Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE13 IOCs
New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery
Threat Actors
Diamond Model
Adversary(1)
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Indicators of Compromise13
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | ns1.cloudlanecdn.com indicatorintel-blognetwork | High | 58 | Jul 22, 26 |
| MD5 | caf021dda726b8ba049c2aa395e505a1 exploitfile-hashintel-blog | Medium | 53 | Jul 22, 26 |
| Domain | ns3.cloudlanecdn.com indicatorintel-blognetwork | High | 58 | Jul 22, 26 |
| Domain | ns2.cloudlanecdn.com indicatorintel-blognetwork | High | 58 | Jul 22, 26 |
| IP | 144.172.108.205 indicatorintel-blognetwork | High | 58 | Jul 22, 26 |
| Domain | clipeditskill.com exploitintel-blognetwork | High | 58 | Jul 22, 26 |
| Domain | ns4.cloudlanecdn.com indicatorintel-blogmalware | Medium | 47 | Jul 21, 26 |
| MD5 | c092b02fbc0fdf7ee9608dd016673806 exploitfile-hashintel-blog | Medium | 53 | Jul 22, 26 |
| IP | 216.126.237.197 indicatorintel-blognetwork | High | 58 | Jul 22, 26 |
| Domain | d.53466d4c67515a.0.p.cloudlanecdn.com indicatorintel-blognetwork | High | 58 | Jul 22, 26 |
| Domain | cloudlanecdn.com indicatorintel-blogmalware | High | 72 | Jul 13, 26 |
| MD5 | 29b2b8c5d99f05bfcdd0d8d976eb5678 exploitfile-hashintel-blog | Medium | 53 | Jul 22, 26 |
| Domain | accesslinkssl.com exploitintel-blognetwork | High | 58 | Jul 22, 26 |
IOC Relationship Graph
IOC Relationship Graph13 total IOCs
DomainMD5IP