Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE10 IOCs
NetScaler C2: A Massive CVE-2026-88771 Exploitation Operation
Malware Families
Diamond Model
Adversary
Infrastructure(2)
Capability(1)
Victim
Indicators of Compromise
Indicators of Compromise10
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | a9142989d912098856e58f2c74c2266e39150d50bc59722f915dade1ddfddf4a exploitfile-hashintel-blog | Medium | 53 | Oct 9, 26 |
| URL | http://45.143.130.195:8899/a/ intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| CVE | CVE-2026-88772 ddosexploitintel-blog | High | 81 | Sep 28, 26 |
| SHA256 | 8588d11874ab52a1637953dc5538984647023d00b529f695fbd0e40cf8e5e852 file-hashintel-blogmalware | Medium | 53 | Oct 9, 26 |
| CVE | CVE-2026-88771 ddosexploitintel-blog | High | 82 | Sep 27, 26 |
| SHA256 | 69a34c591eaaa2cbecaeed10c303b8dcf04c846b8408491da5452b9cfc93f686 exploitfile-hashintel-blog | Medium | 53 | Oct 9, 26 |
| IP | 45.143.130.195 intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
| SHA256 | f9e06d412dee96d98db4d4588f0012af859cc11caaae3e130697f282447cf07f exploitfile-hashintel-blog | Medium | 53 | Oct 9, 26 |
| SHA256 | a3e26053975daa0a12a4848ce9533e5c439617cd7f69851347be2061999b4cd4 exploitfile-hashintel-blog | Medium | 53 | Oct 9, 26 |
| SHA256 | 4992f575f3f1fc448cf54a4a0ce13cf6548790777abe0af1f935663498ea5639 exploitfile-hashintel-blog | Medium | 53 | Oct 9, 26 |
IOC Relationship Graph
IOC Relationship Graph10 total IOCs
SHA256URLCVEIP