IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE14 IOCs

Statistical Report on Malware Targeting Linux SSH Servers in the Third Quarter of 2026

AH
AhnLab
Published October 7, 2026Original Report

Threat Actors

Malware Families

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYPlayINFRASTRUCTURE103.157.217.38159.65.54.221http://177.22.88.133:…CAPABILITYMETA StealerMiraiPlayVICTIMunknown
Adversary(1)
Infrastructure(6)
Capability(4)
Victim

Indicators of Compromise

Indicators of Compromise14

TypeIndicatorConfidenceScoreFirst Seen
MD52a9e5e25776fff5430f2dd06335920a4
file-hashintel-blogmalware
Medium
53
Oct 14, 26
IP103.157.217.38
c2cryptominerddos
High
58
Oct 14, 26
IP159.65.54.221
cryptominerexploitintel-blog
High
58
Oct 14, 26
URLhttp://177.22.88.133:8080/.x/.sys/sys_users
cryptominerintel-blogmalware
High
58
Oct 14, 26
IP177.22.88.133
abusech-threatfox-c2cabusech-urlhaus-c2cactive scan
High
75
May 1, 26
URLhttp://13.71.2.244/.x/x
botnetcryptominerintel-blog
High
86
Sep 8, 26
MD55279c09bdabb12a3a28b0db8e838bf1b
cryptominerfile-hashintel-blog
Medium
53
Oct 14, 26
MD53df700b3c1d0ffab386397f4e59c5b23
cryptominerfile-hashintel-blog
Medium
53
Oct 14, 26
IP128.199.127.217
c2cryptominerddos
High
58
Oct 14, 26
URLhttp://13.71.2.244/.x/sys_users
cryptominerintel-blogmalware
High
58
Oct 14, 26
MD504f5d13f78ca2ab39a8f777885c2a474
botnetexploitfile-hash
High
85
Aug 30, 26
URLhttp://13.71.2.244/.x/pax.txt
cryptominerintel-blogmalware
High
58
Oct 14, 26
MD50e3d8bc69fe996dbd681c01f509e8591
exploitfile-hashintel-blog
Medium
53
Oct 14, 26
URLhttp://13.71.2.244/.x/xmrigroot.tgz
cryptominerintel-blogmalware
High
58
Oct 14, 26

IOC Relationship Graph

IOC Relationship Graph14 total IOCs
MD5IPURL
MD55URL5IP4Actors1Malware4REPORTStatistical Report on MalwPlayMETA StealerMiraiPlayXMRig
scroll to zoom · drag to pan · click IOC to open