Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE34 IOCs
Lunex Uses BYOVD to Disable Security Monitoring and Deploy Persistent Stealer
Threat Actors
Malware Families
Diamond Model
Adversary(34)
Infrastructure(1)
Capability(41)
Victim
Indicators of Compromise
Indicators of Compromise34
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2023-1389 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2025-49704 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2022-30190 exploitintel-blogloader | High | 77 | Jun 12, 26 |
| CVE | CVE-2025-0994 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| Domain | uasputnik.com aptespionageintel-blog | High | 58 | Oct 9, 26 |
| CVE | CVE-2022-47986 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2025-55182 aptespionageexploit | High | 80 | Jun 2, 26 |
| CVE | CVE-2021-3493 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2023-20598 exploitintel-blogloader | Medium | 54 | Oct 7, 26 |
| CVE | CVE-2023-34362 aptespionageexploit | High | 78 | Sep 3, 26 |
| CVE | CVE-2025-3248 botnetddosexploit | High | 79 | Jun 29, 26 |
| CVE | CVE-2025-53770 exploitintel-blogloader | High | 79 | Jun 12, 26 |
| CVE | CVE-2022-31199 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| SHA256 | bf14cd6c3328ebd08e940478b5d1da04e9e5aa576d045d41950bf4f1e2456dd8 botnetfile-hashindicator | High | 85 | Sep 17, 26 |
| CVE | CVE-2021-21974 exploitintel-blogloader | High | 81 | Oct 9, 26 |
| CVE | CVE-2022-21894 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2025-49706 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2023-46604 exploitintel-blogloader | High | 78 | Aug 27, 26 |
| CVE | CVE-2021-4034 exploitintel-blogloader | High | 78 | Jun 2, 26 |
| CVE | CVE-2022-26134 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2023-2868 exploitintel-blogloader | High | 77 | Jun 2, 26 |
| SHA256 | 06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90 botnetfile-hashintel-blog | High | 85 | Sep 25, 26 |
| CVE | CVE-2024-3400 aptespionageexploit | High | 79 | Jun 2, 26 |
| CVE | CVE-2023-22518 aptespionageexploit | High | 81 | Oct 9, 26 |
| CVE | CVE-2024-21412 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2021-33044 exploitintel-blogloader | High | 78 | Jul 30, 26 |
| CVE | CVE-2026-21509 aptespionageexploit | High | 79 | Jun 2, 26 |
| CVE | CVE-2017-7921 exploitintel-blogloader | High | 77 | Jun 3, 26 |
| SHA256 | 6e8b49cf70bf854e8c59c7d27cefa89406caf8978461190dabb86dafcd8554e1 abusealienvault_ransomwareanti-rootkit abuse | Medium | 56 | Mar 23, 26 |
| CVE | CVE-2024-7344 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2023-36025 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2025-53771 exploitintel-blogloader | High | 81 | Oct 9, 26 |
| CVE | CVE-2024-40766 exploitintel-blogloader | High | 79 | Sep 9, 26 |
| CVE | CVE-2025-21042 exploitintel-blogloader | High | 77 | Oct 9, 26 |
IOC Relationship Graph
IOC Relationship Graph34 total IOCs
CVEDomainSHA256