Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE12 IOCs
Multiple Russian Threat Actors Targeting Microsoft Device Code Authentication
Threat Actors
Malware Families
Diamond Model
Adversary(2)
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Indicators of Compromise12
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | connect-71q.pages.dev intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| IP | 172.86.93.30 intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| IP | 107.189.27.41 intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| Domain | afpi-sec.com intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| Domain | sen-comms.com intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| Domain | androidstatics.com intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| Domain | chromeelevationservice.com intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| IP | 144.172.113.77 intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| Domain | rosejob.com acceptaccount compromiseaccount discovery | Medium | 69 | Dec 14, 20 |
| Domain | documents-exe.pages.dev intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| IP | 107.189.26.199 intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| Domain | comms-net.com intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
IOC Relationship Graph
IOC Relationship Graph12 total IOCs
DomainIP