Vigil

Daily Intelligence Brief

0 Critical CVEs (7d) — same

0 New KEVs Today — no urgent patches

0 Ransomware Victims Today — same

0 New IOCs Today — same

0 APT Campaigns Today — same

Ransomware
Victims
Last 90 days

Priority Threats

VULNERABILITY 10.0 CVSS

CVE-2026-4370 — Unknown Unknown

A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4.0.4, where the internal Dqlite database cluster fails to per…

Also: CVE-2026-34162 (CVSS 10.0), CVE-2025-15379 (CVSS 10.0)

RANSOMWARE 21 victims / 7d

thegentlemen

Targeting: Transportation/Logistics (4 incidents) · Energy (2 incidents) · Business Services (2 incidents)

APT CAMPAIGN 14 IOCs

The Crown Prince, Nezha

Top Targeted Sector (30d)

Business Services

Manufacturing

Technology

Consumer Services

Healthcare

Top Targeted Countries (30d)

118

Live Feed Last 24 hours

No events in the last 24 hours yet.
Data refreshes every 30 minutes.

Active IOC Feed

IOC Value	Type	Malware / Family	Threat Type	Source	Confidence	First Seen	Ref
`908ba87316fb65dd8a155177d53343bd19a2a0c99ff5d92a18c785a2746ff8ec`	sha256	Mirai	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`e3d5a0c97327eb83b2674aac333131cb1030f4256f12b4ea31244f4fe112d874`	sha256	Mirai	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`623fc73d98e3105411b49ae20573da2991faa73f5586c0dd0255f48d85d596ea`	sha256	Mirai	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`83ed44068b1fec44e77dded6511f9f308b2d818c78780a0cb6ded293bcf88e8e`	sha256	js	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`b27070a8cea93bd95ce8dc3e70a69391138f030bc8e48927bcd16d87e492b67a`	sha256	js	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`9151cf8957119d6549bfb4308e5f281263e7fbff2874f2d6f1847eac2dc1b556`	sha256	elf	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`4d032532f4bfee05049fd3fba048a8da88936e4259be0fe9d8457ae05a68ecfe`	sha256	Mirai	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`aac0d088885a088e627c59514f90b485c874551e9dfb006adbb534acd3b57ad3`	sha256	Mirai	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`1b9c73c1e4dfc4643ac50d78af99963e0adc9e28ca35cb5f38fbb01293ee40a2`	sha256	Mirai	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`595d02ea8d59413eeed0c093b6b051a9f226da3d1d86bd0a03c956d58fa9c870`	sha256	elf	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`29f5392bfbad0ee2111af3f4cc1e0ecd605e1019131bb25c99b325a036e3b86c`	sha256	Mirai	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`http://110.36.4.89:53768/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://42.239.157.9:55135/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`64.89.162.178:7007`	ip:port	win.xworm	botnet_cc	ThreatFox	75%	2026-07-08	🔗
`abadi136.net`	domain	unknown_stealer	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`abenegihugu.com`	domain	unknown_stealer	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`accidentclinic.miami`	domain	unknown_stealer	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`adalyametal.com`	domain	unknown_stealer	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`2leap.es`	domain	unknown_stealer	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`24cart.store`	domain	unknown_stealer	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`114.132.150.96:8080`	ip:port	unknown	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`82cb5dfe51d3f66119dcb4340b4fabef0ce6a2a4da226f89be1b85443aa2ea24`	sha256	elf	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`7b118c32e261265adfa19e811de28f0c8be1593762c98bf8a74626c7345d2817`	sha256	elf	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`1bdeb2287faa1145ae1b4aae2bf6049f428ae5565b929a3b3273582e2e854d62`	sha256	Mirai	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`284189d1927f940980ba488c7472a8874e0bac8fd98dc3ae474a68b96a537ed0`	sha256	Mirai	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`412cae438376a34129cd05ba25556a3579516b0fd6a956a42f48691ed3f26461`	sha256	Mirai	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`9a618a6a73d274ac9102c388f4f1ec303abce082e99cbd49a542d1609bac4931`	sha256	Mirai	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`cfa38f49fe074831b13faa8b95662767f5108f55c57de98512e08eed67b3b17b`	sha256	Mirai	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`5e6ab3489eb358e76a853602e8d9aa4f928925cb2a37e007d03c1b4bccfbaeb0`	sha256	Mirai	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`fb8afadcb109f815b834768b1242515dabcdf209cd7973fd1be1360f2480d18b`	sha256	Mirai	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`1183ad0536c58299e6a80001a466be358d596fc9d130bd2112cb25b957d784da`	sha256	Mirai	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`5e92efef58c946c74179eabcb0b4b91a767fa6367c5344fe3bdf4a985d38bd22`	sha256	Mirai	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`2a5585d256e92580fb2752fcfddc0a7d9b31256a72006e78e99795c5236301db`	sha256	exe	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`http://162.255.251.91:33439/i`	url	32-bit, arm, elf, Mozi	malware_download	URLhaus	—	2026-07-08
`http://220.135.42.30:53519/i`	url	32-bit, arm, elf, mirai, Mozi	malware_download	URLhaus	—	2026-07-08
`http://163.142.95.89:43256/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://45.90.163.37/GOONGANGONTOP/i486`	url	elf, mirai, opendir, ua-wget	malware_download	URLhaus	—	2026-07-07
`9481dbfb659113e977977f4872d9e620a83a5811fdc30fc4054495fe48cdbcbe`	sha256	zip	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`2a57354f1393e07c42b82322d2b18ee2c6da7b18212db5788c94f857e4cfe121`	sha256	exe	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`cafa5753b4471a613cb44cd88fc36b9acef511509bf85f76940a2813808fc691`	sha256	zip	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`918c42d88be3dd369ddf630867901eaec3a90f1e833d486a2a1ecff6879bd8af`	sha256	exe	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`75e7bfed5d9087512862794295b14258bab7a853b100f093804c92080cd69f98`	sha256	exe	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`5cd69a8d537df27c9ffe4ea201bf72dc98b55f2e2466b82b79fa6cb8b957b396`	sha256	exe	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`4a72842ff25b47bc912714046a833ace69d6cb68f8f2be8d65a6421c4a9cc5a1`	sha256	exe	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`0255ae1616eec19d9b97440779b34a01602bb933699816121d705c069974c7db`	sha256	exe	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`ba1584ade44b7285a92de901daca752a433e8411c1efd6dfabd716ce737d10e0`	sha256	exe	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`http://115.63.230.109:35501/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://5.167.229.94:27250/i`	url	—	malware_download	URLhaus	—	2026-07-08
`http://61.52.61.209:54559/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://123.9.104.69:34901/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://110.36.4.89:53768/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://162.255.251.91:33439/bin.sh`	url	32-bit, arm, elf, mirai, Mozi	malware_download	URLhaus	—	2026-07-08
`https://kaloed.pro/1e523332.exe`	url	—	malware_download	URLhaus	—	2026-07-08
`http://123.9.104.69:34901/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://220.135.42.30:53519/bin.sh`	url	32-bit, arm, elf, mirai, Mozi	malware_download	URLhaus	—	2026-07-08
`http://60.176.4.229:58811/i`	url	mirai	malware_download	URLhaus	—	2026-07-08
`http://182.124.126.196:40819/i`	url	Mozi	malware_download	URLhaus	—	2026-07-08
`http://91.92.242.236/files-129312398/files/file_b66749d846629102.exe`	url	54e64e, dropped-by-amadey	malware_download	URLhaus	—	2026-07-08
`http://39.73.108.18:46667/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://105.224.33.217:41583/i`	url	32-bit, arm, elf, mirai, Mozi	malware_download	URLhaus	—	2026-07-08
`http://42.238.254.190:33907/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://60.176.4.229:58811/bin.sh`	url	mirai	malware_download	URLhaus	—	2026-07-08
`http://105.224.33.217:41583/bin.sh`	url	32-bit, arm, elf, mirai, Mozi	malware_download	URLhaus	—	2026-07-08
`http://123.12.240.37:49403/i`	url	—	malware_download	URLhaus	—	2026-07-08
`http://91.92.242.236/files-129312398/files/file_55c1b708fcd2591a.exe`	url	9d2ca3, dropped-by-amadey	malware_download	URLhaus	—	2026-07-08
`http://42.232.228.31:53154/bin.sh`	url	Mozi	malware_download	URLhaus	—	2026-07-08
`http://42.238.254.190:33907/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://110.39.238.66:42378/i`	url	—	malware_download	URLhaus	—	2026-07-08
`http://123.12.240.37:49403/bin.sh`	url	—	malware_download	URLhaus	—	2026-07-08
`http://61.52.47.54:36456/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://91.92.242.236/files-129312398/files/file_a412f485ab9549f8.exe`	url	9d2ca3, dropped-by-amadey, SalatStealer	malware_download	URLhaus	—	2026-07-08
`http://109.236.44.113:54968/i`	url	mirai	malware_download	URLhaus	—	2026-07-08
`http://216.126.86.26:36797/i`	url	32-bit, arm, elf, mirai, Mozi	malware_download	URLhaus	—	2026-07-08
`http://110.37.102.129:42317/i`	url	32-bit, arm, elf, mirai, Mozi	malware_download	URLhaus	—	2026-07-08
`http://109.236.44.113:54968/bin.sh`	url	32-bit, arm, elf, mirai, Mozi	malware_download	URLhaus	—	2026-07-08
`http://27.153.196.115:50179/bin.sh`	url	32-bit, arm, elf, mirai, Mozi	malware_download	URLhaus	—	2026-07-08
`http://123.4.238.122:50867/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://188.19.147.138:45305/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://42.231.91.217:53883/i`	url	—	malware_download	URLhaus	—	2026-07-08
`http://188.19.147.138:45305/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://123.7.226.252:39722/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://182.127.4.27:43671/bin.sh`	url	Mozi	malware_download	URLhaus	—	2026-07-08
`http://110.37.65.212:34828/i`	url	mirai	malware_download	URLhaus	—	2026-07-08
`http://103.19.49.134:50928/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://112.240.206.31:53993/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://105.225.113.253:36827/i`	url	32-bit, arm, elf, mirai, Mozi	malware_download	URLhaus	—	2026-07-08
`http://110.37.65.212:34828/bin.sh`	url	mirai	malware_download	URLhaus	—	2026-07-08
`http://105.225.113.253:36827/bin.sh`	url	32-bit, arm, elf, mirai, Mozi	malware_download	URLhaus	—	2026-07-08
`http://115.48.14.97:44539/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://61.53.206.243:54006/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://61.52.78.136:39827/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://182.123.245.187:35967/i`	url	Mozi	malware_download	URLhaus	—	2026-07-08
`https://verify.hashtopoils.org/verify_amd`	url	—	malware_download	URLhaus	—	2026-07-08
`https://verify.hashtopoils.org/verify_arm`	url	—	malware_download	URLhaus	—	2026-07-08
`http://91.92.242.236/files-129312398/files/file_da8de9dae556667a.exe`	url	c2-monitor-auto, dropped-by-amadey	malware_download	URLhaus	—	2026-07-08
`http://115.48.14.97:44539/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://61.52.78.136:39827/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://112.240.206.31:53993/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://182.123.245.187:35967/bin.sh`	url	Mozi	malware_download	URLhaus	—	2026-07-08
`http://125.44.217.16:45814/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://130.0.44.29:48255/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://123.7.226.252:39722/i`	url	Mozi	malware_download	URLhaus	—	2026-07-08
`http://218.59.14.73:36944/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://115.50.69.1:59335/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://218.59.14.73:36944/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://113.190.61.94:29420/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://42.235.181.25:38851/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://113.190.61.94:29420/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://105.186.143.79:49489/bin.sh`	url	32-bit, arm, elf, mirai, Mozi	malware_download	URLhaus	—	2026-07-08
`http://42.235.181.25:38851/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://27.207.228.158:46589/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://163.142.92.59:56422/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://200.112.129.57:42371/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://182.116.51.13:39041/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://222.136.52.228:56020/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://200.112.129.57:42371/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://182.127.4.27:43671/i`	url	Mozi	malware_download	URLhaus	—	2026-07-08
`http://222.141.122.76:43722/i`	url	Mozi	malware_download	URLhaus	—	2026-07-08
`http://108.170.136.155:37272/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://42.224.89.156:57932/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://42.224.89.156:57932/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://105.186.143.79:49489/i`	url	32-bit, arm, elf, mirai, Mozi	malware_download	URLhaus	—	2026-07-08
`http://163.142.95.89:43256/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://123.14.219.127:41338/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://218.61.126.54:57066/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://123.11.77.40:40335/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://123.14.219.127:41338/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://175.147.243.250:35517/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://112.93.137.16:35671/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://223.10.4.70:55867/bin.sh`	url	32-bit, arm, elf, mirai, Mozi	malware_download	URLhaus	—	2026-07-08
`http://123.5.158.194:57168/bin.sh`	url	Mozi	malware_download	URLhaus	—	2026-07-08
`http://163.142.93.90:45440/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://83.219.1.198:42561/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://123.8.55.58:53035/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://5.175.192.197/bot_x86_64`	url	5-175-192-197, elf, mirai	malware_download	URLhaus	—	2026-07-08
`http://182.127.112.76:42224/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-07
`https://t08.kataksm188.top/`	url	win.vidar	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`t08.omni-signage.com`	domain	win.vidar	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`https://t08.omni-signage.com/`	url	win.vidar	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`t08.kataksm188.top`	domain	win.vidar	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`gtv6eszx.riskybet.casino`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`mouvwpcv.riskybet.casino`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`riskybet.casino`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`https://potty.com/`	url	js.iclickfix	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`159.203.1.105:9035`	ip:port	elf.aisuru	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`https://tommy-q.lol/o`	url	js.kongtuke	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`tommy-q.lol`	domain	js.kongtuke	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`152.42.214.91:8443`	ip:port	elf.aisuru	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`noveuam.top`	domain	unknown	botnet_cc	ThreatFox	75%	2026-07-08	🔗
`abitarix.top`	domain	unknown	botnet_cc	ThreatFox	75%	2026-07-08	🔗
`e0d1e9dbfb7ee326cc6152ac810d7835cb1f2cd2031e3d8ba83e3777e18bd755`	sha256_hash	unknown	payload	ThreatFox	75%	2026-07-08	🔗
`nubeauty.co`	domain	unknown_stealer	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`topontmosser.be`	domain	unknown_stealer	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`gtm-helper.xyz`	domain	unknown_loader	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`recap-cha.xyz`	domain	unknown_loader	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`jrudq.ganj.bet`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`blhs.20sport.ir`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`mbifcxdz.careeriran.ir`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`ganj.bet`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`20sport.ir`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`careeriran.ir`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`betwinner.poker`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`9c8c0b26c1ac72688e0f1a5d43ddcf16cb2726e2`	sha1_hash	elf.kuiper	payload	ThreatFox	95%	2026-07-08	🔗
`84e114db07c2fbe9225d08bc856ed52f`	md5_hash	elf.kuiper	payload	ThreatFox	95%	2026-07-08	🔗
`a237210c342b24325ac4cae7977613a85966c8b1`	sha1_hash	elf.kuiper	payload	ThreatFox	95%	2026-07-08	🔗
