Indicators of compromise

270 indicators auto-extracted from article text · hashes, IPs, domains, URLs · verify before use

TypeAll domain 1849 sha256 1325 ipv4 324 md5 270 url 101 sha1 53 email 2Window24h 7d 30d 90d

Extraction is regex-based (SHA-256/SHA-1/MD5, public IPv4, defanged hxxp/[.] indicators, and bare domains/emails only from malware, actor, exploit, phishing, ransomware and breach articles with a nearby indicator context word). Treat confidence as low until you verify against the source article.

Type	Indicator	Context	Article	First seen
md5	0398df5a18f71efcfeef4571a2cef577	191050f9099c11c155b436863e9bc43bc904cdb842e249679aa35a MD5: 0398df5a18f71efcfeef4571a2cef577 Talos Rep: https://talosintelligence.com/talos_file_reputat	Begun, the Patch Wars have Cisco Talos	Jul 16, 18:00 UTC · Jul 16, 2026
md5	2915b3f8b703eb744fc54c81f4a9c67f	d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Talos Rep: https://talosintelligence.com/talos_file_reputat	Begun, the Patch Wars have Cisco Talos	Jul 16, 18:00 UTC · Jul 16, 2026
md5	38de5b216c33833af710e88f7f64fc98	bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f MD5: 38de5b216c33833af710e88f7f64fc98 Talos Rep: https://talosintelligence.com/talos_file_reputat	Begun, the Patch Wars have Cisco Talos	Jul 16, 18:00 UTC · Jul 16, 2026
md5	c2efb2dcacba6d3ccc175b6ce1b7ed0a	e6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59 MD5: c2efb2dcacba6d3ccc175b6ce1b7ed0a Talos Rep: https://talosintelligence.com/talos_file_reputat	Begun, the Patch Wars have Cisco Talos	Jul 16, 18:00 UTC · Jul 16, 2026
md5	257bbbbe0a2598872278c87d801d06fd	news.com/article/greece-marfin-bank-deaths-firebomb-arrests-257bbbbe0a2598872278c87d801d06fd A highly concerning development out of Greece this week reg	Friday Squid Blogging: "Squidbleed" Vulnerability Schneier on Security	Jul 10, 21:07 UTC · Jul 10, 2026
md5	2915b3f8b703eb744fc54c81f4a9c67f	d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Talos Rep: https://talosintelligence.com/talos_file_reputat	Winning 54% of the time Cisco Talos	Jul 9, 18:00 UTC · Jul 9, 2026
md5	38de5b216c33833af710e88f7f64fc98	bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f MD5: 38de5b216c33833af710e88f7f64fc98 Talos Rep: https://talosintelligence.com/talos_file_reputat	Winning 54% of the time Cisco Talos	Jul 9, 18:00 UTC · Jul 9, 2026
md5	9b512ba139304c247ddd3d2c4b9179fd	9e8aa423684827b4375a35684c71c600f2dd9101f235e8ec633488 MD5: 9b512ba139304c247ddd3d2c4b9179fd Talos Rep: https://talosintelligence.com/talos_file_reputat	Winning 54% of the time Cisco Talos	Jul 9, 18:00 UTC · Jul 9, 2026
md5	cc4d231df34e57f59eb970353c7d9de2	a4ea07df2dc1d4ed02f8a23b35c9456413b438a2d9ce3ae5076638 MD5: cc4d231df34e57f59eb970353c7d9de2 Talos Rep: https://talosintelligence.com/talos_file_reputat	Winning 54% of the time Cisco Talos	Jul 9, 18:00 UTC · Jul 9, 2026
