Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE31 IOCs
The Job Offer Has Claws: Mirage Kitten Deploys NodeRabbit and PollCat
Threat Actors
Malware Families
Diamond Model
Adversary(34)
Infrastructure
Capability(41)
Victim
Indicators of Compromise
Indicators of Compromise31
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2023-1389 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2025-49704 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| SHA256 | 307ce2448211a5f5d122643f2a739aff33ede72c1858518c8de098f3148bbd00 file-hashintel-blogloader | Medium | 53 | Oct 9, 26 |
| CVE | CVE-2022-30190 exploitintel-blogloader | High | 77 | Jun 12, 26 |
| CVE | CVE-2025-0994 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2022-47986 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2025-55182 aptespionageexploit | High | 80 | Jun 2, 26 |
| CVE | CVE-2021-3493 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2023-34362 aptespionageexploit | High | 78 | Sep 3, 26 |
| CVE | CVE-2025-3248 botnetddosexploit | High | 79 | Jun 29, 26 |
| CVE | CVE-2025-53770 exploitintel-blogloader | High | 79 | Jun 12, 26 |
| CVE | CVE-2022-31199 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2021-21974 exploitintel-blogloader | High | 81 | Oct 9, 26 |
| CVE | CVE-2022-21894 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2025-49706 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| SHA256 | 123289b3680c1d693db0e3702137cc55862dbe8b9a34376bcdf08bd0514b98e7 exploitfile-hashintel-blog | Medium | 53 | Oct 9, 26 |
| CVE | CVE-2023-46604 exploitintel-blogloader | High | 78 | Aug 27, 26 |
| CVE | CVE-2021-4034 exploitintel-blogloader | High | 78 | Jun 2, 26 |
| CVE | CVE-2022-26134 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2023-2868 exploitintel-blogloader | High | 77 | Jun 2, 26 |
| CVE | CVE-2024-3400 aptespionageexploit | High | 79 | Jun 2, 26 |
| CVE | CVE-2023-22518 aptespionageexploit | High | 81 | Oct 9, 26 |
| CVE | CVE-2024-21412 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2021-33044 exploitintel-blogloader | High | 78 | Jul 30, 26 |
| CVE | CVE-2026-21509 aptespionageexploit | High | 79 | Jun 2, 26 |
| CVE | CVE-2017-7921 exploitintel-blogloader | High | 77 | Jun 3, 26 |
| CVE | CVE-2024-7344 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2023-36025 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2025-53771 exploitintel-blogloader | High | 81 | Oct 9, 26 |
| CVE | CVE-2024-40766 exploitintel-blogloader | High | 79 | Sep 9, 26 |
| CVE | CVE-2025-21042 exploitintel-blogloader | High | 77 | Oct 9, 26 |
IOC Relationship Graph
IOC Relationship Graph31 total IOCs
CVESHA256