Security
Indicators of compromise
1,300 indicators auto-extracted from article text · hashes, IPs, domains, URLs · verify before use
Type
| Type | Indicator | Context | Article | First seen |
|---|---|---|---|---|
| domain | debugbear.com | r websites. The address that served the malicious file, cdn.debugbear[.]com, had no DNS record when The Hacker News checked on Novemb | Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script The Hacker News | · 13h ago |
| domain | openaigpt4v.com | minutes before issuing its first request to the C2 server ("openaigpt4v[.]com"), and enters into a periodic polling loop to fetch an XA | NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection The Hacker News | · 13h ago |
| ipv4 | 1.1.18.11 | fault timeout. These deadlocks ( #71 ) appeared resolved by 1.1.18.11.rc-7. Broken Features Orkes’ public documentation claimed b | Jepsen: ParticleDB 1.1.4 Hacker News · AI | · 1d ago |
| domain | rolimons.com | m's account profile. Roblox inventory is valued via a live “Rolimons[.]com” lookup. Figure 7. That’s right: Your Uber Eats history i | Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer Cisco Talos | · 1d ago |
| sha256 | 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279 | net and a wide net that sorts itself. Sample details SHA256 57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279 Filename 9BY0tjwOc3ut.exe /… | Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealer Cisco Talos | · 1d ago |
| ipv4 | 134.209.82.225 | sh a shared attacker. Cursor’s published indicators include 134[.]209[.]82[.]225 , SSH connections on TCP port 22, and HTTP POST traff | Cursor Confirms Malicious Claude Code Extension With SSH Backdoor Was Available for 11 Hours Cyber Security News | · 1d ago |
| sha256 | 06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7 | eb70bd1bb5446e2e46f001 SHA-256 Initial Access python script 06c5c14f043aee3bcc5843b5f50909623d5c9a6239a7c1fba9cddad4111469e7 SHA-256 Initial Access python… | Hackers Impersonate IT Help Desk on Microsoft Teams to Gain Domain Admin Access via AD CS Attacks GBHackers | · 1d ago |
| sha256 | 85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17 | tickets. Indicators of compromise (IOC) Indicator Type Role 85b6c424117494d3056e88689dbc94c75e9afdb187a339714043aec0da109f17 SHA-256 Initial Access Java… | Hackers Impersonate IT Help Desk on Microsoft Teams to Gain Domain Admin Access via AD CS Attacks GBHackers | · 1d ago |
| sha256 | f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001 | 87a339714043aec0da109f17 SHA-256 Initial Access Java Script f326201269f1ee2f803ae435317507263bb6e0dbfdeb70bd1bb5446e2e46f001 SHA-256 Initial Access python… | Hackers Impersonate IT Help Desk on Microsoft Teams to Gain Domain Admin Access via AD CS Attacks GBHackers | · 1d ago |
| ipv4 | 134.209.82.225 | ion and uses retry loops to reconnect. Microsoft identified 134.209.82[.]225 as the configured SSH and HTTP destination. On macOS, per | Hackers Distribute Malicious Claude Code Extension on Cursor Marketplace to Install Persistent SSH Backdoor GBHackers | · 1d ago |
| sha256 | 7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278 | ry point; not a Visual Studio extension (VSIX) package hash 7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278 SHA256 Decoded tunnel private-key… | Hackers Distribute Malicious Claude Code Extension on Cursor Marketplace to Install Persistent SSH Backdoor GBHackers | · 1d ago |
