Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE47 IOCs
Targeting the Systems Behind the Mission: OT Threats to US Critical Infrastructure and Military Operations
Threat Actors
Malware Families
Diamond Model
Adversary(35)
Infrastructure
Capability(41)
Victim
Indicators of Compromise
Indicators of Compromise47
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 8e1769763253594e32f2ade0f1c7bd139205275054c9f5e57fefd8142c75441f file-hashintel-blogloader | Medium | 53 | Oct 9, 26 |
| SHA256 | 8fa3e8fdbaa6ab5a9c44720de4514f19182adc0c9c6001c19cf159b79c0ae9c2 file-hashintel-blogloader | Medium | 53 | Oct 9, 26 |
| CVE | CVE-2023-1389 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| SHA256 | 726c2c2b35cb1adbe59039193030f23e552a28226ecf0b175ec5eba9dbcd336e file-hashintel-blogloader | Medium | 53 | Oct 9, 26 |
| SHA256 | 9a1f1c491274cf5e1ecce2f77c1273aafc43440c9a27ec17d63fa21a89e91715 file-hashintel-blogloader | Medium | 53 | Oct 9, 26 |
| CVE | CVE-2025-49704 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| SHA256 | 6036390a2c81301a23c9452288e39cb34e577483d121711b6ba6230b29a3c9ff file-hashintel-blogloader | Medium | 53 | Oct 9, 26 |
| SHA256 | fae9b6df2987b25d52a95d3e2572ea578f3599be88920c64fd2de09d1703890a file-hashintel-blogloader | Medium | 53 | Oct 9, 26 |
| CVE | CVE-2022-30190 exploitintel-blogloader | High | 77 | Jun 12, 26 |
| CVE | CVE-2018-0171 exploitintel-blogloader | Medium | 51 | Oct 9, 26 |
| CVE | CVE-2025-0994 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2022-47986 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| SHA256 | 1b39f9b2b96a6586c4a11ab2fdbff8fdf16ba5a0ac7603149023d73f33b84498 abuseaccountactive scan | High | 90 | Dec 7, 24 |
| SHA256 | 7e12ec75f0f2324464d473128ae04d447d497c2da46c1ae699d8163080817d38 file-hashintel-blogloader | Medium | 53 | Oct 9, 26 |
| SHA256 | 761075da6b30bb2bcbb5727420e86895b79f7f6f5cebdf90ec6ca85feb78e926 file-hashintel-blogloader | Medium | 53 | Oct 9, 26 |
| CVE | CVE-2025-55182 aptespionageexploit | High | 80 | Jun 2, 26 |
| CVE | CVE-2021-3493 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| SHA256 | e453e6efc5a002709057d8648dbe9998a49b9a12291dee390bb61c98a58b6e95 file-hashindicatorintel-blog | High | 56 | Oct 6, 26 |
| SHA256 | f4dd44bc19c19056794d29151a5b1bb76afd502388622e24c863a8494af147dd file-hashintel-blogloader | Medium | 53 | Oct 9, 26 |
| CVE | CVE-2023-34362 aptespionageexploit | High | 78 | Sep 3, 26 |
| CVE | CVE-2025-3248 botnetddosexploit | High | 79 | Jun 29, 26 |
| SHA256 | 9e5f9dcb5f17efdca727b7b13a5f9ecd3296d28ac10e3675259b660d62739b87 file-hashintel-blogloader | Medium | 53 | Oct 9, 26 |
| CVE | CVE-2025-53770 exploitintel-blogloader | High | 79 | Jun 12, 26 |
| CVE | CVE-2022-31199 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2021-21974 exploitintel-blogloader | High | 81 | Oct 9, 26 |
| SHA256 | 3fe9214b33ead5c7d1f80af469593638b9e1e5f5730a7d3ba2f96b6b555514d4 file-hashintel-blogloader | Medium | 53 | Oct 9, 26 |
| CVE | CVE-2022-21894 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2025-49706 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| SHA256 | 3e9fc13fab3f8d8120bd01604ee50ff65a40121955a4150a6d2c007d34807642 file-hashintel-blogloader | Medium | 53 | Oct 9, 26 |
| SHA256 | 20215acd064c02e5aa6ae3996b53f5313c3f13625a63da1d3795c992ea730191 file-hashintel-blogloader | Medium | 53 | Oct 9, 26 |
| CVE | CVE-2023-46604 exploitintel-blogloader | High | 78 | Aug 27, 26 |
| CVE | CVE-2021-4034 exploitintel-blogloader | High | 78 | Jun 2, 26 |
| CVE | CVE-2022-26134 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2023-2868 exploitintel-blogloader | High | 77 | Jun 2, 26 |
| SHA256 | 3e4bb8089657fef9b8e84d9e17fd0d7740853c4c0487081dacc4f22359bade5c file-hashintel-blogloader | Medium | 53 | Oct 9, 26 |
| CVE | CVE-2024-3400 aptespionageexploit | High | 79 | Jun 2, 26 |
| SHA256 | eaef901b31b5835035b75302f94fee27288ce46971c6db6221ecbea9ba7ff9d0 file-hashintel-blogloader | Medium | 53 | Oct 9, 26 |
| CVE | CVE-2023-22518 aptespionageexploit | High | 81 | Oct 9, 26 |
| CVE | CVE-2024-21412 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2021-33044 exploitintel-blogloader | High | 78 | Jul 30, 26 |
| CVE | CVE-2026-21509 aptespionageexploit | High | 79 | Jun 2, 26 |
| CVE | CVE-2017-7921 exploitintel-blogloader | High | 77 | Jun 3, 26 |
| CVE | CVE-2024-7344 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2023-36025 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2025-53771 exploitintel-blogloader | High | 81 | Oct 9, 26 |
| CVE | CVE-2024-40766 exploitintel-blogloader | High | 79 | Sep 9, 26 |
| CVE | CVE-2025-21042 exploitintel-blogloader | High | 77 | Oct 9, 26 |
IOC Relationship Graph
IOC Relationship Graph47 total IOCs
SHA256CVE