IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE13 IOCs

Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer

HU
Huntress
Published October 8, 2026Original Report

Threat Actors

Malware Families

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYAkiraRoyalSandwormINFRASTRUCTURExmr.kryptex.network185.220.236.49104.234.26.10CAPABILITYAkiraCobalt StrikeImpacketVICTIMunknown
Adversary(4)
Infrastructure(6)
Capability(6)
Victim

Indicators of Compromise

Indicators of Compromise13

TypeIndicatorConfidenceScoreFirst Seen
SHA25605f69ae6b2b89c1c4dcf836bff032232f11bf0109f2b498e2345045d06139034
cryptominerfile-hashintel-blog
Medium
53
Oct 9, 26
CVECVE-2026-105133
exploitintel-blogmalware
Medium
51
Oct 9, 26
SHA2564dcb0202fe8b2d4d7b183764e38184cd6ed50132786cc7e7d1f7f4bce1dd6f3d
file-hashintel-blogmalware
Medium
53
Oct 9, 26
Domainxmr.kryptex.network
intel-blogmalwarenetwork
High
58
Oct 9, 26
IP185.220.236.49
intel-blogmalwarenetwork
High
58
Oct 9, 26
IP104.234.26.10
intel-blogmalwarenetwork
High
58
Oct 9, 26
CVECVE-2026-105134
exploitintel-blogmalware
Medium
51
Oct 9, 26
IP38.60.252.110
intel-blogmalwarenetwork
High
58
Oct 9, 26
IP51.195.127.124
cryptominerintel-blogmalware
High
58
Oct 9, 26
SHA256481728a7c9c4c02be07051d9c1958d902ea6397ebb8952ab83944818e3d25d21
exploitfile-hashintel-blog
Medium
53
Oct 9, 26
IP107.191.47.199
intel-blogmalwarenetwork
High
58
Oct 9, 26
IP177.4.12.11
intel-blogloadermalware
High
58
Oct 9, 26
IP123.202.208.37
intel-blogmalwarenetwork
High
58
Oct 9, 26

IOC Relationship Graph

IOC Relationship Graph13 total IOCs
SHA256CVEDomainIP
IP7SHA2563CVE2Domain1Actors4Malware5REPORTThreat Actors Exploit CritAkiraRoyalSandwormScattered SpiderAkiraCobalt StrikeImpacketMETA StealerRoyal
scroll to zoom · drag to pan · click IOC to open