| sha256 | ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15 | orary tunnel identity; pattern rather than literal filename ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15 SHA256 JavaScript entry point… | Hackers Distribute Malicious Claude Code Extension on Cursor Marketplace to Install Persistent SSH Backdoor GBHackers | · 1d ago |
| url | http://134.209.82.225:8099/beacon | .]225 IP address Configured remote SSH and HTTP destination hxxp://134[.]209[.]82[.]225:8099/beacon URL Reconnaissance endpoint; correlate with the confi | Hackers Distribute Malicious Claude Code Extension on Cursor Marketplace to Install Persistent SSH Backdoor GBHackers | · 1d ago |
| ipv4 | 101.133.233.159 | 0[.]81 AS149440 Evoxt JP Shared 9bie kit (variant), lab RCE 101.133.233[.]159 AS37963 Alibaba Cloud CN Shared 9bie kit plus scanner 144 | Hackers Exploit PHP2Shell RCE Vulnerabilities to Gain Root Access on Palo Alto Firewalls GBHackers | · 1d ago |
| ipv4 | 130.12.180.89 | .27.25[.]75 AS149440 Evoxt DE Staging; education/commercial 130.12.180[.]89 AS202412 Omegatech DE php2shell attempted, failed; pivote | Hackers Exploit PHP2Shell RCE Vulnerabilities to Gain Root Access on Palo Alto Firewalls GBHackers | · 1d ago |
| ipv4 | 130.94.67.235 | S211273 Cloud Software FZCO HK Dev/build box, Moodle victim 130.94.67[.]235:80,8080 AS154177 Light Node Limited JP PAN-OS repackage 4 | Hackers Exploit PHP2Shell RCE Vulnerabilities to Gain Root Access on Palo Alto Firewalls GBHackers | · 1d ago |
| ipv4 | 144.217.161.236 | .]159 AS37963 Alibaba Cloud CN Shared 9bie kit plus scanner 144.217.161[.]236 AS16276 OVH CA Staging; govt finance targets 152.42.245[. | Hackers Exploit PHP2Shell RCE Vulnerabilities to Gain Root Access on Palo Alto Firewalls GBHackers | · 1d ago |
| ipv4 | 15.204.59.70 | 94 AS19318 Interserver US Confirmed source, honeypot shells 15.204.59[.]70 AS16276 OVH US Confirmed source, honeypot shells 2.59.133 | Hackers Exploit PHP2Shell RCE Vulnerabilities to Gain Root Access on Palo Alto Firewalls GBHackers | · 1d ago |
| ipv4 | 152.42.245.8 | .217.161[.]236 AS16276 OVH CA Staging; govt finance targets 152.42.245[.]8 AS14061 DigitalOcean SG Staging; commercial targets 23.27 | Hackers Exploit PHP2Shell RCE Vulnerabilities to Gain Root Access on Palo Alto Firewalls GBHackers | · 1d ago |
| ipv4 | 162.35.99.94 | movement. IOCs IP / host ASN Hosting provider Country Role 162.35.99[.]94 AS19318 Interserver US Confirmed source, honeypot shells | Hackers Exploit PHP2Shell RCE Vulnerabilities to Gain Root Access on Palo Alto Firewalls GBHackers | · 1d ago |
| ipv4 | 185.242.106.140 | 45[.]102:8088 AS46475 Limestone Networks US Staging cluster 185.242.106[.]140:8000 AS42532 SIA VEESP LV Operational toolkit 45.39.190[. | Hackers Exploit PHP2Shell RCE Vulnerabilities to Gain Root Access on Palo Alto Firewalls GBHackers | · 1d ago |
| ipv4 | 208.115.245.102 | 245[.]99:8088 AS46475 Limestone Networks US Staging cluster 208.115.245[.]102:8088 AS46475 Limestone Networks US Staging cluster 185.24 | Hackers Exploit PHP2Shell RCE Vulnerabilities to Gain Root Access on Palo Alto Firewalls GBHackers | · 1d ago |
| ipv4 | 208.115.245.98 | ]151 AS58212 dataforest GmbH DE Confirmed source, GreyNoise 208.115.245[.]98:8088 AS46475 Limestone Networks US Staging cluster 208.11 | Hackers Exploit PHP2Shell RCE Vulnerabilities to Gain Root Access on Palo Alto Firewalls GBHackers | · 1d ago |
| ipv4 | 208.115.245.99 | 245[.]98:8088 AS46475 Limestone Networks US Staging cluster 208.115.245[.]99:8088 AS46475 Limestone Networks US Staging cluster 208.11 | Hackers Exploit PHP2Shell RCE Vulnerabilities to Gain Root Access on Palo Alto Firewalls GBHackers | · 1d ago |