md5	2915b3f8b703eb744fc54c81f4a9c67f	d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Talos Rep: https://talosintelligence.com/talos_file_reputat	Catan and Mouse Cisco Talos	Jul 2, 18:00 UTC · Jul 2, 2026
md5	38de5b216c33833af710e88f7f64fc98	bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f MD5: 38de5b216c33833af710e88f7f64fc98 Talos Rep: https://talosintelligence.com/talos_file_reputat	Catan and Mouse Cisco Talos	Jul 2, 18:00 UTC · Jul 2, 2026
md5	41acb30b9d662d48b7b4fc0ac3d4b79f	1f3b03c1ffa55797e87867f5fb7ce33457411f56afd270cb395453 MD5: 41acb30b9d662d48b7b4fc0ac3d4b79f Talos Rep: https://talosintelligence.com/talos_file_reputat	Catan and Mouse Cisco Talos	Jul 2, 18:00 UTC · Jul 2, 2026
md5	bf9672ec85283fdf002d83662f0b08b7	dcd9e964378760fb6aca86a23622045bca851d8f3ab49ec33978fe MD5: bf9672ec85283fdf002d83662f0b08b7 Talos Rep: https://talosintelligence.com/talos_file_reputat	Catan and Mouse Cisco Talos	Jul 2, 18:00 UTC · Jul 2, 2026
md5	cc4d231df34e57f59eb970353c7d9de2	a4ea07df2dc1d4ed02f8a23b35c9456413b438a2d9ce3ae5076638 MD5: cc4d231df34e57f59eb970353c7d9de2 Talos Rep: https://talosintelligence.com/talos_file_reputat	Catan and Mouse Cisco Talos	Jul 2, 18:00 UTC · Jul 2, 2026
md5	1b67183acc18d7641917f4fe07c1b053	ampaign, we were unable to acquire one of the samples (MD5: 1b67183acc18d7641917f4fe07c1b053) from common malware multiscanner repositories at the time	RedAlpha: New Campaigns Discovered Targeting the Tibetan Community Recorded Future	Jun 26, 00:00 UTC · Jun 26, 2026
md5	e6c0ac26b473d1e0fa9f74fdf1d01af8	nce executed, the lure document loads an embedded DLL (MD5: e6c0ac26b473d1e0fa9f74fdf1d01af8) that drops the validator implant into the users “Temp” dir	RedAlpha: New Campaigns Discovered Targeting the Tibetan Community Recorded Future	Jun 26, 00:00 UTC · Jun 26, 2026
md5	2915b3f8b703eb744fc54c81f4a9c67f	d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Talos Rep: https://talosintelligence.com/talos_file_reputat	Beyond IOCs: AI Cisco Talos	Jun 25, 18:00 UTC · Jun 25, 2026
md5	38de5b216c33833af710e88f7f64fc98	bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f MD5: 38de5b216c33833af710e88f7f64fc98 Talos Rep: https://talosintelligence.com/talos_file_reputat	Beyond IOCs: AI Cisco Talos	Jun 25, 18:00 UTC · Jun 25, 2026
md5	41acb30b9d662d48b7b4fc0ac3d4b79f	1f3b03c1ffa55797e87867f5fb7ce33457411f56afd270cb395453 MD5: 41acb30b9d662d48b7b4fc0ac3d4b79f Talos Rep: https://talosintelligence.com/talos_file_reputat	Beyond IOCs: AI Cisco Talos	Jun 25, 18:00 UTC · Jun 25, 2026
md5	cc4d231df34e57f59eb970353c7d9de2	a4ea07df2dc1d4ed02f8a23b35c9456413b438a2d9ce3ae5076638 MD5: cc4d231df34e57f59eb970353c7d9de2 Talos Rep: https://talosintelligence.com/talos_file_reputat	Beyond IOCs: AI Cisco Talos	Jun 25, 18:00 UTC · Jun 25, 2026
md5	dbd8dbecaa80795c135137d69921fdba	05ee27ee09ea64ed8eb46d8edc92ee37f039dbc3e2bb9f587a33ba MD5: dbd8dbecaa80795c135137d69921fdba Talos Rep: https://talosintelligence.com/talos_file_reputat	Beyond IOCs: AI Cisco Talos	Jun 25, 18:00 UTC · Jun 25, 2026
