Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE15 IOCs
Threat Actor Mr_Rot13 Actively Exploits CVE-2026-41940 for Backdoor Deployment
Diamond Model
Adversary
Infrastructure(2)
Capability
Victim
Indicators of Compromise
Indicators of Compromise15
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | fb1bc3f935fdeb3555465070ba2db33c aptespionagefile-hash | High | 56 | Oct 9, 26 |
| MD5 | 2286f126ab4740ccf2595ad1fa0c615c file-hashintel-blogmalware | High | 56 | Oct 9, 26 |
| MD5 | e49f68a363c867608972680799389daf file-hashindicatorintel-blog | High | 56 | Oct 9, 26 |
| MD5 | 02a5990b11293236e01f174f5999df20 file-hashintel-blogloader | High | 56 | Oct 9, 26 |
| MD5 | 22613c952459e65ce09fb6b5c1c03d47 file-hashindicatorintel-blog | High | 56 | Oct 9, 26 |
| URL | https://wrned.com/log.php?t=3 exfiltrationintel-blognetwork | High | 58 | Oct 9, 26 |
| MD5 | 29222f5e73dd10088fcf1204aa21f87f abuseabuse_ch_hashadministration | High | 84 | May 11, 26 |
| MD5 | 9305b4ebbb4d39907cf36b62989a6af3 file-hashintel-blogmalware | High | 56 | Oct 9, 26 |
| CVE | CVE-2026-41940 botnetexploitintel-blog | High | 69 | Jun 3, 26 |
| MD5 | 45fc93426cf08f91c9f9de5f04a12263 file-hashindicatorintel-blog | High | 56 | Oct 9, 26 |
| MD5 | bae1f1bce7c82fa86f05b12e2e254cfc file-hashintel-blogloader | High | 56 | Oct 9, 26 |
| MD5 | e1ec6ebb96cf87c785ee6a7da677c059 file-hashintel-blogloader | High | 56 | Oct 9, 26 |
| MD5 | 2de27ca8d97124adaf604b18161a441e abuseabuse_ch_hashadministration | High | 83 | May 11, 26 |
| MD5 | 711afb014f64c97d7b31685709c34ce7 file-hashindicatorintel-blog | High | 56 | Oct 9, 26 |
| URL | https://cp.dene.de.com/collect.php intel-blogmalwarenetwork | High | 58 | Oct 9, 26 |
IOC Relationship Graph
IOC Relationship Graph15 total IOCs
MD5URLCVE