Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

TLP:WHITE17 IOCs

Github Yankywilson/jdy Botnet Threat Analysis: Defensive Cti Analysis of the Jdy Reconnaissance Botnet (china Nexus, Volt Typhoon / Kv Lineage, Mitre G1017): Mips64 Implant Reverse Engineering, Infrastructure Enumeration, Tiered Intelligence Reporting, Sigma/yara Detections, and a Tasking Decryptor. Tlp:clear.

ORKL Threat Library

Diamond Model

Adversary(2)

Infrastructure(6)

Capability(1)

Victim

Type	Indicator	Confidence	Score	First Seen
Domain	investigation_methodology.md botnetmalwarenetwork	High	67	Oct 10, 26
Domain	operational_intelligence_report.md botnetmalwarenetwork	High	67	Oct 10, 26
Domain	strategic_intelligence_report.md botnetmalwarenetwork	High	67	Oct 10, 26
SHA256	40ad28b87b5ed395fe8ff303555cc28974682ed6cc5a71ede76c4b17648cb8ed botnetfile-hashmalware	High	86	Jun 23, 26
Domain	jdy_iocs.md malwarenetworkresearch	High	67	Oct 10, 26
Domain	tactical_intelligence_report.md botnetmalwarenetwork	High	67	Oct 10, 26
Domain	threat_hunting_guide.md botnetmalwarenetwork	High	67	Oct 10, 26
Domain	jdy_decrypt.py botnetmalwarenetwork	High	67	Oct 10, 26
Domain	reverse_engineering.md malwarenetworkrat	High	67	Oct 10, 26
Domain	corrections_log.md botnetmalwarenetwork	High	67	Oct 10, 26
Domain	infrastructure_enumeration.md botnetmalwarenetwork	High	67	Oct 10, 26
Domain	jdy_network_cert_notes.md aptespionagemalware	High	67	Oct 10, 26
Domain	implant_components_re.md malwarenetworkrat	High	67	Oct 10, 26
Domain	incident_response_playbook.md malwarenetworkrat	High	67	Oct 10, 26
Domain	non_discriminating_selectors.md botnetmalwarenetwork	High	67	Oct 10, 26
Domain	technical_writeup.md malwarenetworkrat	High	67	Oct 10, 26
Domain	readme.md botnetmalwarenetwork	High	67	Oct 10, 26

IOC Relationship Graph17 total IOCs

DomainSHA256

scroll to zoom · drag to pan · click IOC to open