IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE1 IOC

The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments

WI
Wiz
Published September 25, 2026Original Report

Threat Actors

Malware Families

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYDEV-0537PlayScattered SpiderINFRASTRUCTUREunknownCAPABILITYGh0st RATLinPEASLummaVICTIMunknown
Adversary(3)
Infrastructure
Capability(9)
Victim

Indicators of Compromise

Indicators of Compromise1

TypeIndicatorConfidenceScoreFirst Seen
CVECVE-2023-7028
exploitintel-blogloader
Medium
51
Oct 9, 26

IOC Relationship Graph

IOC Relationship Graph1 total IOCs
CVE
CVE1Actors3Malware5REPORTThe Infostealer Incursion:DEV-0537PlayScattered SpiderGh0st RATLinPEASLummaMETA StealerPlay
scroll to zoom · drag to pan · click IOC to open