Indicators of compromise
1,370 indicators auto-extracted from article text · hashes, IPs, domains, URLs · verify before use
| Type | Indicator | Context | Article | First seen |
|---|---|---|---|---|
| sha256 | a0887fa90f88dd002b025a97b3a57e4fdb7f5fdd725490d96776f8626f528ef2 | 2959cd9aa03482f3398fbe81b4874c50a5945fe6b0c0abb432a33db853f a0887fa90f88dd002b025a97b3a57e4fdb7f5fdd725490d96776f8626f528ef2 a2452456eb3a1a51116d9c2991aae3b0982acc1a9b30efee92a4f102dc4 | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | a08e0d1839b86d0d56a52d07123719211a3c3d43a6aa05aa34531a72ed1207dc | . This domain hosted the C2 server for a ToneShell sample ( a08e0d1839b86d0d56a52d07123719211a3c3d43a6aa05aa34531a72ed1207dc ) installed by Stately Taurus at the Southeast Asian govern | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | a229a2943cf8d1b073574f0c050ca06392d0525b2028f4b4b04d1e4b40110c66 | b07f5098e1ca8fb5a5776eb874072ace4e19734cba4af4450eeccde7f89 a229a2943cf8d1b073574f0c050ca06392d0525b2028f4b4b04d1e4b40110c66 9192a1c1ab42186a46e08b914d66253440af2d2be6b497c34fe4b1770c3 | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | a2452456eb3a1a51116d9c2991aae3b0982acc1a9b30efee92a4f102dc4d2927 | fa90f88dd002b025a97b3a57e4fdb7f5fdd725490d96776f8626f528ef2 a2452456eb3a1a51116d9c2991aae3b0982acc1a9b30efee92a4f102dc4d2927 3e137da41cb509412ee230c6d7aac3d69361358b28c3a09ec851d3c0f38 | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | ab54af1dbe6a82488db161a7f57cd74f2dd282a9522587f18313b4e9835dc558 | 27a21a95ea2a6136c264c6a6cc2f0910a24881118b6eabc2d6509dc8dd7 ab54af1dbe6a82488db161a7f57cd74f2dd282a9522587f18313b4e9835dc558 3cef0b5f069cc1d15d36aa83d54d2a7be79b29b02081b6592dd4714639a | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | ab9d8f1021f2a99c74aa66f8ddb52996ac2337da9de2676d090b87e19ce93033 | hell. SHA256 Family Callback Function Called By UUID Format ab9d8f1021f2a99c74aa66f8ddb52996ac2337da9de2676d090b87e19ce93033 ToneShell EnumSystemLocalesA ASCII cf61b7a9bdde2a39156d88f3 | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | b382cc85eee95a620fc11370309ff76de9a3bcaefb645790434d8251a3b9fce1 | orm samples, we found a variant of the ToneShell backdoor ( b382cc85eee95a620fc11370309ff76de9a3bcaefb645790434d8251a3b9fce1 ) that had the same debug symbol path as the Bookworm loade | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | b7e042d2accdf4a488c3cd46ccd95d6ad5b5a8be71b5d6d76b8046f17debaa18 | lated to PubLoad Using V6-winsp1-wuredir SHA256 Filename C2 b7e042d2accdf4a488c3cd46ccd95d6ad5b5a8be71b5d6d76b8046f17debaa18 analysis of the third meeting of ndsc.zip 123.253.32[.]15 4 | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | bbf12ee2cd71dbcf2948adf64f354ad7c69d6b6ff0b78ea76b3df2d02b08ed0f | df154bb60fcf24d0ab5297d0c6beaca0f Leader.dll Leader.dll 0x0 bbf12ee2cd71dbcf2948adf64f354ad7c69d6b6ff0b78ea76b3df2d02b08ed0f dafdsafdsaa3 Resolver.dll 0x1 fa739724a4b6f7a766a2d7695d7da | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | cf61b7a9bdde2a39156d88f309f230a7d44e9feaf0359947e1f96e069eca4e86 | Compiled SHA256 Filename Debug Symbol Path C2 Dec. 23, 2021 cf61b7a9bdde2a39156d88f309f230a7d44e9feaf0359947e1f96e069eca4e86 anhlab.exe C:\Users\hack\Desktop\uuid\uu\Release\uu.pdb www | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | d7dbfb2b755418842fea4fca5628f0b36bbd128a71ddcd858b4b3c67ba78f516 | ac834672c1b544dd555c93600a637 fjdasljguafa KBLogger.dll 0x5 d7dbfb2b755418842fea4fca5628f0b36bbd128a71ddcd858b4b3c67ba78f516 Coder.dll Coder.dll 0xA 6804b10aefe8fdb2b33ecf3bc5a93f49413 | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | da8ef50fe5e571d0143a758c7c66bb55653f1f2d04f16464fc857226441d79b2 | a725adc57d7b501f33e87230a8291cf8ad22d4d3a830293abcc0ac10d12 da8ef50fe5e571d0143a758c7c66bb55653f1f2d04f16464fc857226441d79b2 f0df09513dcf292264b3336269952c7e9ff685df8180a2035bee9f3143b | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | dcc349a1b624f6b949f181a7dd859a82715b4d3b6c37c7e5be1b729cd8e6f01f | 0820948d5d2ca4c192fac8b1ede91c2 yyrtytr.565 Network.dll 0xE dcc349a1b624f6b949f181a7dd859a82715b4d3b6c37c7e5be1b729cd8e6f01f feareade HTTP.dll 0x13 51bf329ba04a042789bad3b395092488a3d8 | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | f0df09513dcf292264b3336269952c7e9ff685df8180a2035bee9f3143b36609 | 50fe5e571d0143a758c7c66bb55653f1f2d04f16464fc857226441d79b2 f0df09513dcf292264b3336269952c7e9ff685df8180a2035bee9f3143b36609 Bookworm Modules SHA256 Module fa739724a4b6f7a766a2d7695d7d | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | f7b024196ac50bd0f7ed362a532e83edf154bb60fcf24d0ab5297d0c6beaca0f | rrent Module Name Related Bookworm Module Current Module ID f7b024196ac50bd0f7ed362a532e83edf154bb60fcf24d0ab5297d0c6beaca0f Leader.dll Leader.dll 0x0 bbf12ee2cd71dbcf2948adf64f354ad7c | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | fa739724a4b6f7a766a2d7695d7da7b33a6ac834672c1b544dd555c93600a637 | d6b6ff0b78ea76b3df2d02b08ed0f dafdsafdsaa3 Resolver.dll 0x1 fa739724a4b6f7a766a2d7695d7da7b33a6ac834672c1b544dd555c93600a637 fjdasljguafa KBLogger.dll 0x5 d7dbfb2b755418842fea4fca5628f | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | fb25a69ffc18b79ee664462e0717cf5e70820948d5d2ca4c192fac8b1ede91c2 | c6639eae65900cb2ea26911540a77d1f9b7acf6 AES.dll AES.dll 0xC fb25a69ffc18b79ee664462e0717cf5e70820948d5d2ca4c192fac8b1ede91c2 yyrtytr.565 Network.dll 0xE dcc349a1b624f6b949f181a7dd859a8 | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | fbc67446daaa0a0264ed7a252ab42413d6a43c2e5ab43437c2b3272daec85e81 | DIS13n\Release\LTDIS13n.pdb www.fjke5oe[.]com Oct. 26, 2022 fbc67446daaa0a0264ed7a252ab42413d6a43c2e5ab43437c2b3272daec85e81 ltdis13n.dll C:\Users\hack\Documents\WhiteFile\LTDIS13n\Rel | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | fdad627a21a95ea2a6136c264c6a6cc2f0910a24881118b6eabc2d6509dc8dd7 | da41cb509412ee230c6d7aac3d69361358b28c3a09ec851d3c0f3853326 fdad627a21a95ea2a6136c264c6a6cc2f0910a24881118b6eabc2d6509dc8dd7 ab54af1dbe6a82488db161a7f57cd74f2dd282a9522587f18313b4e9835 | Stately Taurus Activity in Southeast Asia Links to Bookworm Malware Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 3b5b19ebe8d8b6c7e5b2ffd2cc194fad1ae6c9eade7646f48c595bd154f4b1e1 | f plugin.zip from anilstone[.]ir on April 14th SHA256 hash: 3b5b19ebe8d8b6c7e5b2ffd2cc194fad1ae6c9eade7646f48c595bd154f4b1e1 File name: exe1.exe File size: 85,504 bytes File descriptio | Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 40e8dc147f189baf4660d5db8e0cd1c647c7f167f7176c5d8ee03b6cac26fed2 | gin.zip from mattsfotoalbum[.]de on April 13th SHA256 hash: 40e8dc147f189baf4660d5db8e0cd1c647c7f167f7176c5d8ee03b6cac26fed2 File name: plugin.js File size: 1,382 bytes File descriptio | Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 41f171eb916d555dc7771ce71013572c498b8d620d2f72872c4b2f3b50c7ccb1 | malware retrieved by plugin.js on April 13th) SHA256 hash: 41f171eb916d555dc7771ce71013572c498b8d620d2f72872c4b2f3b50c7ccb1 File name: exe2.exe File size: 363,728 bytes File descripti | Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 50117ce3fe5dba572cf23584dc7541a7cfd4026d4316e69d29cdf536873fdf20 | malware retrieved by plugin.js on April 13th) SHA256 hash: 50117ce3fe5dba572cf23584dc7541a7cfd4026d4316e69d29cdf536873fdf20 File name: exe1.exe File size: 91,136 bytes File descriptio | Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 5459be968e2296a759dcafa7107ef06d02331b5291c9f3056077bcf38ce37d9e | malware retrieved by plugin.js on April 13th) SHA256 hash: 5459be968e2296a759dcafa7107ef06d02331b5291c9f3056077bcf38ce37d9e File name: exe3.exe File size: 117,561 bytes File descripti | Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 8e210658f17a265f0c595b4f63ee7ba3db4c83f64c93f522e74e57e6fc547b11 | /wrapper/counter/1.htm Associated file hashes: SHA256 hash: 8e210658f17a265f0c595b4f63ee7ba3db4c83f64c93f522e74e57e6fc547b11 File name: plugin.exe File size: 149,346 bytes File descrip | Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | a1670db6204f7666ad246cc11736b052713a4413663f5cbe6aec90ab299431a7 | in.zip from tramplin.online[.]ru on April 13th SHA256 hash: a1670db6204f7666ad246cc11736b052713a4413663f5cbe6aec90ab299431a7 File name: plugin.js File size: 1,537 bytes File descriptio | Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | b2dfa063fa605d942822cc84ef90419e26cfa0030444751fc2b87f1456b72e30 | malware retrieved by plugin.js on April 13th) SHA256 hash: b2dfa063fa605d942822cc84ef90419e26cfa0030444751fc2b87f1456b72e30 File name: exe2.exe File size: 363,922 bytes File descripti | Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | b36a3a9e2b9129cbe7385c97fa24666d2d086f7bb8a3c9c4e019f14a41538be0 | omware from thru Google Docs URL on April 12th SHA256 hash: b36a3a9e2b9129cbe7385c97fa24666d2d086f7bb8a3c9c4e019f14a41538be0 File name: plugin.js File size: 1,369 bytes File descriptio | Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | ba1327106fa0bf82050cf1a1b9c0c119eb0ded63931af4127e5d541dfa2c6850 | malware retrieved by plugin.js on April 14th) SHA256 hash: ba1327106fa0bf82050cf1a1b9c0c119eb0ded63931af4127e5d541dfa2c6850 File name: exe3.exe File size: 221,974 bytes File descripti | Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | d9189f6df89acf8e2f0d689ab73429cde37f974ed423f91d1bcabfe5dda700fa | malware retrieved by plugin.js on April 14th) SHA256 hash: d9189f6df89acf8e2f0d689ab73429cde37f974ed423f91d1bcabfe5dda700fa File name: exe2.exe File size: 366,249 bytes File descripti | Mole Ransomware: How One Malicious Spam Campaign Quickly Increased Complexity and Changed Tactics Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 4228036684f4f519704a102cd9322ac9edb1bfb5b20558a7a6873818f0e6a7b4 | scription: 2016-03-16 Nuclear EK Flash exploit SHA256 hash: 4228036684f4f519704a102cd9322ac9edb1bfb5b20558a7a6873818f0e6a7b4 Description: 2016-03-15 Nuclear EK payload - Locky ransomwa | Locky Ransomware Installed Through Nuclear EK Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 94bd74514cc9e579edf55dd1bac653ceca1837d930d109c6e701afe309b23310 | scription: 2016-03-15 Nuclear EK Flash exploit SHA256 hash: 94bd74514cc9e579edf55dd1bac653ceca1837d930d109c6e701afe309b23310 Description: 2016-03-16 Nuclear EK Flash exploit SHA256 has | Locky Ransomware Installed Through Nuclear EK Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | a9dac0a0389c463b063cb30f647b3d1610e6052570efe2dfb1fca749d8f039fc | ayload - file that downloaded Locky ransomware SHA256 hash: a9dac0a0389c463b063cb30f647b3d1610e6052570efe2dfb1fca749d8f039fc Description: Locky ransomware downloaded by Nuclear EK payl | Locky Ransomware Installed Through Nuclear EK Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | cc2355cc6d265cd90b71282980abcf0a7f3dcb3a608a5c98e7697598696481af | re downloaded by Nuclear EK payload (soft.exe) SHA256 hash: cc2355cc6d265cd90b71282980abcf0a7f3dcb3a608a5c98e7697598696481af | Locky Ransomware Installed Through Nuclear EK Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | faf4f689683f3347738ef0a8370a78d504b513d44f3a70f833c50de3d138c3b2 | 16-03-15 Nuclear EK payload - Locky ransomware SHA256 hash: faf4f689683f3347738ef0a8370a78d504b513d44f3a70f833c50de3d138c3b2 Description: 2016-03-16 Nuclear EK payload - file that down | Locky Ransomware Installed Through Nuclear EK Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 2477db8c1a6882212921ce396d85964d182f9993a0786fb7ccc497b0af78fd3b | on 58.64.142[.]89. SHA256 hashes for these samples follow: 2477db8c1a6882212921ce396d85964d182f9993a0786fb7ccc497b0af78fd3b 4eb75511b34cc276251dff1007328477836da59458e1f89c607c2590fe2 | CryptoBit: Another Ransomware Family Gets an Update Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 4eb75511b34cc276251dff1007328477836da59458e1f89c607c2590fe2ebdaf | b8c1a6882212921ce396d85964d182f9993a0786fb7ccc497b0af78fd3b 4eb75511b34cc276251dff1007328477836da59458e1f89c607c2590fe2ebdaf 5351c106e578453993d20b10bd71301c831a2a0cea3aa45d911fde7a94b | CryptoBit: Another Ransomware Family Gets an Update Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 5351c106e578453993d20b10bd71301c831a2a0cea3aa45d911fde7a94b9247a | 511b34cc276251dff1007328477836da59458e1f89c607c2590fe2ebdaf 5351c106e578453993d20b10bd71301c831a2a0cea3aa45d911fde7a94b9247a 642a3067a35348a833e82e7c08eb53c27f6d2bc68c61bc6e81f135e9927 | CryptoBit: Another Ransomware Family Gets an Update Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 642a3067a35348a833e82e7c08eb53c27f6d2bc68c61bc6e81f135e9927969c7 | 106e578453993d20b10bd71301c831a2a0cea3aa45d911fde7a94b9247a 642a3067a35348a833e82e7c08eb53c27f6d2bc68c61bc6e81f135e9927969c7 