md5	1f65544978b8ea0e745e573b8ee9684b	er sample, discovered on a machine located in Lebanon (MD5: 1F65544978B8EA0E745E573B8EE9684B), the dropper extracts and decompresses SystemSettings.dll	StrikeShark: a new campaign involving a custom SharkLoader and Cobalt Strike Beacon Kaspersky Securelist	Jun 24, 14:23 UTC · Jun 24, 2026
md5	24fcebdeecba65004fdb0923763d74fd	licious dropper named 一种异常状况的截图（包括操作系统和输入法版本）.pdf.exe (MD5: 24FCEBDEECBA65004FDB0923763D74FD), which was identified in a campaign targeting a government	StrikeShark: a new campaign involving a custom SharkLoader and Cobalt Strike Beacon Kaspersky Securelist	Jun 24, 14:23 UTC · Jun 24, 2026
md5	9cbd560f820c95d7c38342cd558cb5c6	DscCoreR.mui A514D1BB62D7916475946FE7C07AC0AA SyncRest.dat 9CBD560F820C95D7C38342CD558CB5C6 “PerfectDLL Hijacking” technique Once the malicious DLL is	StrikeShark: a new campaign involving a custom SharkLoader and Cobalt Strike Beacon Kaspersky Securelist	Jun 24, 14:23 UTC · Jun 24, 2026
md5	a514d1bb62d7916475946fe7c07ac0aa	mSettings.dll AA3086BE652C8B20B0B29B2730D57119 DscCoreR.mui A514D1BB62D7916475946FE7C07AC0AA SyncRest.dat 9CBD560F820C95D7C38342CD558CB5C6 “PerfectDLL H	StrikeShark: a new campaign involving a custom SharkLoader and Cobalt Strike Beacon Kaspersky Securelist	Jun 24, 14:23 UTC · Jun 24, 2026
md5	aa3086be652c8b20b0b29b2730d57119	ngs.exe D98F568496512E4F98670C61C97CB07A SystemSettings.dll AA3086BE652C8B20B0B29B2730D57119 DscCoreR.mui A514D1BB62D7916475946FE7C07AC0AA SyncRest.dat	StrikeShark: a new campaign involving a custom SharkLoader and Cobalt Strike Beacon Kaspersky Securelist	Jun 24, 14:23 UTC · Jun 24, 2026
md5	d98f568496512e4f98670c61c97cb07a	overnment entity in Taiwan. Filename MD5 SystemSettings.exe D98F568496512E4F98670C61C97CB07A SystemSettings.dll AA3086BE652C8B20B0B29B2730D57119 DscCore	StrikeShark: a new campaign involving a custom SharkLoader and Cobalt Strike Beacon Kaspersky Securelist	Jun 24, 14:23 UTC · Jun 24, 2026
md5	95b3ec0a4e539efaa1faa3d4e25d51de	machine on the network to execute a file with the MD5 hash 95b3ec0a4e539efaa1faa3d4e25d51de. A quick search in Recorded Future shows that this hash is	Enriching User Behavior Analytics With Threat Intelligence Recorded Future	Jun 24, 00:00 UTC · Jun 24, 2026
md5	857ef30bf15ea3da9b94092da78ef0fc	wiper used in the Middle East. It is likely that this file (857ef30bf15ea3da9b94092da78ef0fc) is the wiper in question. In 2012, APT33 deployed the dest	Iranian Cyber Response to Death of IRGC Head Would Likely Use Reported TTPs and Previous Access Recorded Future	Jun 23, 00:00 UTC · Jun 23, 2026
md5	02bb20455cc592a69c080abac770ce90	0ba93109757776a44de9d8c88baa4963 Financial Reports(C1).vbs 02bb20455cc592a69c080abac770ce90 Le formulaire de demande le plus récent .vbs 6c39900d77dcba	An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist	Jun 22, 10:00 UTC · Jun 22, 2026
