Vulnerabilityhigh
Cloud Atlas group acquires PowerCloud, ReverseSocks, SSH
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-0802 | Memory Corruption RCE in Microsoft Office Equation Editor | 7.8 | 93% | KEVRansomwarePoC ×3 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | amerikastaj.com | licious and compromised domains used in MS Office documents amerikastaj[.]com bigbang[.]me paleturquoise-dragonfly-364512.hostingersite |
| domain | bigbang.me | mised domains used in MS Office documents amerikastaj[.]com bigbang[.]me paleturquoise-dragonfly-364512.hostingersite[.]com wizzif |
| domain | cloudguide.in | C05 Domains and IPs Reverse SSH/Socks domains tenkoff[.]org cloudguide[.]in goverru[.]com kufar[.]org ultimatecore[.]net spbnews[.]ne |
| domain | fishingflytackle.com | ndo[.]live internationalcommoditiesllc[.]com humanitas[.]si fishingflytackle[.]com firsai.tipshub[.]net alnakhlah.com[.]sa allgoodsdirect.co |
| domain | goverru.com | IPs Reverse SSH/Socks domains tenkoff[.]org cloudguide[.]in goverru[.]com kufar[.]org ultimatecore[.]net spbnews[.]net onedrivesupp |
| domain | hostingersite.com | erikastaj[.]com bigbang[.]me paleturquoise-dragonfly-364512.hostingersite[.]com wizzifi[.]com totallegacy[.]org mamurjor[.]com landscapeu |
| domain | humanitas.si | n.co[.]uk kommando[.]live internationalcommoditiesllc[.]com humanitas[.]si fishingflytackle[.]com firsai.tipshub[.]net alnakhlah.com |
| domain | internationalcommoditiesllc.com | dscapeuganda[.]com lafortunaitalian.co[.]uk kommando[.]live internationalcommoditiesllc[.]com humanitas[.]si fishingflytackle[.]com firsai.tipshub[.]ne |
| domain | investika-club.com | br Powershell payload staging istochnik[.]org znews[.]net i investika-club[.]com 194.102.104[.]207 46.17.45[.]56 46.17.45[.]49 46.17.44[.] |
| domain | istochnik.org | .com[.]au agenciakharis.com[.]br Powershell payload staging istochnik[.]org znews[.]net i investika-club[.]com 194.102.104[.]207 46.1 |
| domain | kommando.live | murjor[.]com landscapeuganda[.]com lafortunaitalian.co[.]uk kommando[.]live internationalcommoditiesllc[.]com humanitas[.]si fishingf |
| domain | kufar.org | H/Socks domains tenkoff[.]org cloudguide[.]in goverru[.]com kufar[.]org ultimatecore[.]net spbnews[.]net onedrivesupport[.]net Ma |
| domain | landscapeuganda.com | ersite[.]com wizzifi[.]com totallegacy[.]org mamurjor[.]com landscapeuganda[.]com lafortunaitalian.co[.]uk kommando[.]live internationalcom |
| domain | mamurjor.com | -364512.hostingersite[.]com wizzifi[.]com totallegacy[.]org mamurjor[.]com landscapeuganda[.]com lafortunaitalian.co[.]uk kommando[. |
| domain | onedrivesupport.net | goverru[.]com kufar[.]org ultimatecore[.]net spbnews[.]net onedrivesupport[.]net Malicious and compromised domains used in MS Office docum |
| domain | spbnews.net | loudguide[.]in goverru[.]com kufar[.]org ultimatecore[.]net spbnews[.]net onedrivesupport[.]net Malicious and compromised domains u |
| domain | tenkoff.org | 90EF27F8890D4EC05 Domains and IPs Reverse SSH/Socks domains tenkoff[.]org cloudguide[.]in goverru[.]com kufar[.]org ultimatecore[.] |
