5b91e97dc4 file-hashintel-blogmalware	Medium	53	Jun 23, 26
SHA256	28f58061348a1c54fa6e7ff6618630259618d4afdf78514d5fccfc993797cdff botnetfile-hashintel-blog	High	86	Jun 21, 26
SHA256	54218a8f2d1acc5d1beb576b970bb5333a4b78b05493754d2d1457ebf22a0ac1 file-hashintel-blogmalware	Medium	53	Jun 23, 26
MD5	df587c58c82d7cfb41d966d2fe21cecb aptespionageexploit	Medium	53	Jun 23, 26
SHA256	1d6f3e8583ce84b892097a03b0d4525850f8d3c59dea56482f17e5c44422dc89 file-hashintel-blogmalware	Medium	53	Jun 23, 26
SHA256	c5c458a7b1bdfa3cbffdbcd0791912ff19267ad2808a5266a9975b22a53e73e0 file-hashintel-blogmalware	Medium	53	Jun 23, 26

IOC Relationship Graph

IOC Relationship Graph24 total IOCs

SHA256URLSHA1CVEDomainIPMD5

scroll to zoom · drag to pan · click IOC to open