| ipv4 | 23.27.25.75 | 245[.]8 AS14061 DigitalOcean SG Staging; commercial targets 23.27.25[.]75 AS149440 Evoxt DE Staging; education/commercial 130.12.18 | Hackers Exploit PHP2Shell RCE Vulnerabilities to Gain Root Access on Palo Alto Firewalls GBHackers | · 1d ago |
| ipv4 | 2.59.133.151 | 04.59[.]70 AS16276 OVH US Confirmed source, honeypot shells 2.59.133[.]151 AS58212 dataforest GmbH DE Confirmed source, GreyNoise 20 | Hackers Exploit PHP2Shell RCE Vulnerabilities to Gain Root Access on Palo Alto Firewalls GBHackers | · 1d ago |
| ipv4 | 34.146.20.31 | Host SRL MD Exploit-development host; lab info-leak working 34.146.20[.]31 AS396982 Google LLC JP Shared 9bie kit, lab RCE 38.60.136 | Hackers Exploit PHP2Shell RCE Vulnerabilities to Gain Root Access on Palo Alto Firewalls GBHackers | · 1d ago |
| ipv4 | 38.60.136.217 | 146.20[.]31 AS396982 Google LLC JP Shared 9bie kit, lab RCE 38.60.136[.]217 AS154177 Light Node Limited FR Shared 9bie kit, lab RCE 9 | Hackers Exploit PHP2Shell RCE Vulnerabilities to Gain Root Access on Palo Alto Firewalls GBHackers | · 1d ago |
| ipv4 | 45.225.135.53 | gatech DE php2shell attempted, failed; pivoted to other bug 45.225.135[.]53 AS64107 RACK SPHERE NL SMTP/XXE operator; php2shell scann | Hackers Exploit PHP2Shell RCE Vulnerabilities to Gain Root Access on Palo Alto Firewalls GBHackers | · 1d ago |
| ipv4 | 45.39.190.176 | 242.106[.]140:8000 AS42532 SIA VEESP LV Operational toolkit 45.39.190[.]176:8000 AS211273 Cloud Software FZCO HK Dev/build box, Moodl | Hackers Exploit PHP2Shell RCE Vulnerabilities to Gain Root Access on Palo Alto Firewalls GBHackers | · 1d ago |
| ipv4 | 45.83.180.113 | 235:80,8080 AS154177 Light Node Limited JP PAN-OS repackage 45.83.180[.]113:19001 AS62005 BlueVPS EE IoC/kit tracker 15.204.59[.]70:8 | Hackers Exploit PHP2Shell RCE Vulnerabilities to Gain Root Access on Palo Alto Firewalls GBHackers | · 1d ago |
| ipv4 | 85.121.179.129 | 4:8090 AS19318 Interserver US Metabase/H2, separate exploit 85.121.179[.]129 AS48753 AlexHost SRL MD Exploit-development host; lab inf | Hackers Exploit PHP2Shell RCE Vulnerabilities to Gain Root Access on Palo Alto Firewalls GBHackers | · 1d ago |
| ipv4 | 96.126.130.81 | 217 AS154177 Light Node Limited FR Shared 9bie kit, lab RCE 96.126.130[.]81 AS149440 Evoxt JP Shared 9bie kit (variant), lab RCE 101. | Hackers Exploit PHP2Shell RCE Vulnerabilities to Gain Root Access on Palo Alto Firewalls GBHackers | · 1d ago |
| ipv4 | 134.209.82.225 | ence of compromise on their own. Indicator Type Description 134.209.82[.]225 IP address Configured remote SSH and HTTP destination hxx | Inside a malicious Claude Code-branded extension and its persistent SSH backdoor Microsoft Security Blog | · 1d ago |
| sha256 | 7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278 | ry point; not a Visual Studio extension (VSIX) package hash 7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278 SHA256 Decoded tunnel private-key… | Inside a malicious Claude Code-branded extension and its persistent SSH backdoor Microsoft Security Blog | · 1d ago |
| sha256 | ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15 | eFileEvents | where Timestamp > ago(30d) | where SHA256 == "ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15" or FileName in~ ( ".smt"… | Inside a malicious Claude Code-branded extension and its persistent SSH backdoor Microsoft Security Blog | · 1d ago |
| url | http://134.209.82.225:8099/beacon | .]225 IP address Configured remote SSH and HTTP destination hxxp://134[.]209[.]82[.]225:8099/beacon URL Reconnaissance endpoint; correlate with the confi | Inside a malicious Claude Code-branded extension and its persistent SSH backdoor Microsoft Security Blog | · 1d ago |