`16f2b00efb6012eddafdabaf21f7e7ff`	md5_hash	elf.kuiper	payload	ThreatFox	95%	2026-07-08	🔗
`fdf03609a12b2535488e008293cd89d596f967af96d7763b880ee1ffd8702630`	sha256_hash	elf.kuiper	payload	ThreatFox	95%	2026-07-08	🔗
`7c0f9f1375d685ec9a30c2e1a5cf7817`	md5_hash	win.netwire	payload	ThreatFox	95%	2026-07-08	🔗
`07e019e4309cd2d20874488411df839728fbda0b580c6f09a72c99f4d873f931`	sha256_hash	elf.kuiper	payload	ThreatFox	95%	2026-07-08	🔗
`b62119f0ae9ad41612f252dd703799d4`	md5_hash	win.netwire	payload	ThreatFox	95%	2026-07-08	🔗
`60c730addd2a15e4213a1d37f55186686976de73a106317b5a258fe0121cfd5c`	sha256_hash	win.netwire	payload	ThreatFox	95%	2026-07-08	🔗
`4dd9e00b51b94a5c9dda104f9cc9d5887cfa6819`	sha1_hash	win.netwire	payload	ThreatFox	95%	2026-07-08	🔗
`897a9a38ebc67beb0775184520c8ce3b0bec04e5`	sha1_hash	win.netwire	payload	ThreatFox	95%	2026-07-08	🔗
`57d20ed65870aa249ca374142d763d13`	md5_hash	win.netwire	payload	ThreatFox	95%	2026-07-08	🔗
`dc8b056dd6eb75df21e9721ac2e340f91bb5e94d5a6ff412d7d0c7539e0f06e2`	sha256_hash	win.netwire	payload	ThreatFox	95%	2026-07-08	🔗
`a54e21752a34a4663cef87b75efe74be139a2c8e`	sha1_hash	win.netwire	payload	ThreatFox	95%	2026-07-08	🔗
`e2ffa36e0a8661af0695eb11fe11ae21aca77367`	sha1_hash	win.njrat	payload	ThreatFox	95%	2026-07-08	🔗
`75f68d369e48fba33a4d53d45f32a6c6`	md5_hash	win.njrat	payload	ThreatFox	95%	2026-07-08	🔗
`433b61c29aefaa5b55fe78063e6ad8597d3835f36e1242d5402ab23e6dc61194`	sha256_hash	win.netwire	payload	ThreatFox	95%	2026-07-08	🔗
`0b64e89c66e5f0f93b164967c738949d7521002f`	sha1_hash	win.agent_tesla	payload	ThreatFox	95%	2026-07-08	🔗
`6e9cd29d317d6f0251aba016f04ea281`	md5_hash	win.agent_tesla	payload	ThreatFox	95%	2026-07-08	🔗
`3f434324ac709227290512410977bca99eb164fc86cae6f22cd4844eb9eb9130`	sha256_hash	win.njrat	payload	ThreatFox	95%	2026-07-08	🔗
`f5088b617e231c7ea495c78deb83813dd5f98ef6`	sha1_hash	win.stealc	payload	ThreatFox	95%	2026-07-08	🔗
`fe2226cdeb007a5b1f5aa13e042d9b11`	md5_hash	win.stealc	payload	ThreatFox	95%	2026-07-08	🔗
`ec8642b8f9d76743c3d9b65f2496f41ba136ff4f1ccfbe4069d494e6a3e579f3`	sha256_hash	win.agent_tesla	payload	ThreatFox	95%	2026-07-08	🔗
`f5d8c56c2b66818eba0bacd35be33b2d2069ff3e28befe67dd4ca17b675b7b27`	sha256_hash	win.njrat	payload	ThreatFox	95%	2026-07-08	🔗
`04ed410e130bba2e28e7fc5e921ee6820547c31f`	sha1_hash	win.njrat	payload	ThreatFox	95%	2026-07-08	🔗
`97960cb546365a3a320fd26dac47d10e`	md5_hash	win.njrat	payload	ThreatFox	95%	2026-07-08	🔗
`c4ce7dd05a3865b7d16a33adc9fa57d15a221abb83cb57fad43e947bc0a17eb1`	sha256_hash	win.stealc	payload	ThreatFox	95%	2026-07-08	🔗
`da483f0d56aabc55d45b170c4f605c97c722b3c2400cc6a5643a45f116121258`	sha256_hash	py.venus_stealer	payload	ThreatFox	95%	2026-07-08	🔗
`8c148fad9feaa0b196989b83eeaed9334083e221`	sha1_hash	py.venus_stealer	payload	ThreatFox	95%	2026-07-08	🔗
`55b80c0bb297e1cdbd85530c30c6d723`	md5_hash	py.venus_stealer	payload	ThreatFox	95%	2026-07-08	🔗
`06f915bc056a74c1c9b6faa3098a700ef4e5f54b8b1e84f73c70dcc6f5096949`	sha256_hash	win.arkei_stealer	payload	ThreatFox	95%	2026-07-08	🔗
`73a97de7a2edda2419f060567ecd07ecc6b9b89e`	sha1_hash	win.arkei_stealer	payload	ThreatFox	95%	2026-07-08	🔗
`32ba76496cf54bf0c9302e6ddab64cd9`	md5_hash	win.arkei_stealer	payload	ThreatFox	95%	2026-07-08	🔗
`86f77feba22ad9641d9464ac07c0fc4c2657f62cf02b85bdb50a192980265ebf`	sha256_hash	win.vidar	payload	ThreatFox	95%	2026-07-08	🔗
`c43ca244dc9905ea3260dff1e7c9414dc3890b37`	sha1_hash	win.vidar	payload	ThreatFox	95%	2026-07-08	🔗
`c6da85645488cfbb1120310f837f7fc7`	md5_hash	win.vidar	payload	ThreatFox	95%	2026-07-08	🔗
`lddwegnb.ketabworld.ir`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`ketabworld.ir`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`107.172.20.215:8080`	ip:port	unknown	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`113.44.90.0:443`	ip:port	unknown	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`107.172.20.215:80`	ip:port	unknown	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`rcodtjdj.melbetiran.bet`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`aafnojwq.megashart.blog`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`104.225.149.151:8080`	ip:port	unknown	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`104.225.149.151:80`	ip:port	unknown	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`104.225.149.151:443`	ip:port	unknown	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`103.215.81.156:8080`	ip:port	unknown	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`160.20.109.47:8090`	ip:port	win.dcrat	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`etorvugt.betsher.casino`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`wrov.betfa.download`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`4lbsgx9v.powershart.com`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`89g5nu0q.powershart.com`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`drvepxdy.milioner.bet`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`instnhvy.melbetiran.bet`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`melbetiran.bet`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`metabluefire.dexispointnexus.garden`	domain	js.clearfake	botnet_cc	ThreatFox	90%	2026-07-08	🔗
`103.236.92.210:80`	ip:port	unknown	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`103.236.92.210:8080`	ip:port	unknown	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`103.236.92.210:443`	ip:port	unknown	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`obds.betsher.casino`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`dpbp.betsher.casino`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`xclparsl.megashart.blog`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`megashart.blog`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`159.203.1.105:9034`	ip:port	elf.aisuru	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`https://fraitas.lol/api/v1/status`	url	js.kongtuke	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`165.232.169.49:8443`	ip:port	elf.aisuru	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`122.51.221.207:8080`	ip:port	win.cobalt_strike	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`2.50.157.201:8808`	ip:port	win.asyncrat	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`122.51.221.207:443`	ip:port	win.cobalt_strike	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`152.42.174.192:8080`	ip:port	win.adaptix_c2	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`9c8joror.melbetir.app`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`melbetir.app`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`rmwj.betfa.download`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`120.205.80.152:8443`	ip:port	elf.aisuru	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`betfa.download`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`https://azevedo.lol/api/v1/status`	url	js.kongtuke	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`https://microcrypt1987.com/update/package`	url	js.kongtuke	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`microcrypt1987.com`	domain	js.kongtuke	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`img-slow.alternativesynergies.com`	domain	js.fakeupdates	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`8n2r77nt.app888starz.download`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`app888starz.download`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`zqjjyamd.megaparifarsi.com`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`hostfastland.mivonflowsrv.garden`	domain	js.clearfake	botnet_cc	ThreatFox	90%	2026-07-08	🔗
`megaparifarsi.com`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`117.72.181.104:8080`	ip:port	win.cobalt_strike	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`117.72.181.104:80`	ip:port	win.cobalt_strike	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`152.42.174.192:80`	ip:port	win.adaptix_c2	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`23.227.199.61:80`	ip:port	win.adaptix_c2	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`158.160.75.185:43291`	ip:port	win.njrat	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`cabv.bet24.casino`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`rieo.bet24.casino`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`217.60.195.113:80`	ip:port	elf.mirai	payload_delivery	ThreatFox	75%	2026-07-08	🔗
`mancityiran.club`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`sjgejs29.itsport.ir`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`itsport.ir`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`13.204.46.27:5173`	ip:port	win.overlord	botnet_cc	ThreatFox	75%	2026-07-08	🔗
`144.31.62.81:8080`	ip:port	win.adaptix_c2	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`107.172.140.187:80`	ip:port	win.adaptix_c2	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`107.172.140.187:8080`	ip:port	win.adaptix_c2	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`144.31.62.81:80`	ip:port	win.adaptix_c2	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`101.33.202.134:80`	ip:port	win.adaptix_c2	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`120.205.80.152:34567`	ip:port	elf.aisuru	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`acesgaragesanjose.com`	domain	unknown	payload_delivery	ThreatFox	75%	2026-07-08	🔗
`emtd.bcgame90.casino`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`agvw.bcgame90.casino`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`hzfe.mellbeet.com`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`mpv5bjr9.yasbet.co`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`94fngygd.yasbet.co`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`bleu2zeit8zone.mivonflowsrv.garden`	domain	js.clearfake	botnet_cc	ThreatFox	90%	2026-07-08	🔗
`mon.kawahsm188.top`	domain	win.vidar	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`https://mon.kawahsm188.top/`	url	win.vidar	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`mon.kataksm188.top`	domain	win.vidar	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`https://mon.kataksm188.top/`	url	win.vidar	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`https://saisrls.it/`	url	win.vidar	payload_delivery	ThreatFox	75%	2026-07-08	🔗
`dcaxdwoo.barcelona11.com`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`ztop.hazzaratbet.com`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`1ca17239f5bec17ef244fc55357c6d0560337d7cadd1bb61574ab010f14a8d14`	sha256_hash	unknown	payload	ThreatFox	100%	2026-07-08	🔗
`830a22ea4eb2ebb8c60c7731fa5175d3a315d023a812aea40147326cc4c8a4dd`	sha256_hash	unknown	payload	ThreatFox	100%	2026-07-08	🔗
`91.92.240.100:53`	ip:port	unknown	botnet_cc	ThreatFox	75%	2026-07-08	🔗
`https://pub-1f5a501a59d74a6a97e77126cf1fc526.r2.dev/dcaczhjitqazbalk.exe`	url	unknown	payload_delivery	ThreatFox	75%	2026-07-08	🔗
`https://qgypyyvvzeouq.mospoqkzvk.com/d/cani`	url	unknown	payload_delivery	ThreatFox	75%	2026-07-08	🔗
`https://qgypyyvvzeouq.mospoqkzvk.com/s/psc2`	url	unknown	payload_delivery	ThreatFox	75%	2026-07-08	🔗
`qgypyyvvzeouq.mospoqkzvk.com`	domain	unknown	payload_delivery	ThreatFox	75%	2026-07-08	🔗
`92429d9ab6518c2d0aca85f1e337a607c861d81445d2a56b027555824dc1fd4f`	sha256	exe	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`a8877412d22348aafce79060d9f8578a94ec9adcf07dcea615735bf664370753`	sha256	Mirai	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`e97e92cd7f069edb07be58a78c2747d458256a120b0635a0b3ad4d159fcf3d92`	sha256	Mirai	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`ede4b155ce8f2c65614c0abda1797bfe3fec8bd78a2ff1a7031d28fbfd4b15ea`	sha256	Mirai	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`f9c6900e015c0e9f5b4d57ff7fa3cd936f1fbf2a5fb08c2ab1a76723538bf692`	sha256	Mirai	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`9e53b8b2bed292c433480ddd989f4a693893a971c67dbf13174adc0b09780f4f`	sha256	sh	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`0563bc585570d57435df9d6b5090967fb3ec128e269a658402775acc00455af1`	sha256	sh	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`dd3b199d255a5f35da02e170f840207ec1b0ce60425a3344bba4da47bfddcfee`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`d85d164e46fabb085609f2586e8fec364539a6ec81f74659f0cb28ac76e7880b`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`c96ddbdab5bbe445d8f3604daca62b80541ece02cc874c338146965e4820a595`	sha256	js	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`http://187.121.141.137:59432/i`	url	32-bit, arm, elf, Mozi	malware_download	URLhaus	—	2026-07-08
`http://77.247.88.83:46373/bin.sh`	url	32-bit, arm, elf, mirai, Mozi	malware_download	URLhaus	—	2026-07-08
`http://219.156.60.141:46448/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://110.39.239.253:40635/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://91.92.40.118/kworkerd-netns-rt`	url	elf, mips, mirai, ua-wget	malware_download	URLhaus	—	2026-07-08
`http://94.154.43.22/arm5`	url	arm, elf, mirai, ua-wget	malware_download	URLhaus	—	2026-07-07
`fezk.polbaz.bet`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`nqwr.polbaz.bet`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`39.105.200.188:8080`	ip:port	win.cobalt_strike	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`49.234.198.180:80`	ip:port	win.cobalt_strike	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`39.106.113.249:80`	ip:port	win.cobalt_strike	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`139.226.191.149:2082`	ip:port	win.cobalt_strike	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`origin-al.org`	domain	unknown	payload_delivery	ThreatFox	75%	2026-07-08	🔗
`sallyflint.com`	domain	unknown	payload_delivery	ThreatFox	75%	2026-07-08	🔗
`infobpi.pl`	domain	unknown	payload_delivery	ThreatFox	75%	2026-07-08	🔗
`cdn-79fe96.cloudflareinsight.com`	domain	unknown	botnet_cc	ThreatFox	75%	2026-07-08	🔗
`cdn-d57299.cloudflareinsight.com`	domain	unknown	botnet_cc	ThreatFox	75%	2026-07-08	🔗
`cdn-a085f7.cloudflareinsight.com`	domain	unknown	botnet_cc	ThreatFox	75%	2026-07-08	🔗
`cdn-b1192b.cloudflareinsight.com`	domain	unknown	botnet_cc	ThreatFox	75%	2026-07-08	🔗
`https://88.99.120.224`	url	win.vidar	botnet_cc	ThreatFox	75%	2026-07-08	🔗
`edcc2ad793e6c3def42d16dfefaff86dd1dbbc479b3e406405960438432fc0cd`	sha256	AgentTesla	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`ad8657d3235485efd37d9b91ba0254f93a72e206bf45ed49fffe00aa3fc010be`	sha256	elf	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`ironhausflow.mivonflowsrv.garden`	domain	js.clearfake	botnet_cc	ThreatFox	90%	2026-07-08	🔗
`desecq.shop`	domain	win.remus	botnet_cc	ThreatFox	75%	2026-07-08	🔗
`tiduflxx.farsi1xbet.shop`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`farsi1xbet.shop`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`47.96.254.114:80`	ip:port	win.cobalt_strike	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`47.96.254.114:8080`	ip:port	win.cobalt_strike	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`47.116.57.211:8080`	ip:port	win.cobalt_strike	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`47.116.57.211:80`	ip:port	win.cobalt_strike	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`39.106.80.126:80`	ip:port	win.cobalt_strike	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`http://144.31.57.70/c0e070fa9435429c8ea5.php`	url	win.stealc	botnet_cc	ThreatFox	100%	2026-07-08	🔗
`srgq.icebet90.com`	domain	js.clearfake	payload_delivery	ThreatFox	100%	2026-07-08	🔗
