IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE7 IOCs

Hackers Hijack Hotel Wi-Fi Gateways to Steal Microsoft 365 Accounts Without Phishing

CP
Cyber Press
Published July 24, 2026Original Report

Threat Actors

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYAPT28INFRASTRUCTURE38.146.28.7531.57.243.154owa-ms365.comCAPABILITYunknownVICTIMunknown
Adversary(1)
Infrastructure(6)
Capability
Victim

Indicators of Compromise

Indicators of Compromise7

TypeIndicatorConfidenceScoreFirst Seen
IP38.146.28.75
aptespionageexploit
High
72
Jul 24, 26
IP31.57.243.154
aptespionageexploit
High
72
Jul 24, 26
Domainowa-ms365.com
aptespionageintel-blog
High
72
Jul 24, 26
IP104.194.159.150
aptespionageexploit
High
75
Jul 24, 26
Domainm365-owa.com
aptespionageintel-blog
High
72
Jul 24, 26
Domainms365-live.com
aptespionageintel-blog
High
72
Jul 24, 26
Domainms365-device.com
aptespionageintel-blog
High
72
Jul 24, 26

IOC Relationship Graph

IOC Relationship Graph7 total IOCs
IPDomain
Domain4IP3Actors1REPORTHackers Hijack Hotel Wi-FiAPT28
scroll to zoom · drag to pan · click IOC to open