6cb7ceca202fccbb8592728b030127eff7a5661b80131d2a40dc637b76d | CryptoBit: Another Ransomware Family Gets an Update Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 6cb7ceca202fccbb8592728b030127eff7a5661b80131d2a40dc637b76d82fa8 | 067a35348a833e82e7c08eb53c27f6d2bc68c61bc6e81f135e9927969c7 6cb7ceca202fccbb8592728b030127eff7a5661b80131d2a40dc637b76d82fa8 8fe6b7f52033794d97aa58605ba3eb306c537abeeaf6d14f45ba3204bf1 | CryptoBit: Another Ransomware Family Gets an Update Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 8fe6b7f52033794d97aa58605ba3eb306c537abeeaf6d14f45ba3204bf112f70 | eca202fccbb8592728b030127eff7a5661b80131d2a40dc637b76d82fa8 8fe6b7f52033794d97aa58605ba3eb306c537abeeaf6d14f45ba3204bf112f70 90e1ea707f97105a99cd7e960fc26deb91aba68f50ec80e40bf915822c4 | CryptoBit: Another Ransomware Family Gets an Update Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 90e1ea707f97105a99cd7e960fc26deb91aba68f50ec80e40bf915822c4e3998 | 7f52033794d97aa58605ba3eb306c537abeeaf6d14f45ba3204bf112f70 90e1ea707f97105a99cd7e960fc26deb91aba68f50ec80e40bf915822c4e3998 bd7e11ecdf7308a4173bdaff82b38c2fba47939ac0356a1878a52fff203 | CryptoBit: Another Ransomware Family Gets an Update Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | bd7e11ecdf7308a4173bdaff82b38c2fba47939ac0356a1878a52fff203656ab | a707f97105a99cd7e960fc26deb91aba68f50ec80e40bf915822c4e3998 bd7e11ecdf7308a4173bdaff82b38c2fba47939ac0356a1878a52fff203656ab Palo Alto Networks customers are protected from Rig EK and | CryptoBit: Another Ransomware Family Gets an Update Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 71eb0797db8de8ff5a9fe84b5568cd728b4b089537e4e1b5fd55b42de8b3fa07 | ow-up malware downloaded by the above SCT file SHA256 hash: 71eb0797db8de8ff5a9fe84b5568cd728b4b089537e4e1b5fd55b42de8b3fa07 File name: bxmmyDLr.exe File description: G-Buster executab | Malspam Targeting Brazil Continues to Evolve Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 94cf47c57413753ecc8c648384b475e96f13f8caca648b9240486340e1d91aa0 | other SCT file called from the first scriptlet SHA256 hash: 94cf47c57413753ecc8c648384b475e96f13f8caca648b9240486340e1d91aa0 File name: ipv3.zip File description: Follow-up malware dow | Malspam Targeting Brazil Continues to Evolve Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | a4cf9811c55d0e4f2f8c783d1458ab3a5d69244287030a0a8154e89ed6ae02b0 | p archive after clicking link from the malspam SHA256 hash: a4cf9811c55d0e4f2f8c783d1458ab3a5d69244287030a0a8154e89ed6ae02b0 File name: Notificacao(Iptu-.-2017).lnk File description: E | Malspam Targeting Brazil Continues to Evolve Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | b42994352613e6bf63599dac0e2d4ddaf2b868842d5f04749f437f8335a63309 | - POST /ipv3/index.php Associated file hashes: SHA256 hash: b42994352613e6bf63599dac0e2d4ddaf2b868842d5f04749f437f8335a63309 File name: Notificacao(Iptu-.-2017).zip File description: D | Malspam Targeting Brazil Continues to Evolve Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | e7374e5ec576d95155c3b35d799656aba33315edbc9cdc7f0a04ed201135843a | ndows shortcut (LNK) file from the zip archive SHA256 hash: e7374e5ec576d95155c3b35d799656aba33315edbc9cdc7f0a04ed201135843a File name: sdar7hsy_2_.sct File description: Scriptlet (SCT | Malspam Targeting Brazil Continues to Evolve Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | ed491c8d0b4ea30a3a4d78c2ee713d72b7ff4b1f90e04a86a775852953ade892 | le returned after double-clicking the LNK file SHA256 hash: ed491c8d0b4ea30a3a4d78c2ee713d72b7ff4b1f90e04a86a775852953ade892 File name: gw4c9sql_1_.sct File description: Another SCT fi | Malspam Targeting Brazil Continues to Evolve Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | faf0892be515437f9dfc86040e130533722b6149d65000969ebb334253cf4b89 | bpSv.exe) made persistent on the infected host SHA256 hash: faf0892be515437f9dfc86040e130533722b6149d65000969ebb334253cf4b89 File name: fltLib.dll File description: Malicious DLL loade | Malspam Targeting Brazil Continues to Evolve Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59 | -QAD.exe Detection Name: Win.Tool.Procpatcher::1201 SHA256: 90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59 MD5: c2efb2dcacba6d3ccc175b6ce1b7ed0a Talos Rep: https://ta | Why metaphor may dictate your security strategy Cisco Talos | · Aug 6, 2026 |
