Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE28 IOCs
Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows
Threat Actors
Malware Families
Diamond Model
Adversary(2)
Infrastructure(6)
Capability(2)
Victim
Indicators of Compromise
Indicators of Compromise28
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-85046 aptespionageexploit | High | 78 | Sep 4, 26 |
| SHA256 | cd0c21f9b32b7feeda1787fccab622dec60ecdf84c0538c08bde3946856b0fa0 file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| URL | https://proof.gitprogram.com/a4/j8 exploitintel-blogmalware | High | 58 | Oct 9, 26 |
| SHA256 | 5eb5645511b00e4f4d73125654eeb3a3930fcf09c65685dc7f03f725331492e3 exploitfile-hashintel-blog | Medium | 53 | Oct 9, 26 |
| SHA256 | d17053557bb90298f7b115432b4820a248fdbe678bca31721529b1f51a82343b browser extensionchrome exploitationdll shared | Medium | 42 | Sep 9, 26 |
| SHA256 | 56eda0ac82e06ee609b034306025e67df161c5877399c305c8eaea136e80c951 browser extensionchrome exploitationdll shared | Medium | 42 | Sep 9, 26 |
| SHA256 | 69c1603f3f9015beb0097d0a3bb0f17400c314e2eae65a7eceacd3b93ea570dc browser extensionchrome exploitationdll shared | Medium | 42 | Sep 9, 26 |
| SHA256 | e2a59432ce2b0d83ded936374a11fca3d3defaf4aab90eb37fca58683eae32c0 file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| URL | http://cloud.shinewrist.net/ exploitintel-blogmalware | High | 58 | Oct 9, 26 |
| SHA256 | 51462a23ac25e1bd0e49b7cae7f3a71f8d2201e22d45175b587e4740b49863cc file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| SHA256 | 337b48c1cd6dd6e7b8073327082a60e149517fa084ba17b180e041fffa3b130d file-hashindicatorintel-blog | Medium | 37 | Sep 9, 26 |
| Domain | d71bedcf-307a-4432-beec-ce943223d0e3.cfargotunnel.com exploitintel-blogmalware | High | 58 | Oct 9, 26 |
| SHA256 | 7a52ff23949edee8faa61ce0def6dbca8b7e5943c54d23376cc190762ea3985c file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| SHA256 | 59dc108e22cb856c228bbf8a1ab955fb66f0844a07fe10fa0d9fc3823d2cbbcb file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| IP | 206.166.251.164 c2intel-blogmalware | High | 58 | Oct 9, 26 |
| SHA256 | 3b71d721c39fad92a44ddd764bbb34afeae44a5db886d0a4827a399a5fbd367f file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| CVE | CVE-2026-85880 aptespionageexploit | High | 75 | Sep 9, 26 |
| URL | https://cloud.shinewrist.net/ intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| SHA256 | b7b0cd6539464ab39c6526e499f86d611faa21c5af945535ebaf187cec543af1 file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| Domain | document.gitprogram.com intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| URL | https://xyz0102.gitprogram.com/a001 intel-blogloadermalware | High | 58 | Oct 9, 26 |
| Domain | gitprogram.com exploitintel-blogmalware | High | 58 | Oct 9, 26 |
| Domain | msbenefit.com exploitintel-blogmalware | High | 64 | Oct 9, 26 |
| URL | https://ocr.opusaccel.top intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| CVE | CVE-2026-87491 aptespionageexploit | High | 71 | Sep 10, 26 |
| SHA256 | 5995f42a828606705a7339d58a665c229936e81c4e539cdfa115eb46a2eb53d6 file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| URL | https://photos.msbenefit.com/fb/w3z intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| URL | https://photos.msbenefit.com/fa/t3 intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
IOC Relationship Graph
IOC Relationship Graph28 total IOCs
CVESHA256URLDomainIP