| domain | artex.nhhh.de | ccount-pool management"). On October 8, 2026, a subdomain ( artex.nhhh.de ) resolving to 23.106.46.239 hosted a page with the title “ | “Black October” for AI Developer Platforms Wiz Blog | · 1d ago |
| domain | direct.465415.xyz | 6.239 in early 2026 and another site tied via passive dns ( direct.465415.xyz ), used the title "Moの自建网盘" ("Mo's self-built cloud drive") | “Black October” for AI Developer Platforms Wiz Blog | · 1d ago |
| domain | momo.skin | , the operator did have access to the stolen keys. The site momo.skin resolved to 23.106.46.239 in early 2026 and another site ti | “Black October” for AI Developer Platforms Wiz Blog | · 1d ago |
| domain | s3.xingjiabiapi.org | resale market for these keys. A subdomain of the main site, s3.xingjiabiapi.org resolved to 38.246.114.118 beginning on September 10, 2026. | “Black October” for AI Developer Platforms Wiz Blog | · 1d ago |
| ipv4 | 104.243.32.50 | 18 Checked permissions on several stolen keys 10/25 - 10/29 104.243.32.50 Checked permissions on several stolen keys 10/19 - 10/30 31 | “Black October” for AI Developer Platforms Wiz Blog | · 1d ago |
| ipv4 | 23.106.46.239 | mpromise?) Wiz Research identified an actor centered around 23.106.46.239 who appears to refer to themselves as “momo” who had access | “Black October” for AI Developer Platforms Wiz Blog | · 1d ago |
| ipv4 | 31.57.201.201 | 50 Checked permissions on several stolen keys 10/19 - 10/30 31.57.201.201 Identified using multiple stolen keys 10/18 - 10/25 The fol | “Black October” for AI Developer Platforms Wiz Blog | · 1d ago |
| ipv4 | 38.246.114.118 | els for discount prices. Infrastructure tied to this site ( 38.246.114.118 ) was identified conducting permission checks on the keys u | “Black October” for AI Developer Platforms Wiz Blog | · 1d ago |
| domain | aber.ir | for persistence, and excluded only Russia. They also used .aber[.]ir instead of dedyn[.]io and included anti-debugging and ant | Yoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic Binaries Security Affairs | · 1d ago |
| domain | dedyn.io | s from word lists in the form adjective-noun-verb-number on dedyn[.]io. Change the picture and the operator gets a new domain. T | Yoba Malware Hides a Crypto Miner Behind Legitimate OpenAI and Anthropic Binaries Security Affairs | · 1d ago |
| md5 | 058ef0cfb57652bddd698609c655b901 | storm-backdoor-attacks#recipe=popular-items&sourcecontentid=058ef0cfb57652bddd698609c655b901) CISA Warns of 'Ongoing' Brickstorm Backdoor Attacks by Ro | Devs Hit by Trojanized Claude Code Extension for Cursor Dark Reading | · 2d ago |
| md5 | 1e51d280261e34e0cc1db58fc4422dce | tepad-updates-6-months#recipe=popular-items&sourcecontentid=1e51d280261e34e0cc1db58fc4422dce) Chinese Hackers Hijack Notepad++ Updates for 6 Months by | Devs Hit by Trojanized Claude Code Extension for Cursor Dark Reading | · 2d ago |
| md5 | 42a3f64a30a24172cce0776514fc74fd | ntel-memory-encryption#recipe=popular-items&sourcecontentid=42a3f64a30a24172cce0776514fc74fd) Cheap Hardware Module Bypasses AMD, Intel Memory Encrypti | Devs Hit by Trojanized Claude Code Extension for Cursor Dark Reading | · 2d ago |
| md5 | 43aa47a844577b6570bf4302ed195069 | ersecurity-claude-llms#recipe=popular-items&sourcecontentid=43aa47a844577b6570bf4302ed195069) In Cybersecurity, Claude Leaves Other LLMs in the Dust by | Devs Hit by Trojanized Claude Code Extension for Cursor Dark Reading | · 2d ago |
| md5 | 21b825d74e7c4683dd09d788c7fc31aa | /apple-patch-policy-ai#recipe=similar-items&sourcecontentid=21b825d74e7c4683dd09d788c7fc31aa) Apple Reverses Age-Old Patch Policy to Keep Up With AI by | Behind the Scenes of How Operation Blackout Went Down Dark Reading | · 2d ago |