md5	05d188f071d097f5b6bd8138749b4b14	708e050632a4280cabf98ac1376b7 Outstanding Balance Sheet.vbs 05d188f071d097f5b6bd8138749b4b14 Penyata bank.vbs 2c6f05f1f309d89b2236e6c8b59c88f9 Account S	An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist	Jun 22, 10:00 UTC · Jun 22, 2026
md5	0ba93109757776a44de9d8c88baa4963	s 20209b3a32769afc6a75694b8d8839dd Statement of Debt(A).vbs 0ba93109757776a44de9d8c88baa4963 Financial Reports(C1).vbs 02bb20455cc592a69c080abac770ce90	An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist	Jun 22, 10:00 UTC · Jun 22, 2026
md5	1a3cc75466ffb1971482f7abf7aabc3f	cf iowepv.vbs 8c6d9fc389ad3f20ccbc71d77eb39bfa btksfmsi.vbs 1a3cc75466ffb1971482f7abf7aabc3f home3.vbs 1c47c63e5ed25060d95359c57c77b107 zipats.vbs 31037	An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist	Jun 22, 10:00 UTC · Jun 22, 2026
md5	1c47c63e5ed25060d95359c57c77b107	bfa btksfmsi.vbs 1a3cc75466ffb1971482f7abf7aabc3f home3.vbs 1c47c63e5ed25060d95359c57c77b107 zipats.vbs 31037a42ca048e06e69a78f55bc2eff5 1122.vbs 7f1644	An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist	Jun 22, 10:00 UTC · Jun 22, 2026
md5	1d94fbe9cab21278cc3f104bea334d08	.vbs 993f4c0cadbc769a4b0ed62a918db58d FinancialReportsS.vbs 1d94fbe9cab21278cc3f104bea334d08 Promissory_Note(b).vbs 9d9ac85765e4a818a3ccabe2cf4fef82 Deb	An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist	Jun 22, 10:00 UTC · Jun 22, 2026
md5	20209b3a32769afc6a75694b8d8839dd	4044e4b6471c9de7b0a4ba37d9d9df9a billing statement (2).vbs 20209b3a32769afc6a75694b8d8839dd Statement of Debt(A).vbs 0ba93109757776a44de9d8c88baa4963 F	An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist	Jun 22, 10:00 UTC · Jun 22, 2026
md5	2c6f05f1f309d89b2236e6c8b59c88f9	Sheet.vbs 05d188f071d097f5b6bd8138749b4b14 Penyata bank.vbs 2c6f05f1f309d89b2236e6c8b59c88f9 Account Statement（13K） (2).vbs 3b1aba44dd3d9b6339b6f56e2f42	An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist	Jun 22, 10:00 UTC · Jun 22, 2026
md5	31037a42ca048e06e69a78f55bc2eff5	abc3f home3.vbs 1c47c63e5ed25060d95359c57c77b107 zipats.vbs 31037a42ca048e06e69a78f55bc2eff5 1122.vbs 7f16449cd0c4862d1eadf8a5742bf09a payload_1.vbs 79e	An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist	Jun 22, 10:00 UTC · Jun 22, 2026
md5	3b1aba44dd3d9b6339b6f56e2f42034b	05f1f309d89b2236e6c8b59c88f9 Account Statement（13K） (2).vbs 3b1aba44dd3d9b6339b6f56e2f42034b Statement of Account.txt d43fdaa1f0ee09d7e5f0f94ee9df7b6c B	An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist	Jun 22, 10:00 UTC · Jun 22, 2026
md5	4044e4b6471c9de7b0a4ba37d9d9df9a	0593e8e0e8fac49429e9b45ebf7fa1 Outstanding Payment List.vbs 4044e4b6471c9de7b0a4ba37d9d9df9a billing statement (2).vbs 20209b3a32769afc6a75694b8d8839dd	An unknown actor distributes malicious VBS scripts via WhatsApp Kaspersky Securelist	Jun 22, 10:00 UTC · Jun 22, 2026