IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE18 IOCs

Russia-Linked Cyber Espionage Clusters Use OAuth Phishing to Target U.S. and European Organizations

CP
Cyber Press
Published August 27, 2026Original Report

Threat Actors

Malware Families

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYUNC6293INFRASTRUCTUREstateaffairs.usdosportal.appstatistic-ms.liveCAPABILITYMETA StealerVICTIMunknown
Adversary(1)
Infrastructure(6)
Capability(1)
Victim

Indicators of Compromise

Indicators of Compromise18

TypeIndicatorConfidenceScoreFirst Seen
Domainstateaffairs.us
intel-blogmalwarenetwork
High
58
Aug 27, 26
Domaindosportal.app
exploitintel-blogmalware
High
63
Aug 21, 26
Domainstatistic-ms.live
intel-blogmalwarenetwork
High
58
Aug 27, 26
Domainglobsec.org
intel-blogmalwarenetwork
High
58
Aug 27, 26
Domainforeignrelations.us
exploitintel-blogmalware
High
63
Aug 21, 26
Domainsharefolders.org
intel-blogmalwarenetwork
High
58
Aug 27, 26
Domainfileshareapp.org
intel-blogmalwarenetwork
High
58
Aug 27, 26
Domainformshare.cloud
intel-blogmalwarenetwork
High
58
Aug 27, 26
Domainthe-washington-ballet.com
intel-blogmalwarenetwork
High
58
Aug 27, 26
IP104.194.159.150
aptespionageexploit
High
75
Jul 24, 26
Domainusercontent.app
intel-blogmalwarenetwork
High
58
Aug 27, 26
IP151.236.15.213
intel-blogmalwarenetwork
High
58
Aug 27, 26
Domaininternationalaffairsportal.us
intel-blogmalwarenetwork
High
58
Aug 27, 26
Domainmy-invite.org
aptespionageexploit
High
72
Aug 1, 26
Email[email protected]
emailintel-blogmalware
High
58
Aug 27, 26
Domain2200freefonts.com
intel-blogmalwarenetwork
High
58
Aug 27, 26
Domainfllefolder.com
intel-blogmalwarenetwork
High
58
Aug 27, 26
Domainsharedfolders.org
intel-blogmalwarenetwork
High
58
Aug 27, 26

IOC Relationship Graph

IOC Relationship Graph18 total IOCs
DomainIPEmail
Domain15IP2Email1Actors1Malware1REPORTRussia-Linked Cyber EspionUNC6293META Stealer
scroll to zoom · drag to pan · click IOC to open