| sha256 | 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f | .exe Detection Name: Win.Dropper.Miner::95.sbx.tg** SHA256: 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f MD5: 38de5b216c33833af710e88f7f64fc98 Talos Rep: https://ta | Why metaphor may dictate your security strategy Cisco Talos | · Aug 6, 2026 |
| sha256 | 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 | lware files from Talos telemetry over the past week SHA256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Talos Rep: https://ta | Why metaphor may dictate your security strategy Cisco Talos | · Aug 6, 2026 |
| sha256 | a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91 | D001.exe Detection Name: Win.Worm.Coinminer::1201** SHA256: a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91 MD5: 7bdbd180c081fa63ca94f9c22c457376 Talos Rep: https://ta | Why metaphor may dictate your security strategy Cisco Talos | · Aug 6, 2026 |
| sha256 | 90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59 | : f_000177.exe Detection Name: W32.Trojan.29jq.1201 SHA256: 90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59 MD5: c2efb2dcacba6d3ccc175b6ce1b7ed0a Talos Rep: https://ta | You were onto something with “It’s the Climb,” Miley Cisco Talos | · Jul 30, 2026 |
| sha256 | 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f | .exe Detection Name: Win.Dropper.Miner::95.sbx.tg** SHA256: 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f MD5: 38de5b216c33833af710e88f7f64fc98 Talos Rep: https://ta | You were onto something with “It’s the Climb,” Miley Cisco Talos | · Jul 30, 2026 |
| sha256 | 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 | lware files from Talos telemetry over the past week SHA256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Talos Rep: https://ta | You were onto something with “It’s the Climb,” Miley Cisco Talos | · Jul 30, 2026 |
| sha256 | a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91 | VID001.exe Detection Name: Win.Worm.Coinminer::1201 SHA256: a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91 MD5: 7bdbd180c081fa63ca94f9c22c457376 Talos Rep: https://ta | You were onto something with “It’s the Climb,” Miley Cisco Talos | · Jul 30, 2026 |
| sha256 | fc18d4060c6dad3057c0b5a70a2081473e066951720cafbd2aa159d3aaccf2e1 | -QAD.exe Detection Name: Win.Tool.Procpatcher::1201 SHA256: fc18d4060c6dad3057c0b5a70a2081473e066951720cafbd2aa159d3aaccf2e1 MD5: ded73d04bb3e3525226de64c38a332e3 Talos Rep: https://ta | You were onto something with “It’s the Climb,” Miley Cisco Talos | · Jul 30, 2026 |
| sha256 | 55a1eb4c2d3da04376df39d7ba832569c6af1a37a0cf2b95f754ac898023a30c | 0-9a-f]{16}.jsp Hash-check any suspicious JSP files against 55a1eb4c2d3da04376df39d7ba832569c6af1a37a0cf2b95f754ac898023a30c Check for flst.txt in /tmp or the Windchill working directo | CISA Adds Exploited PTC Windchill RCE Flaw to KEV as Web Shell Attacks Continue The Hacker News | · Jul 25, 2026 |
| sha256 | 633bd79d1efd3730234d907a2a0d98e3e253a5f0e222e4e4bf3badb3fd6aea0a | tection Name: W32.Variant:MalwareXgenMisc.29d4.1201 SHA256: 633bd79d1efd3730234d907a2a0d98e3e253a5f0e222e4e4bf3badb3fd6aea0a MD5: 770dbe473180366d7b539ff2c188e551 Talos Rep: https://ta | Don’t swing at everything Cisco Talos | · Jul 23, 2026 |
| sha256 | 90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59 | server_tcp.exe Detection Name: W32.Trojan.27oc.1201 SHA256: 90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59 MD5: c2efb2dcacba6d3ccc175b6ce1b7ed0a Talos Rep: https://ta | Don’t swing at everything Cisco Talos | · Jul 23, 2026 |
| sha256 | 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f | D001.exe Detection Name: Win.Worm.Coinminer::1201** SHA256: 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f MD5: 38de5b216c33833af710e88f7f64fc98 Talos Rep: https://ta | Don’t swing at everything Cisco Talos | · Jul 23, 2026 |
| sha256 | 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 | lware files from Talos telemetry over the past week SHA256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Talos Rep: https://ta | Don’t swing at everything Cisco Talos | · Jul 23, 2026 |
