Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE11 IOCs
Q3 2026 Statistical Report on Malware Targeting Windows Web Servers
Threat Actors
Malware Families
Diamond Model
Adversary(1)
Infrastructure(5)
Capability(2)
Victim
Indicators of Compromise
Indicators of Compromise11
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | 0a4be0b6c650ffdcd1c22db56f1c4aec file-hashintel-blogmalware | Medium | 53 | Oct 14, 26 |
| URL | http://2.59.133.147:31338/ins.txt intel-blogmalwarenetwork | High | 58 | Oct 14, 26 |
| URL | http://2.59.133.147:31338/sm.json intel-blogmalwarenetwork | High | 58 | Oct 14, 26 |
| URL | http://45.138.16.187:31337/cofuz.json exploitintel-blogmalware | High | 58 | Oct 14, 26 |
| URL | http://45.138.16.187:31337/bb.json intel-blogmalwarenetwork | High | 58 | Oct 14, 26 |
| MD5 | 177e34d9174766a1d187a0c82de4c02f file-hashintel-blogmalware | Medium | 53 | Oct 14, 26 |
| MD5 | 1dbfda02d74b6a7586c4430175204c28 file-hashintel-blogmalware | Medium | 53 | Oct 14, 26 |
| MD5 | 10f705728d228ad949b7894c1a85a2b1 file-hashintel-blogmalware | Medium | 53 | Oct 14, 26 |
| URL | http://206.82.6.22/ intel-blogmalwarenetwork | High | 58 | Oct 14, 26 |
| CVE | CVE-2019-18935 exploitintel-blogmalware | High | 61 | Sep 28, 26 |
| MD5 | 18fb4e070653fc9791e0e408d8cb1c8e file-hashintel-blogmalware | Medium | 53 | Oct 14, 26 |
IOC Relationship Graph
IOC Relationship Graph11 total IOCs
MD5URLCVE