| md5 | 362b8b6db1ce493c4eee55479e5eaafa | over-to-private-sector#recipe=similar-items&sourcecontentid=362b8b6db1ce493c4eee55479e5eaafa) Hand CVE Over to the Private Sector by Brian Martin Jan 2 | Behind the Scenes of How Operation Blackout Went Down Dark Reading | · 2d ago |
| md5 | 3e902b4f0859291fd322f90ebc26a2b7 | poses-ai-security-gaps#recipe=similar-items&sourcecontentid=3e902b4f0859291fd322f90ebc26a2b7) Europe's Multilingual Reality Exposes AI Security Gaps by | Behind the Scenes of How Operation Blackout Went Down Dark Reading | · 2d ago |
| md5 | 584125add54736d0d7bd9eb777c54e8a | gy-prioritizes-offense#recipe=similar-items&sourcecontentid=584125add54736d0d7bd9eb777c54e8a) White House Cyber Strategy Prioritizes Offense by Jai Vij | Behind the Scenes of How Operation Blackout Went Down Dark Reading | · 2d ago |
| ipv4 | 185.157.161.148 | icly accessible Python HTTP file server hosted in Sweden at 185.157.161[.]148 on port 8877 - last month, and documented the exposed dir | Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see The Register · Security | · 2d ago |
| sha1 | ddcf90715106aa0c0e19c103f8d2c412af4beff3 | tested Remote Support 24.1.2, build 1524046 , revision 4208-ddcf90715106aa0c0e19c103f8d2c412af4beff3 . The test appliance had public issue-menu session starts a | Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764) Rapid7 Blog | · 2d ago |
| md5 | 1876ff0466d7289b2b5677c41b14aa04 | k-pressure-shifts-smbs#recipe=similar-items&sourcecontentid=1876ff0466d7289b2b5677c41b14aa04) Aussies Face Reduced Cybercrime Risk, as Pressure Shifts | L’Italia è afflitta da vulnerabilità informatiche, senza una causa chiara Dark Reading | · 2d ago |
| md5 | 43aa47a844577b6570bf4302ed195069 | ersecurity-claude-llms#recipe=similar-items&sourcecontentid=43aa47a844577b6570bf4302ed195069) In Cybersecurity, Claude Leaves Other LLMs in the Dust by | L’Italia è afflitta da vulnerabilità informatiche, senza una causa chiara Dark Reading | · 2d ago |
| md5 | 4e479d24632faa681df1d8ff75497593 | -cybersecurity-ma-boom#recipe=similar-items&sourcecontentid=4e479d24632faa681df1d8ff75497593) AI Scramble Drives Cybersecurity M&A Boom by Robert Lemos | L’Italia è afflitta da vulnerabilità informatiche, senza una causa chiara Dark Reading | · 2d ago |
| md5 | 7ecd4c9714a7873301835f1f9e391cdb | eking-inside-black-box#recipe=similar-items&sourcecontentid=7ecd4c9714a7873301835f1f9e391cdb) Stronger AI Safety Requires Peeking Inside the 'Black Box | L’Italia è afflitta da vulnerabilità informatiche, senza una causa chiara Dark Reading | · 2d ago |
| domain | aiok.me | ash) then runs, fetched from lookalike domains such as vibe.aiok[.]me. According to technical research published by Symantec , | Unauthorized Codex and Claude Code Relays Disable Security Protections at 12 Organizations GBHackers | · 2d ago |
| domain | jsonbin.io | ntral team to report them to. Later payloads were stored on JSONBin.io, JSONHosting, and Pinata, a gateway to the IPFS network. On | North Korean Hackers Steal Developer Credentials to Inject Malware Into GitHub and Software Packages Cyber Security News | · 2d ago |
| domain | openaigpt4v.com | L Architecture Diagram (Image Source: securelist) The C2 is openaigpt4v[.]com, behind Cloudflare at 104.18.14[.]219. Kaspersky saw one | Hackers Target Asian Governments With New NetamLoader Malware Hidden in Windows Update Files GBHackers | · 2d ago |
