IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE5 IOCs

Lessons from the Isoon Leaks

OT
ORKL Threat Library
Original Report

Threat Actors

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYAPT41BRONZE ATLASBRONZE UNIVERSITYINFRASTRUCTUREhttps://blog.bushidot…74.120.172.10mailnotes.onlineCAPABILITYunknownVICTIMunknown
Adversary(10)
Infrastructure(4)
Capability
Victim

Indicators of Compromise

Indicators of Compromise5

TypeIndicatorConfidenceScoreFirst Seen
MD5aac38c75f268b72910a94881ccbb77cb
exfiltrationfile-hashresearch
High
67
Oct 12, 26
URLhttps://blog.bushidotoken.net/2024/02/lessons-from-isoon-leaks.html
exfiltrationnetworkresearch
High
67
Oct 12, 26
IP74.120.172.10
aptespionageexfiltration
High
72
Oct 10, 26
Domainmailnotes.online
exfiltrationnetworkphishing
High
72
Oct 10, 26
IP8.218.67.52
aptespionageexfiltration
High
70
Oct 10, 26

IOC Relationship Graph

IOC Relationship Graph5 total IOCs
MD5URLIPDomain
IP2MD51URL1Domain1Actors5REPORTLessons from the Isoon LeaAPT41BRONZE ATLASBRONZE UNIVERSITYEarth LuscaHoundstooth Typhoon
scroll to zoom · drag to pan · click IOC to open