`38917247ac41fae313ded776f64b0380068e117ddc412a256bcd313279fd45d0`	sha256	exe	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`550eda8ed1c8777c02d4144c3602e0e078a95afa5df66d7284d2a8441cdd0751`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`f1e5b38ba51f3d5a333e21922335c07177338d65ba842d4b682bb6f9d1b6d02e`	sha256	Vidar	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`3625de02e6d829a337ce865c719c078466c7aff8c89e9b88384fbcd9003b918f`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`0b352d3e66ec7b97e9d26a04d625f1cbafaa31376f753c6beba1d42af01ac504`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`3e2e9ca2f1ad47e319d7960802297e97cde7624648ac8d0a04c522fa0a612f64`	sha256	Vidar	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`f6126eefa85ebab83ec702eaf0871350409b526a579ea9086aa3daddc09e46d7`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`d0cbfa367dd44966ca3646fc28c613c152704bd145e4ac99212782600e96eb52`	sha256	Vidar	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`195231de9197a9283f11ca7e731120b5694a034fc498a255e98b2827320595cd`	sha256	Vidar	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`7f5004c33185df5e036ed42d6d3e2f7933081a562a1ec3795ac173b968383b80`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`ca8b44bf1765547ffb92d3dec240b3ec0c7f07f74128faf8436a87661c53ab4b`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`b9f4913add84ff01bec5f0f238e719b5128b7efc578118c5fac4f881fb97167c`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`7a725b6b4151e23675f5cfc9d8077f83f3a7d837f2615ee6646461f0d21b7cf8`	sha256	Vidar	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`6097d600120da31c7cfcaf07aff76c07a75a5c942d9c39489c1283e0c5604846`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`b6cd1a7945bf1268a516a55eafbbddf48e368b495c12bab4b3e9c9df854aad67`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`0a5f61085097eb8fc63159fca73f3c365e28860e3f37d23ff57a3af5736a5b1c`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`be83ebe9f3cd0d2a84f92fba0ed2f7d5810369b5c1c9ef672edfd4f09aea3b7c`	sha256	Vidar	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`175a7d2a8dcc50665e5f3dd5f0513cc091184065b424907d3e544a56c163e2a3`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`e8f15d19c9c20108530850a8addb4a013eef0b4f96687519a5cacc3e90c9169e`	sha256	Vidar	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`f320cb93aca97694e2935d87576da8cda03d47659021c3f79e15dd164e894599`	sha256	Vidar	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`e5ad234bb8d0205dbc2fd60e220fb4fe879fb2d252f716cff78eb309c30c7421`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`e13563d62d614eedee6768e235be05eca67e86d0329b604bd26de5f929622851`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`15988f3d46d1c569f90fe3e9afa46f018be526b918102b8b2d20c0088f025c29`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`f18ecf8b4da6262bdc42efc531cc5302dc90720eb7744859be63f79627c34939`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`4eb1c6fdd48256c19d9b639c1087a1184daeb263865582e557460b1358bbca06`	sha256	Vidar	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`1f2b4cd5fddc89fe846556ebba5e96458cc56bf935bbf34055744ff54e0fcecf`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`e4556f7a0e2356a4e6816987bd8b4d9b408c7aa8609bc22cba1e6e968097ad20`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`625f0ea72da6eb0ddca4ae4d3e680dc5df30faebf648f82e93006165bd02b981`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`d6b74a926002e9d018073eed697c1b75250deab3945c8388532ad1711984f1bb`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`d9013fa366c2460da14ac377b986dc54acaf08633bf4b436157ea74ae15f991d`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`d4123e8d75feffa620107a4a4ee69848a3011a4de9903b732e03e8a0e4e56f86`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`588a8359d3e29e8334d628214f12cc660f92c3c47c6ff734793d9d2af1bd418d`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`8edf5865a87829fe59b97ffe2c3dda7a4b104b0ae08a202b6be7a5e6ba90eea7`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`22dd141a82c74ef617693b7007f98e681765f0726a0657618d5fd7d1eea0e0c7`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`916b63175a16484b5dc36e51ac2453c6c60e481b4fad4ec9ab511b6c28f2f1ed`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`dc1cbd35e7de92b10f9d5f63bf34610c2ca78e855cd7b9eac1d540e89c9d9a94`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`770abdea2a1560325636bb70cfd5c736e98c7d7ab4478fed43bebb87745898c4`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`d359681ebc98c73c45c803ee55d3b24aea94284cec4a961c79f0e528799febc3`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`c5f481f7023a4b9ee28b83be862286264195ab77e353d999dbf6debee05daa09`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`839dc73d9bb3f3562ea39c5faf41d8908cb9f52a4f9d7cdf005a3f3ec4d58dd6`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`a257198794219f14985ae2cb54c3938e8dddd0f6c1f245044fb991c7312a04ca`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`ffb8bafc3c18814a68f791dec5f38b721e4b1918f387568bc57a873d069b19f5`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`3d7fc882384188cee82010f0d000e37f758a626d2b394b52f87726d9b0333053`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`6ebee939adf95f55cb6a44b9bb82d0e8c2e3ce41b3427a615d9b3cfe3cc0577c`	sha256	ArkeiStealer	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`4e844539d95862ea53a47d0ed5d1cf0809d83a79c24f59afc5b6186054edf54b`	sha256	Mirai	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`378389637bf1a818f395c034f1b207bccdc6306f35117e27d163727664df748b`	sha256	NetSupport	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`c46684753c0e86e0fc5aabf24fa2d9d02b26f957027938767c3cfa5545c1cd44`	sha256	NetSupport	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`21c25061c4b47dc528f62813dd6baae6d9827c6dd71199ed5c7db63872a4ea24`	sha256	Mirai	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`5871e9ed44d989827c88ef3308a1f808d0822d8c936dd3cc0b684a258e62b06d`	sha256	Mirai	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`d11d2e36d17dc323dbafc5e361eb51eb8e0ab078c2f50ec5bc98e5a87190aefb`	sha256	elf	Malware Sample	MalwareBazaar	—	2026-07-08	🔗
`http://91.92.40.118/init.sh`	url	sh, ua-wget	malware_download	URLhaus	—	2026-07-08
`https://pub-61124cd6b14a43ab85c051bf3b7bf33f.r2.dev/Semoklu.msi`	url	NetSupport	malware_download	URLhaus	—	2026-07-08
`http://113.9.240.142:42978/i`	url	32-bit, arm, elf, mirai, Mozi	malware_download	URLhaus	—	2026-07-08
`http://83.219.1.198:42561/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://113.9.240.142:42978/bin.sh`	url	32-bit, arm, elf, mirai, Mozi	malware_download	URLhaus	—	2026-07-08
`http://42.86.113.243:40712/i`	url	—	malware_download	URLhaus	—	2026-07-08
`https://pastefy.app/2UAyY6A9/raw`	url	ascii, Encoded, PhantomGate	malware_download	URLhaus	—	2026-07-08
`http://115.61.51.91:46415/i`	url	Mozi	malware_download	URLhaus	—	2026-07-08
`https://pastefy.app/lBTfY3Xg/raw`	url	ascii, Encoded, PhantomGate	malware_download	URLhaus	—	2026-07-08
`http://46.217.141.171:6457/.i`	url	hajime	malware_download	URLhaus	—	2026-07-08
`http://116.139.183.228:43439/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://115.55.192.200:33588/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://115.55.192.200:33588/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://115.55.177.183:36148/i`	url	Mozi	malware_download	URLhaus	—	2026-07-08
`http://163.142.78.118:39139/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://175.167.76.60:53013/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://91.92.242.236/files-129312398/files/file_3a1cc00092af29d0.exe`	url	54e64e, dropped-by-amadey	malware_download	URLhaus	—	2026-07-08
`http://163.142.78.118:39139/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/f92d1b86bac243da86e3290c1907c299.exe`	url	ArkeiStealer	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/b7af5ef8c6b24dbc84b18b3ef139cbe2.exe`	url	ArkeiStealer	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/480e1d7b7c1f4f86893e91d7297ff652.exe`	url	Vidar	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/aa608087adce4522b98fedc62b0de2ee.exe`	url	ArkeiStealer	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/f8238fad9aff45f3a33bf8037a3ca78a.exe`	url	ArkeiStealer	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/c48d8858c31d4439a5a58204effb3d85.exe`	url	Vidar	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/273a7ebce05249a880abb34ebbb26b14.exe`	url	ArkeiStealer	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/3bf4d96d7ba74ee7ad4ce7cdea8e7033.exe`	url	Vidar	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/e36ea4fdb2994fe9b58aaecc72c71f06.exe`	url	Vidar	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/ee22c737e8b348d49582f9e1790f134f.exe`	url	ArkeiStealer	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/ca089a46f61743cd83884b1577b489ef.exe`	url	Vidar	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/ac68a70ed1654d04b29a8985d5ab58e8.exe`	url	Vidar	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/fe9c82f39a8a4fd0b607fac129f59184.exe`	url	ArkeiStealer	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/3923ae729e2c4adf85dc26b2db55768a.exe`	url	Vidar	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/c61eb43180354427870fc6de651cc63e.exe`	url	ArkeiStealer	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/4b5b8620309f491789af03500ede5528.exe`	url	Vidar	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/37ca1ffeb4e14e6f9b4854013b1c4ca5.exe`	url	Vidar	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/3f319bcbb3744ae8a49dc54a1b02c02c.exe`	url	Vidar	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/f0f1d4b4522f4c9f897ac08a4e1d1623.exe`	url	Vidar	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/856f3e600b2c4b4fa31993e52fba8d28.exe`	url	ArkeiStealer	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/9ee3fe2f7fbf467285527df5252d5f04.exe`	url	ArkeiStealer	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/4da769b12f2447869cad2cd0b27b61a9.exe`	url	ArkeiStealer	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/85af7d651b5d48ebb2753bc53d694c32.exe`	url	ArkeiStealer	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/12b4a453931143629c867b8acf6ecb1f.exe`	url	ArkeiStealer	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/7e02c8bb4178455e8d3af50503fd27c8.exe`	url	ArkeiStealer	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/888412a0a67842f2a0ec6bcf581ab656.exe`	url	ArkeiStealer	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/d63419ec10664d4384a260b3f7e614cc.exe`	url	Vidar	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/2ad3b5bf932d444a8ed96d6a1211ae68.exe`	url	ArkeiStealer	malware_download	URLhaus	—	2026-07-08
`http://119.179.249.198:60598/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`https://fesold.com/db9c0fee.exe`	url	ArkeiStealer	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/6b3b40e54b9c4c26a13d7a72a2eaab3c.exe`	url	Vidar	malware_download	URLhaus	—	2026-07-08
`https://mekasa.pro/3479ba86.exe`	url	ArkeiStealer	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/fe74b5ae594c4eda870ac2ec9dc214a0.exe`	url	Vidar	malware_download	URLhaus	—	2026-07-08
`https://mekasa.pro/b5d036ea.exe`	url	ArkeiStealer	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/32daa1c9eac744b98d12ae18e00f9ad2.exe`	url	Vidar	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/a14d88353c6441d89205a760ac7a1c79.exe`	url	Vidar	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/d71f44238cb84457afebf421116f1c92.exe`	url	ArkeiStealer	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/734f12aafddc4617a3bcae5e56ccbe58.exe`	url	ArkeiStealer	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/6d4b5504e589459f8e11ad3d1838f3f5.exe`	url	Vidar	malware_download	URLhaus	—	2026-07-08
`https://mekasa.pro/e3970037.exe`	url	ArkeiStealer	malware_download	URLhaus	—	2026-07-08
`https://mekasa.pro/72c4197f.exe`	url	ArkeiStealer	malware_download	URLhaus	—	2026-07-08
`https://mekasa.pro/a240a55d.exe`	url	ArkeiStealer	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/edfaeaf2bb634e3bb0f45339142bec7f.exe`	url	Vidar	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/99d213b876a747b6a9ff5322cec7f506.exe`	url	ArkeiStealer	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/25c935b940ea40cfba6db6c752400178.exe`	url	Vidar	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/d9e1709923ce40c49d6add23c7c95d0e.exe`	url	Vidar	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/f9a78169df37447aa3dfc6ad4d3593e7.exe`	url	Vidar	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/57c96d44ac93466f8cf814703a77fe4c.exe`	url	Vidar	malware_download	URLhaus	—	2026-07-08
`http://62.60.226.198/uploads/7d3839dfd03646a282c79d407acc92e8.exe`	url	Vidar	malware_download	URLhaus	—	2026-07-08
`http://39.64.9.139:43526/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://110.36.27.207:33177/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://90.153.217.151:59587/i`	url	Mozi	malware_download	URLhaus	—	2026-07-08
`http://115.52.22.6:35725/i`	url	—	malware_download	URLhaus	—	2026-07-08
`http://119.179.249.198:60598/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://115.55.234.28:52773/i`	url	Mozi	malware_download	URLhaus	—	2026-07-08
`http://151.192.135.88:41726/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://110.36.27.207:33177/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://105.184.91.145:44637/i`	url	32-bit, arm, elf, mirai, Mozi	malware_download	URLhaus	—	2026-07-08
`http://151.192.135.88:41726/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://42.238.64.12:58417/i`	url	Mozi	malware_download	URLhaus	—	2026-07-08
`http://115.55.234.28:52773/bin.sh`	url	Mozi	malware_download	URLhaus	—	2026-07-08
`http://59.103.116.68:46941/bin.sh`	url	Mozi	malware_download	URLhaus	—	2026-07-08
`http://59.103.116.68:46941/i`	url	Mozi	malware_download	URLhaus	—	2026-07-08
`http://123.14.97.76:44096/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://105.184.91.145:44637/bin.sh`	url	32-bit, arm, elf, mirai, Mozi	malware_download	URLhaus	—	2026-07-08
`http://123.235.194.222:60042/bin.sh`	url	Mozi	malware_download	URLhaus	—	2026-07-08
`http://61.137.129.191:59754/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://120.84.214.35:43836/bin.sh`	url	—	malware_download	URLhaus	—	2026-07-08
`http://110.37.118.66:51233/i`	url	mirai	malware_download	URLhaus	—	2026-07-08
`http://110.37.118.66:51233/bin.sh`	url	mirai	malware_download	URLhaus	—	2026-07-08
`http://115.55.10.88:38789/bin.sh`	url	Mozi	malware_download	URLhaus	—	2026-07-08
`http://42.229.160.104:58096/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://222.139.122.118:42542/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://61.54.43.201:39395/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://61.137.129.191:59754/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://105.184.76.93:57607/i`	url	32-bit, arm, elf, mirai, Mozi	malware_download	URLhaus	—	2026-07-08
`http://61.54.43.201:39395/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://27.37.100.207:54087/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://222.137.95.232:58447/i`	url	—	malware_download	URLhaus	—	2026-07-08
`http://105.184.76.93:57607/bin.sh`	url	32-bit, arm, elf, mirai, Mozi	malware_download	URLhaus	—	2026-07-08
`http://91.92.40.118/kworkerd-blkcg`	url	arm, elf, mirai, ua-wget	malware_download	URLhaus	—	2026-07-08
`http://91.92.40.118/kworkerd`	url	elf, gafgyt, mirai, ua-wget, x86	malware_download	URLhaus	—	2026-07-08
`http://91.92.40.118/kworkerd-irq-bal`	url	arm, elf, mirai, ua-wget	malware_download	URLhaus	—	2026-07-08
`http://91.92.40.118/kworkerd-crypto`	url	elf, mirai, SuperH, ua-wget	malware_download	URLhaus	—	2026-07-08
`http://91.92.40.118/kworkerd-softirq`	url	arm, elf, mirai, ua-wget	malware_download	URLhaus	—	2026-07-08
`http://91.92.40.118/kworkerd-events`	url	elf, mirai, ua-wget, x86	malware_download	URLhaus	—	2026-07-08
`http://91.92.40.118/kworkerd-writeback`	url	elf, mirai, PowerPC, ua-wget	malware_download	URLhaus	—	2026-07-08
`http://91.92.40.118/kworkerd-irq`	url	arm, elf, mirai, ua-wget	malware_download	URLhaus	—	2026-07-08
`http://91.92.40.118/kworkerd-netns`	url	elf, mips, ua-wget	malware_download	URLhaus	—	2026-07-08
`http://91.92.40.118/kworkerd-rcu`	url	elf, mips, ua-wget	malware_download	URLhaus	—	2026-07-08
`http://222.137.95.232:58447/bin.sh`	url	—	malware_download	URLhaus	—	2026-07-08
`http://207.34.149.169:32877/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://178.176.107.122:33136/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://5.175.192.197/bot.sh`	url	5-175-192-197, sh	malware_download	URLhaus	—	2026-07-08
`http://5.175.192.197/bot`	url	5-175-192-197, elf, mirai	malware_download	URLhaus	—	2026-07-08
`http://130.12.181.111/Bin/ScreenConnect.ClientSetup.exe`	url	130-12-181-111, connectwise, exe	malware_download	URLhaus	—	2026-07-08
`http://222.137.96.242:55578/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://110.37.14.156:33710/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-08
`http://59.103.86.89:52040/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-07
`http://110.37.14.156:33710/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-07
`http://115.56.64.251:58971/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-07
`http://59.97.251.109:44801/i`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-07
`http://27.222.178.246:42909/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-07
`http://59.97.251.109:44801/bin.sh`	url	32-bit, elf, mips, Mozi	malware_download	URLhaus	—	2026-07-07