| sha256 | e60ab99da105ee27ee09ea64ed8eb46d8edc92ee37f039dbc3e2bb9f587a33ba | -QAD.exe Detection Name: Win.Tool.Procpatcher::1201 SHA256: e60ab99da105ee27ee09ea64ed8eb46d8edc92ee37f039dbc3e2bb9f587a33ba MD5: dbd8dbecaa80795c135137d69921fdba Talos Rep: https://ta | Don’t swing at everything Cisco Talos | · Jul 23, 2026 |
| sha256 | 8cb0c223b018cecef1d990ec81c67b826eb3c30d54f06193cf69969e9a8baea2 | it before any retraining can start. Binary SHA-256: packed 8cb0c223b018cecef1d990ec81c67b826eb3c30d54f06193cf69969e9a8baea2 ; unpacked ea7822eac6cecef7746c606b862b4d3034856caf754c4cf6 | New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack The Hacker News | · Jul 21, 2026 |
| sha256 | ea7822eac6cecef7746c606b862b4d3034856caf754c4cf69533662637905328 | f1d990ec81c67b826eb3c30d54f06193cf69969e9a8baea2 ; unpacked ea7822eac6cecef7746c606b862b4d3034856caf754c4cf69533662637905328 . Sysdig has published the source and C2 addresses, the emb | New ENCFORGE Ransomware Targets AI Model Files in Langflow RCE Attack The Hacker News | · Jul 21, 2026 |
| sha256 | 90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59 | -QAD.exe Detection Name: Win.Tool.Procpatcher::1201 SHA256: 90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59 MD5: c2efb2dcacba6d3ccc175b6ce1b7ed0a Talos Rep: https://ta | Begun, the Patch Wars have Cisco Talos | · Jul 16, 2026 |
| sha256 | 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f | D001.exe Detection Name: Win.Worm.Coinminer::1201** SHA256: 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f MD5: 38de5b216c33833af710e88f7f64fc98 Talos Rep: https://ta | Begun, the Patch Wars have Cisco Talos | · Jul 16, 2026 |
| sha256 | 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 | lware files from Talos telemetry over the past week SHA256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Talos Rep: https://ta | Begun, the Patch Wars have Cisco Talos | · Jul 16, 2026 |
| sha256 | b8be9a5e0a191050f9099c11c155b436863e9bc43bc904cdb842e249679aa35a | 0055df5.dll Detection Name: Auto.90B145.282358.in02 SHA256: b8be9a5e0a191050f9099c11c155b436863e9bc43bc904cdb842e249679aa35a MD5: 0398df5a18f71efcfeef4571a2cef577 Talos Rep: https://ta | Begun, the Patch Wars have Cisco Talos | · Jul 16, 2026 |
| sha256 | a41a523ef9517aab37ed6eea0ec881821bdcb7aefcb5c5f603adc7907f868c86 | cbc7b44ac867e23a20d31d1b0094a13a4f83287f4e60 dist/intro.js: a41a523ef9517aab37ed6eea0ec881821bdcb7aefcb5c5f603adc7907f868c86 Linux payload: fbbcf4d8f98168f78f5c0c47a9ae56d59ec8ac84a7c9 | Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install The Hacker News | · Jul 15, 2026 |
| sha256 | a742de963f14a92d24ebcbc7b44ac867e23a20d31d1b0094a13a4f83287f4e60 | added files and their decompressed payloads: dist/setup.js: a742de963f14a92d24ebcbc7b44ac867e23a20d31d1b0094a13a4f83287f4e60 dist/intro.js: a41a523ef9517aab37ed6eea0ec881821bdcb7aefcb5 | Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install The Hacker News | · Jul 15, 2026 |
| sha256 | b7ca95d1b23c8e67416a25cedf741de0917c2096bbc9d24649eea7853d054903 | 47a9ae56d59ec8ac84a7c9ca6b797fedfb8d62d2bd Windows payload: b7ca95d1b23c8e67416a25cedf741de0917c2096bbc9d24649eea7853d054903 macOS payload: c8fd47d36bdf7c825378593ab82ed8c24d1dc52e26b5 | Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install The Hacker News | · Jul 15, 2026 |
| sha256 | c8fd47d36bdf7c825378593ab82ed8c24d1dc52e26b507812393e24e1d5201fd | 25cedf741de0917c2096bbc9d24649eea7853d054903 macOS payload: c8fd47d36bdf7c825378593ab82ed8c24d1dc52e26b507812393e24e1d5201fd Network endpoints StepSecurity observed at runtime. The two | Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install The Hacker News | · Jul 15, 2026 |
| sha256 | fbbcf4d8f98168f78f5c0c47a9ae56d59ec8ac84a7c9ca6b797fedfb8d62d2bd | 6eea0ec881821bdcb7aefcb5c5f603adc7907f868c86 Linux payload: fbbcf4d8f98168f78f5c0c47a9ae56d59ec8ac84a7c9ca6b797fedfb8d62d2bd Windows payload: b7ca95d1b23c8e67416a25cedf741de0917c2096bb | Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install The Hacker News | · Jul 15, 2026 |
