IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE26 IOCs

Scams, Slaves and (Malware-as-a) Service: Tracking a Trojan to Cambodia’s Scam Centers

IN
Infoblox
Published April 10, 2026Original Report

Threat Actors

Malware Families

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYRoyalINFRASTRUCTUREorbiixtrade.comvnwd.topalperu.topCAPABILITYRoyalVICTIMunknown
Adversary(1)
Infrastructure(6)
Capability(1)
Victim

Indicators of Compromise

Indicators of Compromise26

TypeIndicatorConfidenceScoreFirst Seen
Domainorbiixtrade.com
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domainvnwd.top
active scanafricaapk
Medium
58
Apr 23, 26
Domainalperu.top
c2intel-blogmalware
High
58
Oct 9, 26
SHA25639ea88f852b25d3c55d605464a3440bd250a577e3e21f52d1eaf94d15aad5b82
active scanafricaandroid
High
71
Apr 23, 26
IP38.47.52.4
c2intel-blogmalware
High
58
Oct 9, 26
Domainnmxgo.cc
exploitintel-blogmalware
High
58
Oct 9, 26
Domainngovbr.cc
active scanafricaapk
High
64
Apr 17, 26
SHA2564338ab77d05aeacd7eac5acbe9eed5568778c8e3e9499562816805b54b4d1a6a
abuse_ch_hashandroidantidot
High
74
Dec 30, 25
Domaingoogleplay.djppajakgoid.com
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domainimmigration-kr.net
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domaincedula-registraduria-gov.org
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domainopenbank-es.com
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domainsss.oiago.cc
exploitintel-blogmalware
High
58
Oct 9, 26
Domainidphil.net
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domainvsgo.cc
exploitintel-blogmalware
High
58
Oct 9, 26
Domainorgo.cc
active scanafricaapk
High
68
Apr 23, 26
Domainsafeapk.xyz
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domainalafrica.xyz
c2intel-blogmalware
High
58
Oct 9, 26
SHA2564fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc
active scanafricaandroid
High
68
Apr 17, 26
Domaindkhth.com
active scanafricaapk
High
64
Apr 17, 26
Domainavianca.sxjgo.cc
active scanafricaapk
High
66
Dec 11, 25
IP18.167.169.60
c2intel-blogmalware
High
58
Oct 9, 26
Domainegov.nbsvgo.cc
intel-blogmalwarenetwork
High
58
Oct 9, 26
Domainrycnair.com
intel-blogmalwarenetwork
High
58
Oct 9, 26
IP103.214.169.197
c2intel-blogmalware
High
58
Oct 9, 26
Domainlx-yindu.top
intel-blogmalwarenetwork
High
58
Oct 9, 26

IOC Relationship Graph

IOC Relationship Graph26 total IOCs
DomainSHA256IP
Domain20SHA2563IP3Actors1Malware1REPORTScams, Slaves and (MalwareRoyalRoyal
scroll to zoom · drag to pan · click IOC to open