Analyst Tools

Paste raw text — emails, reports, logs — to automatically extract and classify all IOCs.

Enter any IOC — type is auto-detected and a curated set of intel sources appears.

Decode common obfuscation schemes found in malware, phishing kits, and threat reports.

Convert IOCs between defanged (report-safe) and live formats. Handles hxxp, [.], and [://] notations.

Convert timestamps between Unix epoch, UTC, and local time. Paste any format into any field.

Unix Epoch (seconds)

Unix Epoch (milliseconds)

UTC / ISO 8601

Local Time

Human Readable (UTC)

Relative Time

Paste raw email headers to extract the sending chain, authentication results (SPF / DKIM / DMARC), originating IPs, and timing data.

Ransomware activity

0 New Victims Today

118 Victims This Week UP 115%

thegentlemen Most Active Group (7d)

Business Services Most Targeted Sector (30d)

Victim Name	Ransom Group	Industry / Sector	Country	Date Discovered
opportune.com	chaos	Business Services	US	2026-07-08
corepharma.com CRITICAL SECTOR	chaos	Healthcare	US	2026-07-08
Biessse	spacebears	General	IT	2026-07-08
Aesthetic Surgical Images CRITICAL SECTOR	incransom	Healthcare	US	2026-07-07
Shamrock Holdings Inc.	thegentlemen	General	US	2026-07-07
Medic Rescue CRITICAL SECTOR	thegentlemen	Healthcare	Unknown	2026-07-07
LogiQuip	thegentlemen	Transportation/Logistics	GB	2026-07-07
Virginia Historical Society	thegentlemen	Public Sector	US	2026-07-07
Quanterm Logistics Sdn Bhd	thegentlemen	Transportation/Logistics	MY	2026-07-07
Spedidam	thegentlemen	Transportation/Logistics	FR	2026-07-07
hiddeenn	thegentlemen	General	Unknown	2026-07-07
Arabia Falcon Insurance Company SAOG	thegentlemen	Financial Services	OM	2026-07-07
Ce Ratp Comite D entreprise Ratp	thegentlemen	Transportation/Logistics	FR	2026-07-07
Keifert	thegentlemen	General	DE	2026-07-07
Kosmos CRITICAL SECTOR	thegentlemen	Energy	DE	2026-07-07
EBNY Development	thegentlemen	Construction	EG	2026-07-07
Tonnies Group	thegentlemen	Agriculture and Food Production	DE	2026-07-07
Automovil Supply S.A	thegentlemen	Manufacturing	PY	2026-07-07
Excel Cell Electronic	thegentlemen	Manufacturing	TW	2026-07-07
Mercado Libre	thegentlemen	Technology	AR	2026-07-07
CSIR Structural Engineering Research Centre	thegentlemen	Public Sector	IN	2026-07-07
Jump Solutions Inc	thegentlemen	Business Services	PH	2026-07-07
MBT Energy CRITICAL SECTOR	thegentlemen	Energy	DE	2026-07-07
Lechner Massivhaus GmbH	qilin	Construction	AT	2026-07-07
Pro-Tech Technology	thegentlemen	Technology	SG	2026-07-07
Technical Solutions Group	thegentlemen	Business Services	US	2026-07-07
COP® Vertriebs-GmbH Zentrale	qilin	Business Services	DE	2026-07-07
Welldyne CRITICAL SECTOR	payoutsking	Healthcare	US	2026-07-07
C****p	payoutsking	General	IT	2026-07-07
Preneed Funeral Programs	play	Consumer Services	US	2026-07-07
Next Clinics CRITICAL SECTOR	qilin	Healthcare	CZ	2026-07-07
Kevin Bao Lenguyen	play	General	Unknown	2026-07-07
United Infrastructure CRITICAL SECTOR	play	Energy	US	2026-07-07
YMCA of Western North Carolina	interlock	Consumer Services	US	2026-07-07
URA Group	Booba Project	Business Services	RU	2026-07-07
seprec.gob.bo	krybit	Public Sector	BO	2026-07-07
RISE Architecture	akira	Business Services	Unknown	2026-07-07
Accelirate	qilin	Business Services	US	2026-07-07
Chisholm Persson & Ball	akira	Business Services	Unknown	2026-07-07
Excalibur Rentals	akira	Consumer Services	Unknown	2026-07-07
Mount Royal University	cmdorganization	Education	CA	2026-07-07
Edge Solutions \| Stone Ridge Payments	akira	Financial Services	US	2026-07-07
PB Fiduciaire SA	bravox	Financial Services	CH	2026-07-07
Studio Sardano	AiLock	Consumer Services	IT	2026-07-07
Richmont Graduate University	AiLock	Education	US	2026-07-07
hive360.com	dragonforce	Technology	Unknown	2026-07-07
amplesurveyor.com	dragonforce	Business Services	US	2026-07-07
Forces	medusalocker	General	CA	2026-07-07
Fitcrunch	spacebears	Consumer Services	US	2026-07-07
tecnocurva.com.br	incransom	Technology	BR	2026-07-07
samberger24.de	incransom	Business Services	DE	2026-07-07
matrixwebagency.com	safepay	Business Services	US	2026-07-06
bmiprojects.de	safepay	Construction	DE	2026-07-06
caritas-koblenz.de CRITICAL SECTOR	safepay	Healthcare	DE	2026-07-06
knobel-bau.de	safepay	Construction	DE	2026-07-06
rtngmbh.de	safepay	Business Services	DE	2026-07-06
stedwardscatholicfirstschool.co.uk	safepay	Education	GB	2026-07-06
lh-wohnverbund-wohnen-nrw.de	safepay	Consumer Services	DE	2026-07-06
shw-fr.de	safepay	General	DE	2026-07-06
gisy.com	chaos	Technology	US	2026-07-06
hahn-airport.de	safepay	Transportation/Logistics	DE	2026-07-06
aircreebec.ca	chaos	Transportation/Logistics	CA	2026-07-06
Hansa Research Group Pvt. Ltd	morpheus	Business Services	IN	2026-07-06
Keystone Homes	qilin	Construction	US	2026-07-06
Precision Steel Services	qilin	Manufacturing	Unknown	2026-07-06
Answer Precision Tool	qilin	Business Services	US	2026-07-06
dgcement.com	apt73	Manufacturing	DZ	2026-07-06
Wood Ellis & Wood CPA	qilin	Business Services	US	2026-07-06
Max Fordham	qilin	Business Services	GB	2026-07-06
Grupo Inteca	qilin	Business Services	MX	2026-07-06
azarestan.com	apt73	General	IR	2026-07-06
Upstaging	Booba Project	Business Services	US	2026-07-06
vicentetrapani.com	apt73	General	AR	2026-07-06
LabelDaddy	qilin	Business Services	US	2026-07-06
westernint.com	apt73	Business Services	US	2026-07-06
East African Gasoil CRITICAL SECTOR	arcusmedia	Energy	KE	2026-07-06
dinisrl.it	cry0	Transportation/Logistics	IT	2026-07-06
KOLORKIM KIMYA	Doommageddon	Manufacturing	TR	2026-07-06
Mercedes-Benz Turk	Doommageddon	Manufacturing	TR	2026-07-06
Innovano	Doommageddon	Technology	IN	2026-07-06
Francisco Imóveis	Doommageddon	Consumer Services	BR	2026-07-06
Solventa & Riskmetrica \| Calificadora de Riesgos	Doommageddon	Financial Services	PY	2026-07-06
Frosty Acres Brands	Booba Project	Agriculture and Food Production	US	2026-07-06
Telewave, Inc.	Booba Project	Telecommunication	US	2026-07-06
Fonsan	Booba Project	General	ES	2026-07-06
Nfinite 9000 S.L.	Booba Project	Technology	ES	2026-07-06
Blenheim	spacebears	General	GB	2026-07-06
ENB Versich CRITICAL SECTOR	payload	Energy	CH	2026-07-05
Vela Film S.r.l.	payload	Consumer Services	IT	2026-07-05
Apex Agro, LLC	genesis	Agriculture and Food Production	US	2026-07-05
Mirage Endoscopy Center CRITICAL SECTOR	genesis	Healthcare	US	2026-07-05
Bri-Tech, Inc	genesis	Technology	US	2026-07-05
SBI Software	genesis	Technology	US	2026-07-05
DICON	genesis	General	US	2026-07-05
Westgate	genesis	General	US	2026-07-05
Dunagan Associates	genesis	Business Services	US	2026-07-05
Synergy Interactive	genesis	Technology	US	2026-07-05
East Texas Family Medicine CRITICAL SECTOR	genesis	Healthcare	US	2026-07-05
Gold Standard Automotive	Wallstreet	Manufacturing	US	2026-07-04
Baraga County Memorial Hospital CRITICAL SECTOR	Wallstreet	Healthcare	US	2026-07-04

zerotolerance

DORMANT

zerotolerance

0 Victims (30d)

PIVOT Ready ID: #ZER

Global Victim Distribution (30 days)

Targeted Sectors (30 days)

Top Targeted Countries (30 days)

Country	Incidents (30d)	Share
US	118	41.3%
DE	41	14.3%
BR	17	5.9%
CA	15	5.2%
IT	14	4.9%
FR	12	4.2%
TH	9	3.1%
GB	9	3.1%
ES	8	2.8%
MX	8	2.8%
CH	7	2.4%
AR	7	2.4%
AU	7	2.4%
AE	7	2.4%
MY	7	2.4%

118 This Week ▲ 115% vs last week

0 Today

62 Single-Day Peak (30d)

Vulnerabilities

The WP Learn Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1....

CVSS: 9.6 2026-07-08

CVE-2026-15062

Snowflake / Snowpark Python SDK

SQL injection vulnerabilities in the Snowflake Snowpark Python SDK (snowpark-python) versions prior to 1.53.0 could allo...

Medium Severity (5.0 - 8.9)

CVSS: 7.2 2026-07-08

CVE-2026-6818

e4jvikwp / VikBooking Hotel Booking Engine & PMS

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Sc...

CVSS: 5.3 2026-07-08

CVE-2026-59875

isaacs / node-tar

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.17, node-tar does not strip...

CVSS: 6.4 2026-07-08

CVE-2026-6742

mdempfle / Advanced iFrame

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'addit...

CVSS: 5.9 2026-07-08

CVE-2026-59999

OpenBSD / OpenSSH

In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTun...

CVSS: 6.5 2026-07-08

CVE-2026-56401

Wazuh / Wazuh

Wazuh wazuh-modulesd before 5.0.0-beta3 contains a null pointer dereference vulnerability in invento...

CVSS: 6.1 2026-07-08

CVE-2026-59929

lepture / mistune

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the safe_url filter ...

CVSS: 6.4 2026-07-08

CVE-2026-6740

posimyththemes / Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder

The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vuln...

CVSS: 8.8 2026-07-08

CVE-2026-14158

totalbounty / Widget Logic Visual

The Widget Logic Visual plugin for WordPress is vulnerable to Remote Code Execution in all versions ...

CVSS: 6.3 2026-07-08

CVE-2026-15063

Red Hat / Red Hat OpenShift AI (RHOAI)

A flaw was found in the gorch service template, which is part of the trustyai-service-operator. Even...

CVSS: 5.3 2026-07-08

CVE-2026-15035

bentoml / OpenLLM

A vulnerability was found in bentoml OpenLLM 0.6.30. This affects the function async_run_command of ...

CVSS: 5.4 2026-07-08

CVE-2026-56283

Capgo / Capgo

Capgo before 12.128.2 contains an html injection vulnerability in the organization settings endpoint...

CVSS: 6.1 2026-07-08

CVE-2026-59895

honojs / hono

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.0.0 bef...

CVSS: 7.5 2026-07-08

CVE-2026-59928

lepture / mistune

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document ...

CVSS: 6.4 2026-07-08

CVE-2026-6459

wpdevteam / Essential Addons for Elementor – Popular Elementor Templates & Widgets

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is v...

CVSS: 5.3 2026-07-08

CVE-2026-5459

wedevs / User Frontend: AI Powered Frontend Posting, User Directory, Profile Builder, Membership & User Registration

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registrat...

CVSS: 8.1 2026-07-08

CVE-2026-3688

wclovers / WCFM Membership – WooCommerce Memberships for Multivendor Marketplace

The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vu...

CVSS: 7.7 2026-07-08

CVE-2026-60002

OpenBSD / OpenSSH

ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key...

CVSS: 8.8 2026-07-08

CVE-2026-56086

Dell / PowerProtect Data Domain

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through...

CVSS: 8.8 2026-07-08

CVE-2026-15067

Snowflake / Terraform Provider for Snowflake

Snowflake Terraform Provider versions prior to 2.18.0 contain several security vulnerabilities, incl...

CVSS: 8.5 2026-07-08

CVE-2026-56002

X.Org / libXfont2

A heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 a...

CVSS: 7.5 2026-07-08

CVE-2026-56226

Cap-go / capgo

Capgo (Cap-go/capgo) before 12.128.2 exposes the Supabase PostgREST RPC function public.get_orgs_v6(...

CVSS: 6.5 2026-07-08

CVE-2026-56273

Flowise / Flowise

Flowise before 3.1.0 contains a path traversal vulnerability in Faiss and SimpleStore vector store i...

CVSS: 7 2026-07-08

CVE-2026-56297

FreeRDP / FreeRDP

FreeRDP before 3.22.0 contains a use-after-free vulnerability in dvcman_channel_close and dvcman_cal...

CVSS: 7.5 2026-07-08

CVE-2026-59703

repomix / repomix

repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthen...

CVSS: 5.3 2026-07-08

CVE-2026-59871

isaacs / node-tar

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-di...

CVSS: 7.5 2026-07-08

CVE-2026-59892

open-telemetry / opentelemetry-js

OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/prop...

CVSS: 7.5 2026-07-08

CVE-2026-59922

lepture / mistune

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tild...

CVSS: 5.3 2026-07-08

CVE-2026-59927

lepture / mistune

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, the Include directiv...

CVSS: 6.5 2026-07-08

CVE-2026-60001

OpenBSD / OpenSSH

sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.

CVSS: 7.2 2026-07-08

CVE-2026-6820

e4jvikwp / VikBooking Hotel Booking Engine & PMS

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Sc...

CVSS: 7.5 2026-07-08

CVE-2026-9842

pixelgrade / Backstage – Customizer Demo Access

The Backstage - Customizer Demo Access plugin for WordPress is vulnerable to Privilege Escalation in...

CVSS: 6.1 2026-07-08

CVE-2026-8310

Webbeyaz Web Design / Mediküm Web

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i...

CVSS: 7.5 2026-07-08

CVE-2026-6854

joedolson / My Calendar – Accessible Event Manager

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQ...

CVSS: 6.1 2026-07-08

CVE-2026-60092

AVideo / AVideo

AVideo (Meet plugin) through commit e8d6119f3cb1b849149906efeb0a41fc024f59f8 contains a stored cross...

CVSS: 7.7 2026-07-08

CVE-2026-55431

coder / coder

Coder allows organizations to provision remote development environments via Terraform. Prior to vers...

CVSS: 5.4 2026-07-08

CVE-2026-55433

coder / coder

Coder allows organizations to provision remote development environments via Terraform. Prior to vers...

CVSS: 5.4 2026-07-08

CVE-2026-55437

coder / coder

Coder allows organizations to provision remote development environments via Terraform. Prior to vers...

CVSS: 7.5 2026-07-08

CVE-2026-5356

latepoint / LatePoint – Calendar Booking Plugin for Appointments and Events

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerab...