| sha256 | 51cada347262d7b2bcde70552fcdae221625ad75435cee8a9c3e7b67cc47a807 | tion blob recovered from the dead-drop material has SHA-256 51cada347262d7b2bcde70552fcdae221625ad75435cee8a9c3e7b67cc47a807 .” The decrypted URL resolves to a GitHub release: a passwo | 222 GitHub Repositories Linked to Fake Go Package Malware Operation Security Affairs | · Jul 10, 2026 |
| sha256 | 621c6d42409e8aa423684827b4375a35684c71c600f2dd9101f235e8ec633488 | D001.exe Detection Name: Win.Worm.Coinminer::1201** SHA256: 621c6d42409e8aa423684827b4375a35684c71c600f2dd9101f235e8ec633488 MD5: 9b512ba139304c247ddd3d2c4b9179fd Talos Rep: https://ta | Winning 54% of the time Cisco Talos | · Jul 9, 2026 |
| sha256 | 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f | fd.exe Detection Name: W32.HEUR:Attribute.28iy.1201 SHA256: 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f MD5: 38de5b216c33833af710e88f7f64fc98 Talos Rep: https://ta | Winning 54% of the time Cisco Talos | · Jul 9, 2026 |
| sha256 | 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 | lware files from Talos telemetry over the past week SHA256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Talos Rep: https://ta | Winning 54% of the time Cisco Talos | · Jul 9, 2026 |
| sha256 | afc8a00883a4ea07df2dc1d4ed02f8a23b35c9456413b438a2d9ce3ae5076638 | -QAD.exe Detection Name: Win.Tool.Procpatcher::1201 SHA256: afc8a00883a4ea07df2dc1d4ed02f8a23b35c9456413b438a2d9ce3ae5076638 MD5: cc4d231df34e57f59eb970353c7d9de2 Talos Rep: https://ta | Winning 54% of the time Cisco Talos | · Jul 9, 2026 |
| sha256 | 0352f3e338261d98895df4c7b7a76b296485b2290c72bce56603351d167d0601 | 6f3a8e913f526ec57eeec50e1306f7b34b037915b7a1cf2968cc46acc58 0352f3e338261d98895df4c7b7a76b296485b2290c72bce56603351d167d0601 52b871429833e1dee348263844efb531f6a3fcd321f88dc8a876caaee91 | UAT-7810 continues building ORB networks using new malware Cisco Talos | · Jul 7, 2026 |
| sha256 | 03926e3da998f32ad898b640bd15cf145768f9e849e6f18d81350234254c424e | ea5339c73cb4a777a3e9f98bf3cb08da6622c9dd3b4cc9b083cb03d10a2 03926e3da998f32ad898b640bd15cf145768f9e849e6f18d81350234254c424e 16971f9706d70ac4925651c7c8719b9d77aff63e4c0a618129efc32c2c4 | UAT-7810 continues building ORB networks using new malware Cisco Talos | · Jul 7, 2026 |
| sha256 | 08701ed7975bf4f5688c2724d27ab497764200ad6f4dc53d3cc03b170378ced0 | 878e28284539419612616d964ab9224cbe27e57f42293d91d02d684e3db 08701ed7975bf4f5688c2724d27ab497764200ad6f4dc53d3cc03b170378ced0 604b53f87d6c070bf387e80c70a6df8d272fa3fc143148d41f13e59d52a | UAT-7810 continues building ORB networks using new malware Cisco Talos | · Jul 7, 2026 |
| sha256 | 0a8555a71868749be8c905ed53296ce335af50a9262772b5e154ad3f9c35c2e4 | 49fa81a699a667cafdbd6d1f6e781edd686c947eb8ae27134f6dc2c43d7 0a8555a71868749be8c905ed53296ce335af50a9262772b5e154ad3f9c35c2e4 5dbfa033676b5caacfae902734ce462cd871181eefbe299250ca8ac7e13 | UAT-7810 continues building ORB networks using new malware Cisco Talos | · Jul 7, 2026 |
| sha256 | 0a8cae96e25e85c612b0736fe886f9b124ad70ec425bc2ec1a8a4135b25436ba | 3f87d6c070bf387e80c70a6df8d272fa3fc143148d41f13e59d52ab1f13 0a8cae96e25e85c612b0736fe886f9b124ad70ec425bc2ec1a8a4135b25436ba 8459ff264a2c81c68a34c4ee6bc109d141ad28b96037d34ff112322a4c8 | UAT-7810 continues building ORB networks using new malware Cisco Talos | · Jul 7, 2026 |
| sha256 | 0af4c52a1d13e4132a1843ce7727abcf0ddd4d1ca6a4b17cdf599ec3f355c241 | c61baa67ae2838a36c2e6ff0476a8f2117b96a7027b830c8cb46ce78efc 0af4c52a1d13e4132a1843ce7727abcf0ddd4d1ca6a4b17cdf599ec3f355c241 d4861088161fc72b9922abf933b4ea664a807105ec1eab4a173253aa60b | UAT-7810 continues building ORB networks using new malware Cisco Talos | · Jul 7, 2026 |
| sha256 | 13acadb3541e75af50e02d5be56c2238b93d8f154ce5514be1558e6ee59a1432 | 8dea8ed9aec4466e67a9d0aecf9e7026ff16a792d1d6f306e8b67d3f34c 13acadb3541e75af50e02d5be56c2238b93d8f154ce5514be1558e6ee59a1432 | UAT-7810 continues building ORB networks using new malware Cisco Talos | · Jul 7, 2026 |
| sha256 | 1660536f448b8b9f086ce9ea3ce4e9deefc59a76711ea53ee6d8f08fc8c1bb99 | 636eec376ad6c3ece2202b1722219955638e09b6f96d4cfc0598d3b1890 1660536f448b8b9f086ce9ea3ce4e9deefc59a76711ea53ee6d8f08fc8c1bb99 65feba2c971c214e71303ad2e0fbf62b45ebcaa784cbf3d0dab62786cb4 | UAT-7810 continues building ORB networks using new malware Cisco Talos | · Jul 7, 2026 |
