IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE11 IOCs

Gotta Breach 'Em All! The Journey Of ShinyHunters

SB
Sekoia Blog
Published September 24, 2026Original Report

Threat Actors

Malware Families

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYLockBitPlayScattered SpiderINFRASTRUCTUREchronicle.comrf.wspromo.comCAPABILITYChiselLockBitMETA StealerVICTIMunknown
Adversary(4)
Infrastructure(6)
Capability(4)
Victim

Indicators of Compromise

Indicators of Compromise11

TypeIndicatorConfidenceScoreFirst Seen
Domainchronicle.com
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domainrf.ws
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domainpromo.com
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domaindatabreaches.net
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domainbreachforums.hn
intel-blogmalwarenetwork
High
58
Oct 9, 26
CVECVE-2026-35273
aptespionageexploit
High
81
Jun 12, 26
Domainraidforums.com
indicatorintel-blogmalware
Low
31
Jul 18, 26
SHA256fa210f015399de16bf7cb1e05856d179dfaabb1ecc9bb5fd277f94972a3bdc43
file-hashintel-blogmalware
Medium
53
Oct 9, 26
SHA256a4e525d8825c1bac6dd934ef2c008b5fb9988289190b5b98d854799e07e207e4
file-hashintel-blogmalware
Medium
53
Oct 9, 26
SHA256d5efdf6f35e9c6edcad5fbec707e6c88570c9d8796bf089c29303d591b94e384
file-hashintel-blogmalware
Medium
53
Oct 9, 26
Domainbreachforums.st
exploitintel-blogmalware
High
58
Oct 9, 26

IOC Relationship Graph

IOC Relationship Graph11 total IOCs
DomainCVESHA256
Domain7SHA2563CVE1Actors4Malware4REPORTGotta Breach 'Em All! The LockBitPlayScattered SpiderUNC5537ChiselLockBitMETA StealerPlay
scroll to zoom · drag to pan · click IOC to open