| domain | openaigpt4v.com | NET 2 Plugin, talks to a command-and-control (C2) server at openaigpt4v[.]com. The name looks like an AI service, but the domain sits b | APT Hackers Use NetamLoader Malware to Target Windows 10 Systems in Asian Governments Cyber Security News | · 2d ago |
| ipv4 | 104.18.14.219 | oad container Domain openaigpt4v[.]com C2 server IP address 104.18.14[.]219 C2 IP (Cloudflare) Note: IP addresses and domains are int | APT Hackers Use NetamLoader Malware to Target Windows 10 Systems in Asian Governments Cyber Security News | · 2d ago |
| md5 | 4f28622c5e60c01319bf48cf742fe1a5 | XAML-2 Hash B3C4A635179680EDAFB5D006CF0CFFC6 XAML-2-1 Hash 4F28622C5E60C01319BF48CF742FE1A5 XAML-2-2 Hash C86D53392A87DD3F3E62D62C9B92A9BD XAML-3 File | APT Hackers Use NetamLoader Malware to Target Windows 10 Systems in Asian Governments Cyber Security News | · 2d ago |
| md5 | 514117d536e347560d049cfe0c609632 | 1B73488EF5E2E55A75C3 PatchMyPC-ScriptRunner.exe.config Hash 514117D536E347560D049CFE0C609632 XAML-1 Hash 9000820D8153C24CD60D53001D3A97B6 XAML-2 Hash B3 | APT Hackers Use NetamLoader Malware to Target Windows 10 Systems in Asian Governments Cyber Security News | · 2d ago |
| md5 | 514ac0d73b8a1b73488ef5e2e55a75c3 | in Hash 67E3617F8709D34F806F8E02BADBA8A5 fabric.config Hash 514AC0D73B8A1B73488EF5E2E55A75C3 PatchMyPC-ScriptRunner.exe.config Hash 514117D536E347560D04 | APT Hackers Use NetamLoader Malware to Target Windows 10 Systems in Asian Governments Cyber Security News | · 2d ago |
| md5 | 67e3617f8709d34f806f8e02badba8a5 | er Hash CFB8B281BDF5D9390E64B10C312FB2C1 .NET 2 Plugin Hash 67E3617F8709D34F806F8E02BADBA8A5 fabric.config Hash 514AC0D73B8A1B73488EF5E2E55A75C3 PatchMy | APT Hackers Use NetamLoader Malware to Target Windows 10 Systems in Asian Governments Cyber Security News | · 2d ago |
| md5 | 9000820d8153c24cd60d53001d3a97b6 | xe.config Hash 514117D536E347560D049CFE0C609632 XAML-1 Hash 9000820D8153C24CD60D53001D3A97B6 XAML-2 Hash B3C4A635179680EDAFB5D006CF0CFFC6 XAML-2-1 Hash | APT Hackers Use NetamLoader Malware to Target Windows 10 Systems in Asian Governments Cyber Security News | · 2d ago |
| md5 | ab81564bcb8ca7e710c66832de747556 | k Hash E1DC6F1ED193594F2284BE22AE08DFA4 Resources.resx Hash AB81564BCB8CA7E710C66832DE747556 .NET 1 Loader Hash CFB8B281BDF5D9390E64B10C312FB2C1 .NET 2 | APT Hackers Use NetamLoader Malware to Target Windows 10 Systems in Asian Governments Cyber Security News | · 2d ago |
| md5 | b3c4a635179680edafb5d006cf0cffc6 | 32 XAML-1 Hash 9000820D8153C24CD60D53001D3A97B6 XAML-2 Hash B3C4A635179680EDAFB5D006CF0CFFC6 XAML-2-1 Hash 4F28622C5E60C01319BF48CF742FE1A5 XAML-2-2 Has | APT Hackers Use NetamLoader Malware to Target Windows 10 Systems in Asian Governments Cyber Security News | · 2d ago |
| md5 | c86d53392a87dd3f3e62d62c9b92a9bd | AML-2-1 Hash 4F28622C5E60C01319BF48CF742FE1A5 XAML-2-2 Hash C86D53392A87DD3F3E62D62C9B92A9BD XAML-3 File path C:\Windows\SoftwareDistribution\Download\I | APT Hackers Use NetamLoader Malware to Target Windows 10 Systems in Asian Governments Cyber Security News | · 2d ago |
| md5 | cfb8b281bdf5d9390e64b10c312fb2c1 | sx Hash AB81564BCB8CA7E710C66832DE747556 .NET 1 Loader Hash CFB8B281BDF5D9390E64B10C312FB2C1 .NET 2 Plugin Hash 67E3617F8709D34F806F8E02BADBA8A5 fabric. | APT Hackers Use NetamLoader Malware to Target Windows 10 Systems in Asian Governments Cyber Security News | · 2d ago |
| md5 | e1dc6f1ed193594f2284be22ae08dfa4 | 0F577E98E Listed first in the report’s file-hash block Hash E1DC6F1ED193594F2284BE22AE08DFA4 Resources.resx Hash AB81564BCB8CA7E710C66832DE747556 .NET 1 | APT Hackers Use NetamLoader Malware to Target Windows 10 Systems in Asian Governments Cyber Security News | · 2d ago |