| sha256 | 16971f9706d70ac4925651c7c8719b9d77aff63e4c0a618129efc32c2c46b989 | e3da998f32ad898b640bd15cf145768f9e849e6f18d81350234254c424e 16971f9706d70ac4925651c7c8719b9d77aff63e4c0a618129efc32c2c46b989 6917c0f9eafefe42e33e791b75a7e503ff8b081bc10a98449e4076787df | UAT-7810 continues building ORB networks using new malware Cisco Talos | · Jul 7, 2026 |
| sha256 | 1b5649b479fd625de5c8120873644b5eb669cc89cd504582c18e0ae350fd8823 | ttp[:]//95.182.100[.]231:2222/ Malware indicators LEASHTEST 1b5649b479fd625de5c8120873644b5eb669cc89cd504582c18e0ae350fd8823 LONGLEASH 755fcee1337a252203002ecfdf673a08cfadeda8d738bef2d | UAT-7810 continues building ORB networks using new malware Cisco Talos | · Jul 7, 2026 |
| sha256 | 20fcba222f74dd68aaeb1f0ad30cdf702a828ee164a182b30d05d600c35b72d9 | 033676b5caacfae902734ce462cd871181eefbe299250ca8ac7e139719e 20fcba222f74dd68aaeb1f0ad30cdf702a828ee164a182b30d05d600c35b72d9 912adea5339c73cb4a777a3e9f98bf3cb08da6622c9dd3b4cc9b083cb03 | UAT-7810 continues building ORB networks using new malware Cisco Talos | · Jul 7, 2026 |
| sha256 | 29686c933cec1e274467e2dae264625ae6f754824bb7f550bc9c3131f625562c | a37a9943a267a8b2100fba2678353d6ec88844505ccbba659e586c7a105 29686c933cec1e274467e2dae264625ae6f754824bb7f550bc9c3131f625562c d973ad5a80c3d7468a9c392db4166857ed32b5d61cd6755766ba8922156 | UAT-7810 continues building ORB networks using new malware Cisco Talos | · Jul 7, 2026 |
| sha256 | 29c7fccc6ef8cbfe4da9a169c7c74bacaea1fb515a1fddef91ab1b1522f76e4c | 1f273eeb576d39235d0a5c6f18f2574b132a1022598edfa38065783ab98 29c7fccc6ef8cbfe4da9a169c7c74bacaea1fb515a1fddef91ab1b1522f76e4c 425bf771c8c9f740b1ae9803dcb4fd45af4d6a6f171fcc72fc7d511095c | UAT-7810 continues building ORB networks using new malware Cisco Talos | · Jul 7, 2026 |
| sha256 | 2e0e43776e2e1a37d882a1b2ebb7d337ee88950177e43831dae645a367824feb | e8ae98579bfb940290f60e59a502b3065345aaf765456387989c0488b20 2e0e43776e2e1a37d882a1b2ebb7d337ee88950177e43831dae645a367824feb b5969636eec376ad6c3ece2202b1722219955638e09b6f96d4cfc0598d3 | UAT-7810 continues building ORB networks using new malware Cisco Talos | · Jul 7, 2026 |
| sha256 | 2ebc1b6cf543e2cb3f22d9a5b54b6676bb71dde98df7532f8791297734e44fdd | dfae488d9dfe260b32460a1d947fb5af58ceaf2fb0139bc08b4bb79a966 2ebc1b6cf543e2cb3f22d9a5b54b6676bb71dde98df7532f8791297734e44fdd 6dbd507ca7cecea861f9cf704b3c5c37f5bd5392886a8c2562088892b77 | UAT-7810 continues building ORB networks using new malware Cisco Talos | · Jul 7, 2026 |
| sha256 | 3169a6dbcce684e2c5a2f166996b58ffa673df6e58b8edf2bdf3e66271c8c69e | e9acd50f96d566e8d139f6490abf2bbf7a9293b876eeb4598fd2c37c515 3169a6dbcce684e2c5a2f166996b58ffa673df6e58b8edf2bdf3e66271c8c69e d871d76171504597bbda387689e12e7a5e354c360ff135f4df231cec68c | UAT-7810 continues building ORB networks using new malware Cisco Talos | · Jul 7, 2026 |
| sha256 | 323c3a91be60ebc3e06e942bad04899a15911cea23269e43d07829164b2ce5d4 | 90571645c4641dcff2c07a4c3ab9acad06aa9607350a385729d8d6139f1 323c3a91be60ebc3e06e942bad04899a15911cea23269e43d07829164b2ce5d4 880425fee707e9f42e0b8d60119ed639b1ad506ea29877d126bdebce379 | UAT-7810 continues building ORB networks using new malware Cisco Talos | · Jul 7, 2026 |
| sha256 | 324d95024fc8da5c92b5a1f4825aed5a2a91c9ca8fb6aa52abb332a4c9cf4257 | 29d9d0d4e45fc2b784a7fcfcf31dd48fd3bde30f8d956383d1 JARLEASH 324d95024fc8da5c92b5a1f4825aed5a2a91c9ca8fb6aa52abb332a4c9cf4257 bafba443170e54ef7fd431ce7f1b5e202719f3fd022e4ef70788904f574 | UAT-7810 continues building ORB networks using new malware Cisco Talos | · Jul 7, 2026 |
| sha256 | 33c10b77e1da9f0679023d55fb3057879d15609db9c1d46ee5c3ff1240a3d052 | b231c23d41234e55b1f7ed89f86234f785adbbe820959655d7b019d7df9 33c10b77e1da9f0679023d55fb3057879d15609db9c1d46ee5c3ff1240a3d052 5faea1650cac0f3ffd2dc1fb220182095a46e34158967d37c2a942e85e2 | UAT-7810 continues building ORB networks using new malware Cisco Talos | · Jul 7, 2026 |
Extraction is regex-based (SHA-256/SHA-1/MD5, public IPv4, defanged hxxp/[.] indicators, and bare domains/emails only from malware, actor, exploit, phishing, ransomware and breach articles with a nearby indicator context word). Treat confidence as low until you verify against the source article.