CVSS: 7.1 2026-07-08

CVE-2026-41122

Dell / PowerProtect Data Domain

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through...

CVSS: 8.5 2026-07-08

CVE-2026-56003

X.Org / libXfont2

A heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in...

CVSS: 7.7 2026-07-08

CVE-2026-55874

seaweedfs / seaweedfs

SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot...

CVSS: 6.5 2026-07-08

CVE-2026-56220

Capgo / Capgo

Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.manifest INSERT p...

CVSS: 8.1 2026-07-08

CVE-2026-56246

Capgo / Capgo

Capgo before 12.128.2 contains a broken access control vulnerability in the organization management ...

CVSS: 7.5 2026-07-08

CVE-2026-56250

Capgo / Capgo

Capgo before 12.128.2 allows upload-scoped API keys to modify the mutable app_versions.r2_path field...

CVSS: 5.4 2026-07-08

CVE-2026-56293

Capgo / Capgo

Capgo before 12.128.2 contains an authorization flaw in transfer_app() that fails to update deploy_h...

CVSS: 8.1 2026-07-08

CVE-2026-3144

IBM / API Connect

IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to ...

CVSS: 5.4 2026-07-08

CVE-2026-56775

n8n / n8n

n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization vulnerability in three mutating ev...

CVSS: 6.4 2026-07-08

CVE-2026-56778

n8n / n8n

n8n before 2.25.7 and 2.26.x before 2.26.2 contains an authorization bypass in the Public API execut...

CVSS: 7.1 2026-07-08

CVE-2026-59261

OpenClaw / OpenClaw

OpenClaw before 2026.5.28 contains a credential exposure vulnerability where workspace dotenv files ...

CVSS: 8.2 2026-07-08

CVE-2026-59731

withastro / astro

Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions...

CVSS: 5.3 2026-07-08

CVE-2026-59870

nodeca / js-yaml

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.1, YAML11_SCHEMA support for t...

CVSS: 5.3 2026-07-08

CVE-2026-59877

protobufjs / protobuf.js

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, p...

CVSS: 6.1 2026-07-08

CVE-2026-59890

pypa / setuptools

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python...

CVSS: 7.5 2026-07-08

CVE-2026-15053

Tanium / Tanium Server

Tanium addressed a denial of service vulnerability in Tanium Server.

CVSS: 6.1 2026-07-08

CVE-2026-59923

lepture / mistune

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, HTMLRenderer.safe_ur...

CVSS: 7.5 2026-07-08

CVE-2026-53482

Dell / PowerProtect Data Domain

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through...

CVSS: 8.8 2026-07-08

CVE-2026-60102

horde / Vfs

Horde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerability in t...

CVSS: 7.5 2026-07-08

CVE-2026-6230

tainacan / Tainacan

The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery'...

CVSS: 5.8 2026-07-08

CVE-2026-55430

coder / coder

Coder allows organizations to provision remote development environments via Terraform. Prior to vers...

CVSS: 5.4 2026-07-08

CVE-2026-8315

Webbeyaz Web Design / Mediküm Web

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i...

CVSS: 7.5 2026-07-08

CVE-2026-9700

joe007 / Eventer

The Eventer plugin for WordPress is vulnerable to time-based SQL Injection via the ‘code’ parameter ...

CVSS: 8.1 2026-07-08

CVE-2026-54652

blakeblackshear / frigate

Frigate is an open source network video recorder. In version 0.17.1, the GET /api/logs/{service} end...

CVSS: 8.7 2026-07-08

CVE-2026-55429

coder / coder

Coder allows organizations to provision remote development environments via Terraform. Prior to vers...

CVSS: 6.1 2026-07-08

CVE-2026-11798

the_champ / Social Share, Social Login and Social Comments Plugin – Super Socializer

The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is...

CVSS: 6.4 2026-07-08

CVE-2026-10570

idocoh / Sympl Repeater for ACF and Elementor

The Sympl Repeater for ACF and Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scr...

CVSS: 8.8 2026-07-08

CVE-2026-14489

globalprogramming / WHMCS Bridge

The WHMCS Bridge plugin for WordPress is vulnerable to arbitrary file uploads due to missing file ty...

CVSS: 5.4 2026-07-08

CVE-2026-55432

coder / coder

Coder allows organizations to provision remote development environments via Terraform. Prior to vers...

CVSS: 8 2026-07-08

CVE-2026-11903

Progress / MOVEit Transfer

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i...

CVSS: 7.4 2026-07-08

CVE-2026-55436

coder / coder

Coder allows organizations to provision remote development environments via Terraform. Starting in v...

CVSS: 5.8 2026-07-08

CVE-2026-55438

coder / coder

Coder allows organizations to provision remote development environments via Terraform. Prior to vers...

CVSS: 5.3 2026-07-08

CVE-2026-14500

sayantandas20 / Bulk Order Update for WooCommerce

The Bulk Order Update for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Read in v...

CVSS: 6.3 2026-07-08

CVE-2026-55668

filebrowser / filebrowser

File Browser provides a web file managing interface. Prior to 2.63.16, ScopedFs validates the neares...

CVSS: 8.8 2026-07-08

CVE-2026-14495

wpdo5ea / DoLogin Security

The DoLogin Security plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Ra...

CVSS: 5.3 2026-07-08

CVE-2026-12097

saadiqbal / User Management

The User Management plugin for WordPress is vulnerable to authorization bypass in all versions up to...

CVSS: 7.8 2026-07-08

CVE-2026-22927

Omnissa / Omnissa Workspace ONE® Tunnel for Windows

Omnissa Workspace ONE® Tunnel for Windows addresses a Local Privilege Escalation Vulnerability.

CVSS: 6.3 2026-07-08

CVE-2026-15044

Red Hat / Red Hat OpenShift AI (RHOAI)

A flaw was found in the TrustyAI Service Operator. When deploying services like gorch or NemoGuardra...

CVSS: 7.5 2026-07-08

CVE-2026-44840

dgraph-io / dgraph

Dgraph is an open source distributed GraphQL database. Prior to version 25.3.4, the `checkUserPasswo...

CVSS: 7.2 2026-07-08

CVE-2026-10698

Progress / MOVEit Transfer

Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Tra...

CVSS: 7.5 2026-07-08

CVE-2026-10699

Progress / MOVEit Transfer

Missing release of memory after effective lifetime vulnerability in Progress MOVEit Transfer (Custom...

CVSS: 5.3 2026-07-08

CVE-2026-56284

Cap-go / capgo

Capgo (Cap-go/capgo) before 12.128.2 contains an information disclosure vulnerability in the Supabas...

CVSS: 6.3 2026-07-08

CVE-2026-14250

themehunk / TH Login Registration

The Themehunk Login Registration plugin for WordPress is vulnerable to privilege escalation in versi...

CVSS: 5.3 2026-07-08

CVE-2026-29007

u-boot / u-boot

U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcp_rx_state_machine() (n...

CVSS: 8.2 2026-07-08

CVE-2026-29009

u-boot / u-boot

U-Boot through 2026.04-rc3 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs...

CVSS: 5.4 2026-07-08

CVE-2026-56359

n8n / n8n

n8n before 2.8.0 contains a cross-site scripting vulnerability in the credential management flow whe...

CVSS: 7.5 2026-07-08

CVE-2026-29008

u-boot / u-boot

U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine()...

CVSS: 7.8 2026-07-08

CVE-2026-56437

Fuji Electric Co.,Ltd. / Pupsman

Uncontrolled search path element issue exists in Pupsman versions prior to 3.9.0. If a crafted DLL f...

CVSS: 7.4 2026-07-08

CVE-2026-56776

n8n / n8n

n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/{wor...

CVSS: 5 2026-07-08

CVE-2026-57439

gchq / CyberChef

CyberChef is a web app for encryption, encoding, compression, and data analysis. Prior to 11.2.0, th...

CVSS: 7.8 2026-07-08

CVE-2026-57895

Fuji Electric Co.,Ltd. / Pupsman

Incorrect default permissions issue exists in Pupsman versions prior to 3.9.0. An attacker can place...

CVSS: 7.5 2026-07-08

CVE-2026-58656

getgrav / grav

Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and respo...

CVSS: 6.5 2026-07-08

CVE-2026-59262

affine / monorepo

AFFiNE's histories GraphQL field fails to validate Doc.Read permission before exposing document edit...

CVSS: 7.5 2026-07-08

CVE-2026-59724

socketio / socket.io

Socket.IO enables bidirectional and low-latency communication for every platform. From 6.5.0 before ...

CVSS: 7.5 2026-07-08

CVE-2026-59725

socketio / socket.io

Socket.IO enables bidirectional and low-latency communication for every platform. From 4.1.0 before ...

CVSS: 5.3 2026-07-08

CVE-2026-59868

nodeca / js-yaml

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.0, when merge keys are enabled...

CVSS: 7.5 2026-07-08

CVE-2026-59869

nodeca / js-yaml

js-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0...

CVSS: 7.5 2026-07-08

CVE-2026-59887

markdown-it / linkify-it

linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: sch...

CVSS: 8.8 2026-07-08

CVE-2026-14482

shen2 / 多说社会化评论框

The 多说社会化评论框 plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and i...

CVSS: 6.5 2026-07-08

CVE-2026-59896

honojs / hono

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.11.8 be...

CVSS: 6.1 2026-07-08

CVE-2026-50813

n/a / n/a

An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive i...

CVSS: 5.9 2026-07-08

CVE-2026-59924

lepture / mistune

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse() join...

CVSS: 7.5 2026-07-08

CVE-2026-59925

lepture / mistune

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of we...

CVSS: 7.5 2026-07-08

CVE-2026-14244

jssor / Jssor Slider by jssor.com

The Jssor Slider by jssor.com plugin for WordPress is vulnerable to Directory Traversal in all versi...

CVSS: 6.3 2026-07-08

CVE-2026-15033

christopherthielen / check-peer-dependencies

A flaw has been found in christopherthielen check-peer-dependencies up to 4.3.4. Affected by this vu...

CVSS: 6.5 2026-07-07

CVE-2026-55490

openwrt / openwrt

OpenWrt is a Linux operating system targeting embedded devices. Before v25.12.5, an integer underflo...

CVSS: 6.5 2026-07-07

CVE-2026-55434

coder / coder

Coder allows organizations to provision remote development environments via Terraform. Starting in v...

CVSS: 8.3 2026-07-07

CVE-2026-55427

coder / coder

Coder allows organizations to provision remote development environments via Terraform. Prior to vers...

CVSS: 8.6 2026-07-07

CVE-2026-55418

labring / FastGPT

FastGPT is an open source AI knowledge base platform. Prior to v4.15.0-beta5, two FastGPT file handl...

CVSS: 8.2 2026-07-07

CVE-2026-55428

coder / coder

Coder allows organizations to provision remote development environments via Terraform. Prior to vers...

CVSS: 6.5 2026-07-07

CVE-2026-55078

coder / coder

Coder allows organizations to provision remote development environments via Terraform. Starting in v...

CVSS: 7.4 2026-07-07

CVE-2026-55076

coder / coder

Coder allows organizations to provision remote development environments via Terraform. Prior to vers...

CVSS: 7.2 2026-07-07

CVE-2026-55077

coder / coder

Coder allows organizations to provision remote development environments via Terraform. Prior to vers...

CVSS: 8.8 2026-07-07

CVE-2026-11610

Red Hat / Red Hat Directory Server 11.5 E4S for RHEL 8

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). A...

CVSS: 7.7 2026-07-07

CVE-2026-54607

labring / FastGPT

FastGPT is a knowledge-based AI application platform. Prior to 4.15.0-beta4, the HTTP-tool OpenAPI s...

Low Severity (1.0 - 4.9)

CVSS: 3.1 2026-07-08

CVE-2026-14966

Black Lantern Security / BBOT

BBOT's unarchive module rejects archives containing symlink entries before extra...

CVSS: 3.1 2026-07-08

CVE-2026-14967

Black Lantern Security / BBOT

BBOT's `github_workflows` module could be induced to write a downloaded artifact...

CVSS: 4.9 2026-07-08

CVE-2026-14362

HashiCorp / Shared library

HashiCorp memberlist before version 0.6.0 is vulnerable to a denial-of-service i...

CVSS: 3.3 2026-07-08

CVE-2026-56374

ImageMagick / ImageMagick

ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the...

CVSS: 4.2 2026-07-08

CVE-2026-59996

OpenBSD / OpenSSH

scp in OpenSSH before 10.4 may place a file in the parent directory of an intend...

CVSS: 4.9 2026-07-08

CVE-2026-12936

devitemsllc / Recurio – Ultimate Subscription for WooCommerce

The Recurio – Ultimate Subscription for WooCommerce plugin for WordPress is vuln...

CVSS: 3.3 2026-07-08

CVE-2026-56362

ImageMagick / ImageMagick

ImageMagick before 7.1.2-15 contains a heap-buffer-overflow read vulnerability i...

CVSS: 4.3 2026-07-08

CVE-2026-59930

lepture / mistune

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, ...

CVSS: 4.2 2026-07-08

CVE-2026-59995

OpenBSD / OpenSSH

sftp in OpenSSH before 10.4 does not properly constrain the location of download...

CVSS: 4.8 2026-07-08

CVE-2026-6371

Limatek System Inc. / LimRAD NAC

Improper neutralization of input during web page generation ('cross-site scripti...

CVSS: 4.7 2026-07-08

CVE-2026-54344

ToolJet / ToolJet

ToolJet is an open-source low-code platform for building internal tools. Prior t...

CVSS: 4.3 2026-07-08

CVE-2026-56298

Capgo / Capgo

Capgo before 12.128.2 fails to strip EXIF metadata from images uploaded via the ...

CVSS: 4 2026-07-08

CVE-2026-56360

n8n / n8n

n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on...

CVSS: 4.8 2026-07-08

CVE-2026-58657

Grav / Grav

Grav before 2.0.0 (affected through 2.0.0-rc.9 and the 2.0 branch) contains a st...

CVSS: 4.7 2026-07-08

CVE-2026-59883

guzzle / guzzle

Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, CookieJar did not rest...

CVSS: 4.8 2026-07-08

CVE-2026-59897

honojs / hono

Hono is a Web application framework that provides support for any JavaScript run...

CVSS: 4.3 2026-07-08

CVE-2026-15034

flask-dashboard / Flask-MonitoringDashboard

A vulnerability has been found in flask-dashboard Flask-MonitoringDashboard up t...

CVSS: 4.8 2026-07-08

CVE-2026-59998

OpenBSD / OpenSSH

sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSA...

CVSS: 3.7 2026-07-08

CVE-2026-60000

OpenBSD / OpenSSH

sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service...

CVSS: 4.3 2026-07-08

CVE-2026-56217

Capgo / Capgo

Capgo before 12.128.2 contains a policy bypass vulnerability in app_versions upd...

CVSS: 4.3 2026-07-08

CVE-2026-9731

wpkuf / Wp Js Detect

The Wp Js Detect plugin for WordPress is vulnerable to Cross-Site Request Forger...

CVSS: 4.7 2026-07-08

CVE-2026-12002

smub / Smash Balloon Social Photo Feed – Easy Social Feeds Plugin

The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPr...

CVSS: 4.2 2026-07-08

CVE-2026-59997

OpenBSD / OpenSSH

internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command...

CVSS: 4.4 2026-07-08

CVE-2026-12041

chatra / Chatra Live Chat + ChatBot + Cart Saver

The Chatra Live Chat + ChatBot + Cart Saver plugin for WordPress is vulnerable t...

CVSS: 4.3 2026-07-08

CVE-2026-55873

seaweedfs / seaweedfs

SeaweedFS is a distributed storage system. In versions 4.08 through 4.33, reques...

CVSS: 3.7 2026-07-08

CVE-2026-15041

Red Hat / Red Hat Directory Server 11

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verificatio...

CVSS: 4.3 2026-07-08

CVE-2026-58654

Grav / Grav

The Grav API plugin (getgrav/grav-plugin-api) 1.0.0 contains an unrestricted fil...

CVSS: 4.8 2026-07-08

CVE-2026-59876

protobufjs / protobuf.js

protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8....

