Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE8 IOCs
Inside The Com: Understanding the Ecosystem Behind Scattered Spider, LAPSUS$, ShinyHunters, and FALCON
Threat Actors
Malware Families
Diamond Model
Adversary(2)
Infrastructure(6)
Capability(2)
Victim
Indicators of Compromise
Indicators of Compromise8
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | helpdesk-organization.com exploitintel-blogmalware | High | 58 | Oct 9, 26 |
| Domain | sso-organization.com exploitintel-blogmalware | High | 58 | Oct 9, 26 |
| Domain | organization-okta.com intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| Domain | organization-sso.com intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| Domain | organization-helpdesk.com intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| Domain | passkey.com intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| Domain | ticket-organization.com exploitintel-blogmalware | High | 58 | Oct 9, 26 |
| CVE | CVE-2025-61882 exploitintel-blogmalware | High | 59 | Oct 9, 26 |
IOC Relationship Graph
IOC Relationship Graph8 total IOCs
DomainCVE