IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Your Exposure
TLP:WHITE6 IOCs

Why Are You Texting Me? Unc3944 Leverages Sms Phishing Campaigns for Sim Swapping, Ransomware, Extortion, and Notoriety

OT
ORKL Threat Library
Original Report

Threat Actors

Malware Families

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYALPHVBRONZE UNIVERSITYBlackCatINFRASTRUCTUREhelpdesk.cominternal.comhelp.comCAPABILITYBlackCatImpacketMimikatzVICTIMunknown
Adversary(8)
Infrastructure(6)
Capability(6)
Victim

Indicators of Compromise

Indicators of Compromise6

TypeIndicatorConfidenceScoreFirst Seen
Domainhelpdesk.com
intel-blogmalwarenetwork
High
62
Jun 7, 26
Domaininternal.com
malwarenetworkphishing
High
67
Oct 16, 26
Domainhelp.com
malwarenetworkphishing
High
67
Oct 16, 26
Domainservicedesk.com
malwarenetworkphishing
High
67
Oct 16, 26
Domainsecretsdump.py
::keywords_error_mainabuseacademic institutions
Medium
66
Mar 11, 24
Domainsso.com
malwarenetworkphishing
High
67
Oct 16, 26

IOC Relationship Graph

IOC Relationship Graph6 total IOCs
Domain
Domain6Actors5Malware5REPORTWhy Are You Texting Me? UnALPHVBRONZE UNIVERSITYBlackCatEarth LuscaGOLD HARVESTBlackCatImpacketMimikatzPsExecSecretsDump
scroll to zoom · drag to pan · click IOC to open