CVSS: 4.2 2026-07-08

CVE-2026-59882

guzzle / psr7

guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to ...

CVSS: 4.3 2026-07-08

CVE-2026-15036

n/a / Harness

A vulnerability was determined in Harness up to 2.28.2. This vulnerability affec...

CVSS: 2.7 2026-07-08

CVE-2026-53480

Dell / PowerProtect Data Domain

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release ver...

CVSS: 3.9 2026-07-07

CVE-2026-55592

lissy93 / dashy

Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace v...

CVSS: 4.9 2026-07-07

CVE-2026-55079

coder / coder

CVE-2026-56246

Capgo - Capgo

Capgo before 12.128.2 contains a broken access control vulnerability in the organization management API where a scoped API key (limited_to_orgs) inherits its owner-user's permissions, allowing destructive cross-organization actions. When a user is an admin in two organizations and creates a write-mode API key restricted to one organization, that key can still perform destructive operations (e.g., DELETE /organization, DELETE /organization/members) against another organization. The root cause is route-level authorization (rbac_check_permission_direct) that evaluates the key owner's user privileges before enforcing the API key's limited_to_orgs scope.

CVSS: 6.5

2026-07-08

CVE-2026-56401

Wazuh - Wazuh

Wazuh wazuh-modulesd before 5.0.0-beta3 contains a null pointer dereference vulnerability in inventory_sync FlatBuffer DataValue handling. An enrolled agent can send a verifier-valid DataValue message omitting the optional id field, causing wazuh-modulesd to crash when dereferencing data->id()->string_view() without null validation, resulting in denial of service.

CVSS: 9.1

2026-07-08

CVE-2026-9074

IBM - API Connect

IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functionality.

CVSS: 8.7

2026-07-08

CVE-2026-55429

coder - coder

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `UpsertWorkspaceApp` overwrites an existing app's `agent_id` on a primary-key conflict and `insertAgentApp` accepts the app ID from the provisioner's `CompleteJob` payload without verifying it belongs to the workspace being built. `CompleteJob` runs under `dbauthz.AsProvisionerd` so the authorization layer does not block the cross-workspace upsert. Exploitation requires elevated access as a template author or external provisioner operator. The fix in versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2 verifies that any existing `workspace_apps` row matching the supplied ID belongs to the workspace being built and rejects cross-workspace agent reassignment. No known workarounds are available.

AWAITING CVSS

2026-07-08

CVE-2026-59874

isaacs - node-tar

n8n - n8n

n8n before 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 contains a SQL injection vulnerability in the legacy MySQL v1 node's executeQuery operation. The operation substitutes evaluated {{ ... }} expression values directly into the raw SQL string without parameterization. When a workflow uses this operation with expression-sourced values and is connected to an externally-reachable trigger (such as a Webhook node), attacker-controlled input reaching those expressions results in SQL injection, allowing execution of arbitrary SQL with the configured MySQL credentials' privileges. The MySQL v2 node, which uses parameterized queries, is not affected.

CRITICAL VENDOR

AWAITING CVSS

2026-07-08

CVE-2026-59880

immutable-js - immutable-js

Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set keep keys that share the same 32-bit hash in a HashCollisionNode collision bucket that is scanned linearly, allowing an attacker who controls keys inserted into a Map, such as through Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep, to craft many colliding keys and degrade insertion and lookup to consume disproportionate CPU. This issue is fixed in versions 4.3.9 and 5.1.8.

CVSS: 6.3

2026-07-08

CVE-2026-15063

Red Hat - Red Hat OpenShift AI (RHOAI)

A flaw was found in the gorch service template, which is part of the trustyai-service-operator. Even when authentication is enabled, the gorch service exposes unproxied orchestrator and detector metrics ports. This allows any pod on the cluster network to directly access these ports, bypassing the kube-rbac-proxy and its authentication mechanisms. This could lead to unauthorized access to the orchestrator and detector metrics.

CVSS: 4.3

2026-07-08

CVE-2026-15034

flask-dashboard - Flask-MonitoringDashboard

CVE-2026-54344

ToolJet - ToolJet

ToolJet is an open-source low-code platform for building internal tools. Prior to 3.20.180, ToolJet's render preview deployment workflow interpolates github.event.comment.body directly into a bash conditional in a run step, allowing any GitHub user who can comment on an open pull request with a deploy command to execute shell commands on the CI runner and exfiltrate deployment secrets. This issue is reported as fixed in version 3.20.180.

CVSS: 8.1

2026-07-08

CVE-2026-54652

blakeblackshear - frigate

isaacs - node-tar

node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.18, node-tar coerces all-digit PAX path and linkpath values in src/pax.ts to JavaScript numbers, causing downstream path handling such as normalizeWindowsPath(entry.path).split('/') to throw an uncaught TypeError. This issue is fixed in version 7.5.18.

CRITICAL VENDOR

CVSS: 7.7

2026-07-08

CVE-2026-60002

OpenBSD - OpenSSH

ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)

AWAITING CVSS

2026-07-08

CVE-2026-24698

n/a - n/a

2026-07-08

CVE-2026-59876

protobufjs - protobuf.js

protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 until 8.6.5, the protobufjs Text Format extension parsed string-keyed map entries using ordinary property assignment, allowing a map entry with key __proto__ to change the prototype of the returned map object instead of creating an own map entry in protobufjs/ext/textformat. This issue is fixed in version 8.6.5.

CVSS: 8.2

2026-07-08

CVE-2026-59731

withastro - astro

Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit, while later rewrite route matching performs an additional decodeURI() operation and can resolve the request to a protected route. This issue is fixed in version 6.4.8.

CVSS: 7.5

2026-07-08

CVE-2026-59928

lepture - mistune

Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link definitions causes quadratic work in src/mistune/block_parser.py and the ref_links environment dictionary handling, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0.

CVSS: 5.3

2026-07-08

CVE-2026-59877

protobufjs - protobuf.js

protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.5 and 8.6.6, protobufjs parsed option names by advancing through schema tokens until reaching an = token without checking for end of input, so a crafted .proto schema that opens an option declaration and ends prematurely can cause parse, Root.load, or Root.loadSync to loop indefinitely. This issue is fixed in versions 7.6.5 and 8.6.6.

Sort by:

EPSS: 3.2%

2026-07-01

CVE-2026-45659

Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network.

Product: SharePoint Server

EPSS: 1.2%

2026-06-29

CVE-2026-48558

SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication.

Product: SimpleHelp

Advanced Persistent Threats (APT)

200 Tracked Actors

4 Active (OTX Matched)

50 Live OTX Pulses

How a single ScreenConnect incident exposed a massive campaign

A massive campaign distributes malicious installer archives hosted on spoofed websites masquerading as popular software like OBS Studio, DNS Jumper, DS4Windows, and Bandicam. Over 90 domain names localized across 10 languages were discovered. The malicious archives bundle a legitimate Microsoft-signed install.exe binary with a rogue install.res.1033.dll library deployed via DLL sideloading. This installs the ScreenConnect remote access service, which then deploys AsyncRAT payloads through PowerShell and VBS scripts. The threat actors leverage SEO techniques to position fraudulent sites at the top of search engine results, targeting both individual users and corporate networks. The infrastructure spans three IP addresses with domains registered between October 2025 and March 2026, creating a global footprint with multi-language support.

IOCs: 134 remote access trojan fake software

LOW OTX PULSE

7/1/2026

Phishing in the Balkans: Fake Traffic Fines, Real Losses

An active SMS phishing campaign targets Serbian road users by impersonating Putevi Srbije, Serbia's state road authority. Victims receive text messages claiming they have unpaid traffic fines with urgent payment demands. The fraudulent links lead to cloned government websites designed to steal payment card details. The infrastructure employs JavaScript-based obfuscation techniques to evade automated security scanners and uses disposable domains with uncommon TLDs. Technical analysis reveals connections to both Darcula and Phoenix Phishing-as-a-Service platforms, indicating fraudsters are combining tools from multiple PhaaS vendors. The operation demonstrates coordinated roles including infrastructure setup, SMS distribution, and data harvesting. Similar campaigns have targeted victims globally across government bodies, postal services, and financial institutions.

IOCs: 25 phoenix government impersonation

CRITICAL OTX PULSE

7/1/2026

Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique

Check Point Research discovered a novel browser-native ransomware technique that emerged from AI-generated code attributed to DeepSeek. The attack leverages the File System Access API in Chromium browsers to encrypt files without requiring native payloads, exploits, or app installations. A malicious sample disguised as an AI image upscaler was analyzed, revealing how LLMs can connect theoretical platform risks to practical attack workflows. The technique is particularly concerning on Android, where Chrome allows web pages to access photo directories after user approval through legitimate permission prompts. By using social engineering with a fake AI enhancement tool, attackers can persuade victims to grant folder-level access, enabling file exfiltration and encryption entirely within the browser. This demonstrates how frontier AI models can autonomously design novel attack chains by reasoning across existing knowledge.

IOCs: 1 infernograbber llm-generated malware

MEDIUM OTX PULSE

7/1/2026

Inside an affiliate panel targeting Microsoft 365

Cisco Talos discovered ARToken, a sophisticated phishing-as-a-service panel sharing infrastructure and operational patterns with the EvilTokens platform. The panel exposes over 80 API endpoints enabling device code phishing, Primary Refresh Token persistence, email access, business email compromise operations, and SharePoint exfiltration through a React-based dashboard. The platform deploys a seven-layer anti-analysis system combining client-side behavioral verification with XOR-encrypted payloads. ARToken abuses Microsoft's OAuth 2.0 Device Authorization Grant to bypass multi-factor authentication entirely. Analysis reveals post-compromise capabilities including token management across password resets, automated BEC operations, inbox rule manipulation for evidence suppression, cross-account keyword monitoring, and SharePoint file operations. The platform operates as multi-tenant infrastructure with subscription-based affiliate access, representing a complete operations environment rather than simple phish...

IOCs: 5 oauth abuse phishing-as-a-service

MEDIUM OTX PULSE

7/1/2026

An Analysis of ValleyRAT Infection Campaigns from Fake Installers, Japanese Malicious Emails

LevelBlue has identified two distinct ValleyRAT attack vectors: campaigns using fake installers and malicious email-based campaigns. Detection volume increased significantly from May 2025, nearly doubling in 2026. The fake installer attacks primarily target Chinese-speaking users and employ advanced techniques including Pool Party Variant 7 process injection and BYOVD methods. The malicious email campaigns target both Chinese and Japanese-speaking users, delivering ZIP archives containing EXE and DLL files that leverage DLL sideloading. The malware employs multiple evasion techniques including junk code insertion, memory size checks, sleeping duration checks, process count validation, and fileless execution using Donut-generated shellcode. ValleyRAT establishes persistence through registry modification and enables remote access capabilities for threat actors.

IOCs: 6 phishing emails process injection

CRITICAL OTX PULSE

6/30/2026

Not very gentlemanly: Analyzing a zero-day exploit used to disable targets' EDRs

The Gentlemen ransomware group, which emerged in July 2025, employed a zero-day vulnerability in a bring-your-own-vulnerable-driver (BYOVD) attack to disable endpoint detection and response systems. During an incident investigated in early April, the group leveraged an obscure third-party driver named ktapi.sys from Kontron to bypass security protections. The sophisticated exploit chains multiple advanced techniques to navigate Windows exploit mitigations, including bypassing Supervisor Mode Access Prevention and Supervisor Mode Execution Prevention. The toolkit enables the attackers to call privileged kernel mode functions from user mode processes, ultimately terminating EDR processes including Windows Defender, ESET, Palo Alto Cortex XDR, and SentinelOne. The vulnerability had no prior public documentation and was previously absent from vulnerable driver blocklists.

IOCs: 3 the gentlemen edr killer

HIGH OTX PULSE

6/29/2026

India's government and energy sectors targeted with ZOHOMURK and MINIRECON

Mustang Panda orchestrated two concurrent espionage campaigns targeting Indian government entities and hydropower infrastructure between May and June 2026. The campaigns leveraged DLL sideloading via legitimate executables to deploy newly identified malware including SHARDLOADER, MINIRECON, and ZOHOMURK. MINIRECON represents an evolution of Toneshell with WebSocket-based command-and-control capabilities, while ZOHOMURK abuses Zoho WorkDrive cloud services for C2 communications and data exfiltration. Distribution occurred through spear-phishing with lures themed around India-Taiwan cooperation agreements and hydropower projects. The activity demonstrates code overlaps with previous tooling, infrastructure proximity to known operations, and targeting patterns aligned with Chinese strategic intelligence collection priorities. Multiple compromised government systems were identified, with coordination conducted through CERT-In for victim notification and remediation.

IOCs: 17 india government targeting

CRITICAL OTX PULSE

6/29/2026

The Gentlemen are knocking: сustom backdoors and evolving tactics

The Gentlemen ransomware-as-a-service group emerged as a top-10 threat actor in the first half of 2026. The group exploits vulnerabilities in internet-facing devices like VPNs and firewalls, potentially collaborating with initial access brokers. They employ comprehensive reconnaissance using tools like SharpADWS, NetScan, and Advanced IP Scanner, capturing network traffic with netsh. The attackers disable security products through BYOVD techniques using vulnerable drivers, and deploy custom Go-based backdoors and ransomware variants. They spread laterally via GPO deployment and PsExec, encrypt files using Curve25519 and XChaCha20, and recently developed a C-based ransomware variant using AES256-GCM and RSA. The group targets multiple industries worldwide, particularly in Brazil, China, Indonesia, Taiwan, and Thailand, with attacks focusing on manufacturing, IT services, healthcare, and financial sectors.

IOCs: 48 vulnerable drivers sharkloader

MEDIUM OTX PULSE

6/24/2026

AsyncRAT and Remcos delivered in an optimistic campaign

A global phishing campaign targets business functions with emails carrying malicious Excel attachments that initiate a multi-stage infection chain when macros are enabled. The attack uses layered obfuscation, including HTA scripts, PowerShell, encoded payloads, and steganography in PNG files, to deliver and execute Remote Access Trojans such as Remcos and AsyncRAT in a largely fileless manner. It achieves scale and persistence through high variability, automation, disposable infrastructure, and consistent patterns that help evade detection despite relatively simple techniques.

IOCs: 99 Steganography phishing

HIGH OTX PULSE

6/22/2026

3CXDesktopApp Intrusion Campaign Prevention

A sophisticated supply chain attack compromised the legitimate 3CXDesktopApp softphone application across Windows, macOS, and Linux platforms. The malicious activity involved trojanized signed installers that deployed a compromised ffmpeg.dll binary, establishing HTTPS beacons to attacker-controlled infrastructure and enabling second-stage payload deployment. Analysis revealed the attack utilized specific beacon structures and encryption keys matching infrastructure patterns, with hands-on-keyboard activity observed in targeted cases. The operation affected multiple platforms through signed MSI installers containing malicious components. The attack demonstrated advanced tradecraft through abuse of trusted software distribution channels, requiring immediate removal of affected versions and deployment of behavioral detection capabilities to identify malicious beaconing activity.

IOCs: 29 softphone trojanized installer

LOW OTX PULSE

6/19/2026

Inside the FortiBleed Open Directory: A Technical Analysis of What the Attacker Left Behind

An exposed attacker server has unveiled FortiBleed, a large-scale credential-compromise campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways globally. This operation involved credential harvesting through reuse, brute force, and hash cracking using a distributed GPU infrastructure with approximately 36 rented GPUs via Hashtopolis. The exposed directory contained 319 files revealing scanning tools, cracking infrastructure, credential databases, post-exploitation toolkits, and active VPN configurations. While initially reported as affecting 21,632 domains, analysis of the attacker's own tooling reveals only 918 organizations showed evidence of internal network compromise, with merely 148 confirmed cases where credentials were fully cracked. The operation ultimately aimed to sell initial access to compromised networks, with victims spanning 194 countries, predominantly India, United States, and Taiwan.