| md5 | f2458ed133f8d0ca19e22c10f577e98e | e e4537a1762fcafd2fd96bfc825bad34f9db9a24d CAB archive Hash F2458ED133F8D0CA19E22C10F577E98E Listed first in the report’s file-hash block Hash E1DC6F1ED | APT Hackers Use NetamLoader Malware to Target Windows 10 Systems in Asian Governments Cyber Security News | · 2d ago |
| sha1 | e4537a1762fcafd2fd96bfc825bad34f9db9a24d | ise (IoCs):- Type Indicator Description Hash / archive name e4537a1762fcafd2fd96bfc825bad34f9db9a24d CAB archive Hash F2458ED133F8D0CA19E22C10F577E98E Listed fi | APT Hackers Use NetamLoader Malware to Target Windows 10 Systems in Asian Governments Cyber Security News | · 2d ago |
| ipv4 | 134.209.82.225 | backdoor status to the attacker’s server at the IP address 134.209.82[.]225 Attack chain Source: OpenSourceMalware However, according | Malicious Claude Code extension on Cursor planted SSH backdoors BleepingComputer | · 2d ago |
| ipv4 | 144.172.101.72 | obalt Strike C2 server used in Aur0ra ransomware operations 144[.]172[.]101[.]72 IP address Cobalt Strike C2 server used in Aur0ra ran | Aur0ra Ransomware Hackers Use Cursor AI Agents to Gain Domain Admin Access and Steal Data Cyber Security News | · 2d ago |
| ipv4 | 152.236.3.8 | ta exfiltration server used in Aur0ra ransomware operations 152[.]236[.]3[.]8 IP address Cobalt Strike C2 server used in Aur0ra ran | Aur0ra Ransomware Hackers Use Cursor AI Agents to Gain Domain Admin Access and Steal Data Cyber Security News | · 2d ago |
| ipv4 | 152.236.4.14 | s. Indicators of compromise (IoCs):- Indicator Type Context 152[.]236[.]4[.]14 IP address Data exfiltration server used in Aur0ra ra | Aur0ra Ransomware Hackers Use Cursor AI Agents to Gain Domain Admin Access and Steal Data Cyber Security News | · 2d ago |
| ipv4 | 172.86.113.245 | dress SOCKS proxy node used in Aur0ra ransomware operations 172[.]86[.]113[.]245 IP address Open directory server used in Aur0ra ranso | Aur0ra Ransomware Hackers Use Cursor AI Agents to Gain Domain Admin Access and Steal Data Cyber Security News | · 2d ago |
| ipv4 | 172.86.89.124 | obalt Strike C2 server used in Aur0ra ransomware operations 172[.]86[.]89[.]124 IP address Cobalt Strike C2 server used in Aur0ra ran | Aur0ra Ransomware Hackers Use Cursor AI Agents to Gain Domain Admin Access and Steal Data Cyber Security News | · 2d ago |
| ipv4 | 206.223.230.107 | obalt Strike C2 server used in Aur0ra ransomware operations 206[.]223[.]230[.]107 IP address Cobalt Strike C2 server used in Aur0ra ran | Aur0ra Ransomware Hackers Use Cursor AI Agents to Gain Domain Admin Access and Steal Data Cyber Security News | · 2d ago |
| ipv4 | 45.59.113.63 | obalt Strike C2 server used in Aur0ra ransomware operations 45[.]59[.]113[.]63 IP address SOCKS proxy node used in Aur0ra ransomware | Aur0ra Ransomware Hackers Use Cursor AI Agents to Gain Domain Admin Access and Steal Data Cyber Security News | · 2d ago |
| domain | 4pred.cc | biz, polidex[.]cc, polymarket-labs[.]click, polyspace[.]cc, 4pred[.]cc, werexo[.]com, plmrkt[.]com, polix[.]cc, 7poly[.]icu, loo | Hackers Build Fake Polymarket Platforms That Rig Trades and Block Cryptocurrency Withdrawals Cyber Security News | · 2d ago |
| domain | 7poly.icu | e[.]cc, 4pred[.]cc, werexo[.]com, plmrkt[.]com, polix[.]cc, 7poly[.]icu, lootwox[.]com Domain AtlasCore polycore[.]cc, zarama[.]x | Hackers Build Fake Polymarket Platforms That Rig Trades and Block Cryptocurrency Withdrawals Cyber Security News | · 2d ago |
| domain | apexswap.top | lydep[.]com, swapnux[.]com, eventmex[.]com, tonchange[.]cc, apexswap[.]top, gemchange[.]com, predictionmarket[.]help, exchangezone[. | Hackers Build Fake Polymarket Platforms That Rig Trades and Block Cryptocurrency Withdrawals Cyber Security News | · 2d ago |
