Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE3 IOCs
Red Heron Hackers Exploit Critical Gitea RCE to Steal Source Code and Deploy Linux Rootkit
Diamond Model
Adversary
Infrastructure(1)
Capability
Victim
Indicators of Compromise
Indicators of Compromise3
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 663a8088faca8e126a11648f5671fcf4eaf96435e10daf63a1d1b17d8385154c file-hashindicatorintel-blog | Medium | 53 | Sep 27, 26 |
| CVE | CVE-2026-60004 botnetcryptominerexploit | High | 82 | Aug 8, 26 |
| Domain | 981666.xyz aptespionageintel-blog | High | 69 | Jul 20, 26 |
IOC Relationship Graph
IOC Relationship Graph3 total IOCs
SHA256CVEDomain