IOCs: 7 vpn compromise hash cracking

LOW OTX PULSE

6/19/2026

Threat Actors Weaponizing RAR Archives to Target Thailand's Healthcare Sector

An active malware campaign is targeting Thailand's healthcare sector, including Ministry of Health personnel and affiliated organizations. The operation leverages healthcare-themed spear-phishing lures distributed through malicious RAR archives containing obfuscated batch scripts and executable payloads. The infection chain employs multiple stages of obfuscation, GitHub-hosted payload delivery, and persistence mechanisms. The final payload is a Python-based information stealer designed to harvest browser credentials, session data, and cookies, with exfiltration attempts through Telegram Bot API. The campaign demonstrates sophisticated tradecraft including Rouki-obfuscated batch loaders, Startup folder persistence, and bundled Python interpreters. Active operational window spans from April to June 2026, with all samples uploaded from Thailand.

IOCs: 9 batch script obfuscation github payload hosting

HIGH OTX PULSE

6/19/2026

Operation Poisson – Analyzing a Cybercriminal’s Entire Operation

A comprehensive analysis of 339 commands issued by a French-speaking threat actor nicknamed 'Poisson' over 33 days, targeting a French automotive small business and four French individuals. The attacker utilized a multi-stage fileless attack deploying a 70-line Python keylogger to harvest banking and email credentials. The operation leveraged free-tier infrastructure including Havoc C2 framework, Backblaze B2 storage, and DuckDNS. Most significantly, the attacker installed OpenSSH and Tailscale VPN on victim machines, creating persistent access that survived C2 server takedown. When the C2 went offline for 18 days, the attacker's access remained intact through the VPN mesh, demonstrating that VPN-mesh-based persistence is actively used in real-world intrusions and that traditional C2 takedown is insufficient for remediation.

IOCs: 13 tailscale rustdesk

LOW OTX PULSE

6/19/2026

Analysis of Gamaredon campaign targeting Ukraine weaponizing CVE-2025-8088

A campaign exploiting the WinRAR path-traversal vulnerability CVE-2025-8088 has been actively targeting Ukraine since February 2026, with ongoing activity through June 2026. The operation uses Ukrainian military and conscription-themed documents as lures, distributed as RAR archives. The malicious archives contain NTFS alternate data streams with path-traversal sequences that automatically place LNK files into the Windows Startup folder upon extraction. These shortcuts execute hidden PowerShell stagers incorporating anti-analysis techniques including debugger checks, disk-space verification, and sleep delays to evade sandbox detection. The persistent nature of the attacks demonstrates continuous targeting of Ukrainian entities over a four-month period using social engineering focused on military documentation themes.

IOCs: 25 path-traversal cve-2025-8088

LOW OTX PULSE

6/19/2026

OXLOADER: new loader evading detection to drop infostealer

A previously undocumented Windows loader designated as OXLOADER delivers the CASTLESTEALER infostealer through malicious Google Ads campaigns, achieving remarkably low detection rates. The loader employs multiple obfuscation layers including control-flow flattening, opaque predicates, and mixed Boolean-Arithmetic techniques, along with self-modifying decryption stubs and abuse of the Windows .reloc section for shellcode staging. Distribution occurs via malvertising impersonating Node.js installations, redirecting victims through intermediary domains to Storj-hosted batch scripts. The loader implements five anti-VM and language checks, including CIS-region and Russian-language exclusions, suggesting a financially motivated Russian-speaking threat actor. OXLOADER uses DonutLoader to deliver the .NET-based CASTLESTEALER payload in memory, evading traditional detection mechanisms through deliberate engineering choices.

SideCopy, also tracked as APT36 or Transparent Tribe, has launched a new attack campaign targeting Indian defense personnel using a fake 'Minutes Of Meeting' document as lure. The attack employs an identical playbook to previous operations: a double-extension Minutes Of Meeting.docx.lnk file executes a PowerShell stager (pdfdocs.bat) from a nested pdfdocs folder while displaying a clean decoy document. The chain deploys a Remote Access Trojan (pdfdocs) that establishes persistence through the HKCU Run key. The staged components demonstrate low detection rates at initial delivery, with the decoy document scoring 0/66, the stager 1/61, and only the final executable reaching 35/71 detections.

Attackers deploying DragonForce ransomware against a major U.S. services firm concealed their command-and-control traffic within Microsoft Teams relay infrastructure using Backdoor.Turn, a custom Go-based remote access trojan. This novel technique leverages anonymous Teams visitor tokens and TURN relay servers to mask malicious communications as legitimate Microsoft traffic. The intrusion lasted one to two months, beginning in December 2025 with exploitation of an SQL server vulnerability. Attackers employed sophisticated defense evasion tactics including DLL side-loading with VirtualBox executables and multiple Bring Your Own Vulnerable Driver techniques. They exploited a previously unknown vulnerability in Huawei's HWAuidoOs2Ec.sys driver, along with several other vulnerable drivers, to terminate security processes at kernel level. The campaign demonstrates DragonForce's evolution into a highly capable ransomware cartel with advanced operational maturity.

DragonForce

IOCs: 31 dragonforce dll side-loading

PK DORMANT

Stealth Mango and Tangelo

This threat actor targets organizations in the satellite communications, telecommunications, geospatial-imaging, and defense secto…

CN DORMANT

1937CN

1937CN is a Chinese hacking group that has been active since at least 2013. The group is known for targeting Vietnamese organizati…

IQ DORMANT

313 Team

313 Team is an Iraq-based threat actor that has conducted coordinated DDoS campaigns targeting multiple government servers in the …

SY DORMANT

APT-C-27

A threat actor which is ac tive since at least November 2014. This group launched long-term at tacks against organizations in the …

AKA: GoldMouse Golden RAT ATK80

PLA Navy Anchor Panda is an adversary that CrowdStrike has tracked extensively over the last year targeting both civilian and mili…

AKA: ANCHOR PANDA QAZTeam ALUMINUM

Targets: Other Aerospace Defense

CN DORMANT

APT15

This threat actor uses phishing techniques to compromise the networks of foreign ministries of European countries for espionage pu…

AKA: VIXEN PANDA Ke3Chang Playful Dragon Metushy

Targets: Government Administration

CN DORMANT

Putter Panda were the subject of an extensive report by CrowdStrike, which stated: 'The CrowdStrike Intelligence team has been tra…

AKA: PLA Unit 61486 PUTTER PANDA MSUpdater 4HCrew

CN DORMANT

APT20

We’ve uncovered some new data and likely attribution regarding a series of APT watering hole attacks this past summer. Watering ho…

AKA: VIOLIN PANDA TH3Bug Crawling Taurus

CN DORMANT

APT21

AKA: HAMMER PANDA TEMP.Zhenbao NetTraveler

CN DORMANT

APT22

Suckfly is a China-based threat group that has been active since at least 2014

AKA: G0039 Suckfly BRONZE OLIVE Group 46

CN DORMANT

APT23

TrendMicro described Tropic Trooper in a 2015 report as: 'Taiwan and the Philippines have become the targets of an ongoing campaig…

AKA: PIRATE PANDA KeyBoy Tropic Trooper BRONZE HOBART

Targets: Military Government Administration

CN DORMANT

APT24

The Pitty Tiger group has been active since at least 2011. They have been seen using HeartBleed vulnerability in order to directly…

AKA: PITTY PANDA G0011 Temp.Pittytiger

CN DORMANT

APT26

AKA: JerseyMikes TURBINE PANDA BRONZE EXPRESS TECHNETIUM

CN DORMANT

APT27

A China-based actor that targets foreign embassies to collect data on government, defence, and technology sectors.

AKA: GreedyTaotie TG-3390 EMISSARY PANDA TEMP.Hippo

Targets: Technology Government Administration

RU DORMANT

APT28

The Sofacy Group (also known as APT28, Pawn Storm, Fancy Bear and Sednit) is a cyber espionage group believed to have ties to the …

AKA: Pawn Storm FANCY BEAR Sednit SNAKEMACKEREL

Targets: Military Government Administration

RU DORMANT

APT29

A 2015 report by F-Secure describe APT29 as: 'The Dukes are a well-resourced, highly dedicated and organized cyberespionage group …

AKA: Group 100 COZY BEAR The Dukes Minidionis

Targets: Think Tanks Government Administration

CN ACTIVE

APT3

Symantec described UPS in 2016 report as: 'Buckeye (also known as APT3, Gothic Panda, UPS Team, and TG-0110) is a cyberespionage …

AKA: GOTHIC PANDA TG-0110 Group 6 UPS

Targets: Political party

CN DORMANT

APT30

APT30 is a threat group suspected to be associated with the Chinese government. While Naikon shares some characteristics with APT3…

AKA: G0013

CN DORMANT

APT31

FireEye characterizes APT31 as an actor specialized on intellectual property theft, focusing on data and projects that make a part…

AKA: ZIRCONIUM JUDGMENT PANDA BRONZE VINEWOOD Red keres

VN DORMANT

APT32

Cyber espionage actors, now designated by FireEye as APT32 (OceanLotus Group), are carrying out intrusions into private sector com…

AKA: OceanLotus Group Ocean Lotus OceanLotus Cobalt Kitty

Targets: Dissidents Government Administration

IR DORMANT

APT33

Our analysis reveals that APT33 is a capable group that has carried out cyber espionage operations since at least 2013. We assess …

AKA: APT 33 Elfin MAGNALLIUM Refined Kitten

IR DORMANT

APT35

FireEye has identified APT35 operations dating back to 2014. APT35, also known as the Newscaster Team, is a threat group sponsored…

AKA: Newscaster Team Magic Hound G0059 Phosphorus

KP DORMANT

APT37

APT37 has likely been active since at least 2012 and focuses on targeting the public and private sectors primarily in South Korea.…

AKA: APT 37 Group 123 Group123 InkySquid

IR DORMANT

APT39

APT39 was created to bring together previous activities and methods used by this actor, and its activities largely align with a gr…

AKA: Chafer REMIX KITTEN COBALT HICKMAN G0087

CN DORMANT

APT4

AKA: PLA Navy MAVERICK PANDA BRONZE EDISON SODIUM

CN DORMANT

Ababil of Minab is an emerging pro-Iranian hacktivist group with a limited public profile and little verifiable prior activity in …

IQ DORMANT

Altahrea Team

Altahrea Team is a pro-Iranian hacking group that has been active since at least 2020. The group has claimed responsibility for a …

CN DORMANT

Amaranth-Dragon

Amaranth-Dragon is a previously untracked threat actor assessed to be closely linked to the China-affiliated APT 41 ecosystem, exh…

LB DORMANT

Amethyst Rain

Microsoft threat actor profile. Origin/Threat: Lebanon.

AKA: VolcanicTimber Volatile Cedar

RU DORMANT

Angry Likho

Angry Likho is an APT group that has been active since 2023, primarily targeting large organizations and government agencies in Ru…

AKA: Sticky Werewolf

TW DORMANT

Anonymous64

Anonymous 64 is a group accused by China's national security ministry of attempting to gain control of web portals, outdoor electr…

AKA: Anonymous 64

CN DORMANT

Antlion

Antlion is a Chinese state-backed advanced persistent threat (APT) group, who has been targeting financial institutions in Taiwan.…

CN DORMANT

Aoqin Dragon

SentinelLabs has uncovered a cluster of activity beginning at least as far back as 2013 and continuing to the present day, primari…

AKA: UNC94

IR DORMANT

AppMilad

AppMilad is an Iranian hacking group that has been identified as the source of a spyware campaign called RatMilad. This spyware is…

PS DORMANT

AridViper

AridViper is a state-sponsored APT primarily targeting military personnel, journalists, and dissidents in the Middle East, with a …

AKA: Desert Falcon Arid Viper APT-C-23 Bearded Barbie

TR DORMANT

Aslan Neferler Tim

Turkish nationalist hacktivist group that has been active for roughly one year. According to Domaintools, the group’s site has bee…

AKA: Lion Soldiers Team Phantom Turk

Targets: Government Administration News - Media

CN DORMANT

Avivore

The group’s existence came to light during Context’s investigation of a number of attacks against multinational enterprises that c…

TR DORMANT

Ayyıldız Tim

Ayyıldız (Crescent and Star) Tim is a nationalist hacking group founded in 2002. It performs defacements and DDoS attacks against …

AKA: Crescent and Star

Targets: Government Administration

IT DORMANT

AzzaSec

AzzaSec is a hacktivist group that originated in Italy. Known for their pro-Palestine stance, they have been involved in various c…

IR DORMANT

BANISHED KITTEN

BANISHED KITTEN is an Iranian state-nexus adversary active since at least 2008. While the adversary’s most prominent activity is t…

AKA: DUNE Storm-0842 Red Sandstorm

In December 2020, the IT management software provider SolarWinds announced that an unidentified threat actor had exploited a vulne…

CN DORMANT

BRONZE SPRING

BRONZE SPRING is a threat group that CTU researchers assess with high confidence operates on behalf of China in the theft of intel…

AKA: UNC302

CN DORMANT

BRONZE STARLIGHT

BRONZE STARLIGHT has been active since mid 2021 and targets organizations globally across a range of industry verticals. The group…

AKA: SLIME34 DEV-0401 Cinnamon Tempest Emperor Dragonfly

CN DORMANT

BRONZE VAPOR

BRONZE VAPOR is a targeted threat group assessed with moderate confidence to be of Chinese origin. Artefacts from tools associated…

VN DORMANT

BatShadow

BatShadow is a Vietnamese threat actor that targets job seekers and digital marketing professionals through social engineering cam…

UA DORMANT

Bearlyfy

Bearlyfy has been attributed to over 70 cyber attacks targeting Russian companies since its emergence in January 2025, employing a…

AKA: Labubu

CN DORMANT

Beijing Group

AKA: SNEAKY PANDA Elderwood Elderwood Gang SIG22

PS DORMANT

BiBiGun

A pro-Hamas hacktivist group developed a wiper called BiBi-Linux to target and destroy data on Israeli systems. The malware impers…

KE DORMANT

Bignosa

Bignosa is a threat actor known for launching malware campaigns targeting Australian and US organizations using phishing emails wi…

UA DORMANT

BlackJack

Blackjack, a threat actor linked to Ukraine's security apparatus, has targeted critical Russian entities such as ISPs, utilities, …

CN DORMANT

BlackTech

BlackTech is a cyber espionage group operating against targets in East Asia, particularly Taiwan, and occasionally, Japan and Hong…

AKA: CIRCUIT PANDA Temp.Overboard HUAPI Palmerworm

PS DORMANT

Blackatom

Recent campaigns suggest Hamas-linked actors may be advancing their TTPs to include intricate social engineering lures specially c…

CN DORMANT

Blackgear

BLACKGEAR is an espionage campaign which has targeted users in Taiwan for many years. Multiple papers and talks have been released…

AKA: Topgear Comnie BLACKGEAR

PS DORMANT

Blackmeta

BLACKMETA is a pro-Palestinian hacktivist group that has claimed responsibility for a series of DDoS attacks and data breaches tar…

AKA: SN Blackmeta

CN DORMANT

Blackwood

Blackwood is a China-aligned APT group that has been active since at least 2018. They primarily engage in cyberespionage operation…

IR DORMANT

BladedFeline

BladedFeline is an Iran-aligned APT group that has been active since at least 2017, targeting Iraqi and Kurdish government officia…

CN DORMANT

Blue Termite

Blue Termite is a group of suspected Chinese origin active in Japan.

AKA: Cloudy Omega Emdivi

IL DORMANT

Blue Tsunami

Blue Tsunami, also known as Black Cube, is a cyber mercenary group associated with the private intelligence firm Black Cube. They …

AKA: Black Cube

IR DORMANT

Bohrium

Bohrium is an Iranian threat actor that has been involved in spear-phishing operations targeting organizations in the US, Middle E…

AKA: Smoke Sandstorm BOHRIUM IMPERIAL KITTEN

RU DORMANT

Boulder Bear

First observed activity in December 2013.