| domain | atlascore-panel.net | f compromise (IoCs):- Type Group Indicator Domain AtlasCore atlascore-panel[.]net, polymarket[.]atlascore-panel[.]net, casino[.]atlascore-p | Hackers Build Fake Polymarket Platforms That Rig Trades and Block Cryptocurrency Withdrawals Cyber Security News | · 2d ago |
| domain | authmy.co | o-cheap[.]pro, futaryx[.]com, fortvet[.]cc, fortexp[.]live, authmy[.]co, predxmarket[.]xyz, polyfucked[.]top, fortnitebeast[.]top | Hackers Build Fake Polymarket Platforms That Rig Trades and Block Cryptocurrency Withdrawals Cyber Security News | · 2d ago |
| domain | bravioar.com | e[.]club, speculor[.]net, rqwrujarser[.]icu, wettora[.]com, bravioar[.]com, winzo[.]live, predictum[.]app, predictum[.]pro, predictu | Hackers Build Fake Polymarket Platforms That Rig Trades and Block Cryptocurrency Withdrawals Cyber Security News | · 2d ago |
| domain | btwoteam.xyz | m magnetic-panel[.]space, tradingai[.]fun, crossbook[.]xyz, btwoteam[.]xyz, predicton[.]org, polymarket[.]casino IP address AtlasCor | Hackers Build Fake Polymarket Platforms That Rig Trades and Block Cryptocurrency Withdrawals Cyber Security News | · 2d ago |
| domain | casino.atlascore-panel.net | atlascore-panel[.]net, polymarket[.]atlascore-panel[.]net, casino[.]atlascore-panel[.]net, docs[.]atlascore-panel[.]net, prdct[.]cc, event-x[.]cc | Hackers Build Fake Polymarket Platforms That Rig Trades and Block Cryptocurrency Withdrawals Cyber Security News | · 2d ago |
| domain | crossbook.xyz | main Magnetic Team magnetic-panel[.]space, tradingai[.]fun, crossbook[.]xyz, btwoteam[.]xyz, predicton[.]org, polymarket[.]casino IP | Hackers Build Fake Polymarket Platforms That Rig Trades and Block Cryptocurrency Withdrawals Cyber Security News | · 2d ago |
| domain | delevent.cc | dictum[.]pro, predictum[.]cc, egov-x[.]com, deltevent[.]cc, delevent[.]cc, uppulse[.]xyz, depredictor[.]com, plexocade[.]com, predi | Hackers Build Fake Polymarket Platforms That Rig Trades and Block Cryptocurrency Withdrawals Cyber Security News | · 2d ago |
| domain | deltapredict.net | com, vuefax[.]com, polywax[.]net, zevrix[.]pro, polym[.]cc, deltapredict[.]net, polyxmarket[.]com, polyxchange[.]net, polymusk[.]net, po | Hackers Build Fake Polymarket Platforms That Rig Trades and Block Cryptocurrency Withdrawals Cyber Security News | · 2d ago |
| domain | deltevent.cc | ictum[.]app, predictum[.]pro, predictum[.]cc, egov-x[.]com, deltevent[.]cc, delevent[.]cc, uppulse[.]xyz, depredictor[.]com, plexoca | Hackers Build Fake Polymarket Platforms That Rig Trades and Block Cryptocurrency Withdrawals Cyber Security News | · 2d ago |
| domain | depredictor.com | egov-x[.]com, deltevent[.]cc, delevent[.]cc, uppulse[.]xyz, depredictor[.]com, plexocade[.]com, predictmex[.]com, gobeast[.]bet, testdo | Hackers Build Fake Polymarket Platforms That Rig Trades and Block Cryptocurrency Withdrawals Cyber Security News | · 2d ago |
| domain | docs.atlascore-panel.net | et[.]atlascore-panel[.]net, casino[.]atlascore-panel[.]net, docs[.]atlascore-panel[.]net, prdct[.]cc, event-x[.]cc, predicate[.]cc, predictedby[ | Hackers Build Fake Polymarket Platforms That Rig Trades and Block Cryptocurrency Withdrawals Cyber Security News | · 2d ago |
Extraction is regex-based (SHA-256/SHA-1/MD5, public IPv4, defanged hxxp/[.] indicators, and bare domains/emails only from malware, actor, exploit, phishing, ransomware and breach articles with a nearby indicator context word). Treat confidence as low until you verify against the source article.