CN DORMANT

BrazenBamboo

BrazenBamboo is a Chinese state-affiliated threat actor known for developing the LIGHTSPY, DEEPDATA, and DEEPPOST malware families…

CN DORMANT

Budminer

Based on the evidence we have presented Symantec attributed the activity involving theDripion malware to the Budminer advanced thr…

AKA: Budminer cyberespionage group

RU DORMANT

BuhTrap

Buhtrap has been active since 2014, however their first attacks against financial institutions were only detected in August 2015. …

Targets: Bank Payment Finance

RU DORMANT

CIRCUS SPIDER

According to Crowdstrike, the NetWalker ransomware is being developed and maintained by a Russian-speaking actor designated as CIR…

CN DORMANT

CL-STA-0048

CL-STA-0048 is a Chinese state-backed APT that targets strategic sectors in South Asia, particularly government and telecommunicat…

AKA: CL STA 0048

CN DORMANT

CL-STA-1087

CL-STA-1087 is a suspected state-sponsored espionage campaign operating out of China, targeting military organizations in Southeas…

CN DORMANT

CL-UNK-1068

CL-UNK-1068 is a Chinese threat actor that has targeted critical infrastructure in Asia, primarily focusing on cyberespionage. The…

IR DORMANT

Cadelle

Symantec telemetry identified Cadelle and Chafer activity dating from as far back as July 2014, however, it’s likely that activity…

RU DORMANT

Callisto

The Callisto Group is an advanced threat actor whose known targets include military personnel, government officials, think tanks, …

AKA: COLDRIVER SEABORGIUM TA446 GOSSAMER BEAR

Targets: Government Administration Military Think Tanks

CN DORMANT

Calypso

For the first time, the activity of the Calypso group was detected by specialists of PT Expert Security Center in March 2019, duri…

AKA: BRONZE MEDLEY Red Lamassu

Targets: Government Administration

CN DORMANT

Camaro Dragon

In early 2023, the Check Point Incident Response Team (CPIRT) team investigated a malware incident at a European healthcare instit…

CN DORMANT

CardinalLizard

CardinalLizard, a cyber threat actor linked to China, has targeted entities in Asia since 2018. Their methods include spear-phishi…

ES DORMANT

Careto

This threat actor targets governments, diplomatic missions, private companies in the energy sector, and academics for espionage pu…

AKA: The Mask Mask Ugly Face

IL DORMANT

Carmine Tsunami

Carmine Tsunami is a threat actor linked to an Israel-based private sector offensive actor called QuaDream. QuaDream sells a platf…

AKA: DEV-0196 QuaDream

CN DORMANT

CeranaKeeper

CeranaKeeper is a China-aligned APT that has been active since at least early 2022, primarily targeting governmental institutions …

IR DORMANT

Charming Kitten

Charming Kitten (aka Parastoo, aka Newscaster) is an group with a suspected nexus to Iran that targets organizations involved in g…

AKA: Newscaster Parastoo iKittens Group 83

Targets: Defense Diplomacy Military

CN DORMANT

Chaya_004

Chaya_004 is a Chinese threat actor identified through malicious infrastructure, including a network of servers hosting Supershell…

RU DORMANT

Chernovite

Chernovite is a highly capable and sophisticated threat actor group that has developed a modular ICS malware framework called PIPE…

IR DORMANT

Cleaver

A group of cyber actors utilizing infrastructure located in Iran have been conducting computer network exploitation activity again…

AKA: Operation Cleaver Op Cleaver Tarh Andishan Alibaba

Cotton Sandstorm is an Iranian threat actor involved in hack-and-leak operations. They have targeted various organizations, includ…

AKA: Emennet Pasargad Holy Souls MARNANBRIDGE NEPTUNIUM

IR DORMANT

Cuboid Sandstorm

Cuboid Sandstorm is an Iranian threat actor that targeted an Israel-based IT company in July 2021. They gained access to the compa…

AKA: DEV-0228

CN DORMANT

Curious Gorge

Curious Gorge, a group TAG attributes to China's PLA SSF, has conducted campaigns against government and military organizations in…

AKA: UNC3742

RU DORMANT

Curly COMrades

Curly COMrades is a threat actor identified by Amazon Threat Intelligence and Bitdefender, believed to operate in support of Russi…

IR DORMANT

Cutting Kitten

One of the threat actors responsible for the denial of service attacks against U.S in 2012–2013. Three individuals associated with…

AKA: ITsecTeam

UA DORMANT

Cyber Alliance

The Ukrainian Cyber Alliance is a pro-Ukraine hacktivist group formed in 2016, primarily targeting Russian entities since the inva…

IR DORMANT

Cyber Av3ngers

Cyber Av3ngers is an Iranian IRGC Cyber-Electronic Command-affiliated threat actor that targets internet-exposed operational techn…

AKA: CyberAv3ngers Shahid Kaveh Group

RU DORMANT

Cyber Berkut

IR DORMANT

Cyber Islamic Resistance

Cyber Islamic Resistance is a hacktivist collective ideologically aligned with Iran, engaging in operations such as website deface…

BY DORMANT

Cyber Partisans

The Cyber Partisans, a hacktivist group based in Belarus, has been involved in various cyber-attacks targeting organizations and i…

RU DORMANT

Cyber Serp

UAC-0255 is a threat actor that conducted a phishing campaign impersonating CERT-UA to distribute the AGEWHEEZE RAT, targeting org…

AKA: UAC-0255

IR DORMANT

Cyber Toufan

Cyber Toufan is a threat actor group that has gained prominence for its cyberattacks targeting Israeli organizations. The group's …

IR DORMANT

Cyber fighters of Izz Ad-Din Al Qassam

AKA: Fraternal Jackal

UA DORMANT

Cyber.Anarchy.Squad

Cyber Anarchy Squad is a pro-Ukrainian hacktivist group known for targeting Russian companies and infrastructure. They have carrie…

AKA: Cyber Anarchy Squad

CN DORMANT

DAGGER PANDA

Operate since at least 2011, from several locations in China, with members in Korea and Japan as well. Possibly linked to Onion D…

AKA: IceFog Trident RedFoxtrot Red Wendigo

Targets: Other Maritime Military

CN DORMANT

DEV-0147

DEV-0147 is a China-based cyber espionage actor was observed compromising diplomatic targets in South America, a notable expansion…

IR DORMANT

DEV-0270

Microsoft threat intelligence teams have been tracking multiple ransomware campaigns and have tied these attacks to DEV-0270, also…

AKA: Nemesis Kitten Storm-0270

RU DORMANT

DEV-0586

MSTIC has not found any notable associations between this observed activity, tracked as DEV-0586, and other known activity groups.…

AKA: Ruinous Ursa Cadet Blizzard

CN DORMANT

Dalbit

The group usually targets vulnerable servers to breach information including internal data from companies or encrypts files and de…

LB DORMANT

Dark Caracal

Lookout and Electronic Frontier Foundation (EFF) have discovered Dark Caracal, a persistent and prolific actor, who at the time of…

AKA: G0070

KR DORMANT

DarkHotel

Kaspersky described DarkHotel in a 2014 report as: '... DarkHotel drives its campaigns by spear-phishing targets with highly advan…

AKA: DUBNIUM Fallout Team Karba Luder

SY DORMANT

Deadeye Jackal

The Syrian Electronic Army (SEA) is a group of computer hackers which first surfaced online in 2011 to support the government of S…

AKA: SyrianElectronicArmy SEA

CN DORMANT

ELOQUENT PANDA

KP DORMANT

ELUSIVE COMET

ELUSIVE COMET is a threat actor responsible for significant cryptocurrency theft through sophisticated social engineering attacks,…

RU ACTIVE

ENERGETIC BEAR

A Russian group that collects intelligence on the energy industry.

AKA: BERSERK BEAR ALLANITE CASTLE DYMALLOY

Targets: Energy

CN DORMANT

Earth Alux

Earth Alux is a China-linked APT group known for conducting cyberespionage attacks across various sectors, including government, t…

CN DORMANT

Earth Baxia

Earth Baxia is a threat actor opearting out of China, targeting government organizations in Taiwan and potentially across the APAC…

CN DORMANT

Earth Berberoka

According to TrendMicro, Earth Berberoka is a threat group originating from China that mainly focuses on targeting gambling websit…

AKA: GamblingPuppet

CN DORMANT

Earth Freybug

Earth Freybug, identified as a subset of APT41, is a cyberthreat group active since at least 2012, engaging in espionage and finan…

CN DORMANT

Earth Naga is an APT group that has persistently targeted high-value organizations, including government agencies, telecommunicati…

CN DORMANT

Earth Wendigo

Earth Wendigo is a threat actor from China that has been targeting several organizations — including government organizations, res…

IR DORMANT

Edalat-e Ali

Edalat-e Ali is a hacktivist group known for disrupting Iranian state-run TV and radio transmissions during significant events, su…

IR DORMANT

Educated Manticore

Educated Manticore is an Iranian APT group aligned with the Islamic Revolutionary Guard Corps, primarily engaged in espionage targ…

US DORMANT

Equation Group

The Equation Group is a highly sophisticated threat actor described by its discoverers at Kaspersky Labs as one of the most sophis…

AKA: Tilded Team EQGRP G0020

CN DORMANT

Evasive Panda

Evasive Panda is an APT group that has been active since at least 2012, conducting cyberespionage targeting individuals, governmen…

AKA: BRONZE HIGHLAND

RU DORMANT

EvilWeb

EvilWeb is a pro-Russian hacktivist group created in March 2024 that targets American and European entities using a hack-and-leak …

RU DORMANT

FIN1

FireEye first identified this activity during a recent investigation at an organization in the financial industry. They identified…

RU DORMANT

FIN13

Since 2017, Mandiant has been tracking FIN13, an industrious and versatile financially motivated threat actor conducting long-term…

AKA: TG2003 Elephant Beetle

RU DORMANT

FIN7

Groups targeting financial organizations or people with significant financial assets.

AKA: CARBON SPIDER GOLD NIAGARA Calcium ATK32

CN DORMANT

FOXY PANDA

Adversary group targeting telecommunication and technology organizations.

Targets: Technology Telecoms

RU DORMANT

Femwar02

Femwar02 is a previously unknown pro-Russian ransomware threat actor that emerged in early 2026, linked to a major cyberattack on …

IR ACTIVE

Ferocious Kitten

Ferocious Kitten is an APT group that has been active against Persian-speaking individuals since 2015 and appears to be based in I…

CN DORMANT

Flax Typhoon

Flax Typhoon is a Chinese state-sponsored threat actor that primarily targets organizations in Taiwan. They conduct espionage camp…

AKA: Ethereal Panda Storm-0919

IR DORMANT

Flying Kitten

Activity: defense and aerospace sectors, also interested in targeting entities in the oil/gas industry.

AKA: SaffronRose Saffron Rose AjaxSecurityTeam Ajax Security Team

Targets: Aerospace Defense Gas

RU DORMANT

FlyingYeti

FlyingYeti is a Russia-aligned threat actor targeting Ukrainian military entities. They conduct reconnaissance activities and laun…

AKA: Storm-1837 Flying Yeti

IR DORMANT

Fox Kitten

PIONEER KITTEN is an Iran-based adversary that has been active since at least 2017 and has a suspected nexus to the Iranian govern…

AKA: PIONEER KITTEN PARISITE UNC757 Lemon Sandstorm

BY DORMANT

FrostyNeighbor

FrostyNeighbor is a Belarus-aligned APT group known for conducting influence and disinformation campaigns, particularly targeting …

CN DORMANT

GALLIUM

GALLIUM, is a threat actor believed to be targeting telecommunication providers over the world, mostly South-East Asia, Europe and…

AKA: Red Dev 4 Alloy Taurus Granite Typhoon PHANTOM PANDA

RU DORMANT

GCMAN

GCMAN is a threat group that focuses on targeting banks for the purpose of transferring money to e-currency services.

AKA: G0036

Targets: Bank

CN DORMANT

GHOST STADIUM

GHOST STADIUM is a Chinese-speaking, financially motivated threat actor operating a sophisticated phishing campaign across over 30…

CN DORMANT

GIBBERISH PANDA

CN DORMANT

GOBLIN PANDA

Goblin Panda is one of a handful of elite Chinese advanced persistent threat (APT) groups. Most Chinese APTs target the United Sta…

AKA: Conimes Cycldek

CN DORMANT

GREF

GREF is a China-aligned APT group that has been active since at least March 2017. They are known for using custom backdoors, loade…

CN DORMANT

GTG-1002

GTG-1002 is a Chinese state-sponsored APT that conducted a large-scale autonomous cyber espionage campaign targeting approximately…

RU DORMANT

Gamaredon Group

Unit 42 threat researchers have recently observed a threat group distributing new, custom developed malware. We have labelled this…

AKA: ACTINIUM DEV-0157 Blue Otso BlueAlpha

CN DORMANT

GhostEmperor

Greenbug

Greenbug was discovered targeting a range of organizations in the Middle East including companies in the aviation, energy, governm…

Targets: Education Energy Investment

RU DORMANT

GreyVibe

GREYVIBE is a low-to-moderately sophisticated threat actor associated with Russian state interests, primarily targeting Ukrainian …

UA DORMANT

Groundbait

Groundbait is a group targeting anti-government separatists in the self-declared Donetsk and Luhansk People’s Republics.

Targets: Separatists

CN DORMANT

HAFNIUM

HAFNIUM primarily targets entities in the United States across a number of industry sectors, including infectious disease research…

AKA: ATK233 G0125 Operation Exchange Marauder Red Dev 13

IN DORMANT

HAZY TIGER

The Bitter threat group initially started using RAT tools in their campaigns, as the first Bitter versions, for Android released i…

AKA: Bitter T-APT-17 APT-C-08 Orange Yali

CN DORMANT

HURRICANE PANDA

We have investigated their intrusions since 2013 and have been battling them nonstop over the last year at several large telecommu…

Targets: Technology Telecoms

PS DORMANT

Handala

Handala is a pro-Palestinian hacktivist group that targets Israeli organizations, employing tactics such as phishing, data theft, …

CN DORMANT

Hellsing

This threat actor uses spear-phishing techniques to compromise diplomatic targets in Southeast Asia, India, and the United States.…

Microsoft threat actor profile. Origin/Threat: China.

AKA: HASSIUM DRAGNET PANDA isoon deepclif

CN DORMANT

HummingBad

This group created a malware that takes over Android devices and generates $300,000 per month in fraudulent ad revenue. The group…

RU DORMANT

Hunt3r Kill3rs

Hunt3r Kill3rs is a newly emerged threat group claiming expertise in cyber operations, including ICS breaches and web application …

CN DORMANT

IMPERSONATING PANDA

ID DORMANT

INDOHAXSEC TEAM

INDOHAXSEC TEAM is an Indonesian group that claims to have developed a web-based version of WannaCry, asserting the ability to enc…

RU DORMANT

INDRIK SPIDER

INDRIK SPIDER is a sophisticated eCrime group that has been operating Dridex since June 2014. In 2015 and 2016, Dridex was one of …

AKA: Manatee Tempest

IR DORMANT

IRIDIUM

Resecurity’s research indicates that the attack on Parliament is a part of a multi-year cyberespionage campaign orchestrated by a …

Priority Threats

Live Feed Last 24 hours

Active IOC Feed

Analyst Tools

Threat Intelligence News

Ransomware activity

thegentlemen

lockbit5

qilin

safepay

incransom

shinyhunters

nova

dragonforce

nightspire

threeam

genesis

icarus

medusalocker

akira

deadlock

krybit

payload

apt73

aurora

play

spacebears

booba project

chaos

cmdorganization

m3rx

doommageddon

anubis

braincipher

direwolf

wallstreet

ailock

cloak

lynx

bravox

coinbasecartel

gunra

interlock

lapsus$

payoutsking

pear

ransomhouse

shadowbyt3$

silentransomgroup

stormous

triple x

worldleaks

arcusmedia

auditteam

black x

blackfield

cry0

fulcrumsec

insomnia

lamashtu

morpheus

prinzeugen

ransomexx

securotrop

unsafe

0apt

0day syndicate

0mega

8base

abrahams_ax

abyss

adminlocker

againstthewest

agl0bgvycg

ako

alp-001

alphalocker

alphv

apos

argonauts