| domain | tipshub.net | itiesllc[.]com humanitas[.]si fishingflytackle[.]com firsai.tipshub[.]net alnakhlah.com[.]sa allgoodsdirect.com[.]au agenciakharis. |
| domain | totallegacy.org | urquoise-dragonfly-364512.hostingersite[.]com wizzifi[.]com totallegacy[.]org mamurjor[.]com landscapeuganda[.]com lafortunaitalian.co[ |
| domain | ultimatecore.net | ins tenkoff[.]org cloudguide[.]in goverru[.]com kufar[.]org ultimatecore[.]net spbnews[.]net onedrivesupport[.]net Malicious and comprom |
| domain | wizzifi.com | ang[.]me paleturquoise-dragonfly-364512.hostingersite[.]com wizzifi[.]com totallegacy[.]org mamurjor[.]com landscapeuganda[.]com la |
| domain | znews.net | akharis.com[.]br Powershell payload staging istochnik[.]org znews[.]net i investika-club[.]com 194.102.104[.]207 46.17.45[.]56 46 |
| ipv4 | 146.70.53.171 | 8.129[.]224 185.53.179[.]136 185.126.239[.]77 5.181.21[.]75 146.70.53[.]171 45.15.65[.]134 185.250.181[.]207 81.30.105[.]71 File path |
| ipv4 | 185.126.239.77 | .114[.]57 45.87.219[.]116 37.228.129[.]224 185.53.179[.]136 185.126.239[.]77 5.181.21[.]75 146.70.53[.]171 45.15.65[.]134 185.250.181[ |
| ipv4 | 185.22.154.73 | 7 46.17.45[.]56 46.17.45[.]49 46.17.44[.]125 46.17.44[.]212 185.22.154[.]73 194.87.196[.]163 195.58.49[.]9 93.125.114[.]193 93.125.11 |
| ipv4 | 185.250.181.207 | 5.126.239[.]77 5.181.21[.]75 146.70.53[.]171 45.15.65[.]134 185.250.181[.]207 81.30.105[.]71 File paths VBS scripts WriteToSchedulerKil |
| ipv4 | 185.53.179.136 | .114[.]193 93.125.114[.]57 45.87.219[.]116 37.228.129[.]224 185.53.179[.]136 185.126.239[.]77 5.181.21[.]75 146.70.53[.]171 45.15.65[. |
| ipv4 | 194.102.104.207 | staging istochnik[.]org znews[.]net i investika-club[.]com 194.102.104[.]207 46.17.45[.]56 46.17.45[.]49 46.17.44[.]125 46.17.44[.]212 |
| ipv4 | 194.87.196.163 | 46.17.45[.]49 46.17.44[.]125 46.17.44[.]212 185.22.154[.]73 194.87.196[.]163 195.58.49[.]9 93.125.114[.]193 93.125.114[.]57 45.87.219[ |
| ipv4 | 195.58.49.9 | 17.44[.]125 46.17.44[.]212 185.22.154[.]73 194.87.196[.]163 195.58.49[.]9 93.125.114[.]193 93.125.114[.]57 45.87.219[.]116 37.228.1 |
| ipv4 | 37.228.129.224 | .58.49[.]9 93.125.114[.]193 93.125.114[.]57 45.87.219[.]116 37.228.129[.]224 185.53.179[.]136 185.126.239[.]77 5.181.21[.]75 146.70.53 |
| ipv4 | 45.15.65.134 | 53.179[.]136 185.126.239[.]77 5.181.21[.]75 146.70.53[.]171 45.15.65[.]134 185.250.181[.]207 81.30.105[.]71 File paths VBS scripts W |
| ipv4 | 45.87.219.116 | 87.196[.]163 195.58.49[.]9 93.125.114[.]193 93.125.114[.]57 45.87.219[.]116 37.228.129[.]224 185.53.179[.]136 185.126.239[.]77 5.181. |
| ipv4 | 46.17.44.125 | ka-club[.]com 194.102.104[.]207 46.17.45[.]56 46.17.45[.]49 46.17.44[.]125 46.17.44[.]212 185.22.154[.]73 194.87.196[.]163 195.58.49 |
| ipv4 | 46.17.44.212 | 94.102.104[.]207 46.17.45[.]56 46.17.45[.]49 46.17.44[.]125 46.17.44[.]212 185.22.154[.]73 194.87.196[.]163 195.58.49[.]9 93.125.114 |
| ipv4 | 46.17.45.49 | ]net i investika-club[.]com 194.102.104[.]207 46.17.45[.]56 46.17.45[.]49 46.17.44[.]125 46.17.44[.]212 185.22.154[.]73 194.87.196[ |
| ipv4 | 46.17.45.56 | [.]org znews[.]net i investika-club[.]com 194.102.104[.]207 46.17.45[.]56 46.17.45[.]49 46.17.44[.]125 46.17.44[.]212 185.22.154[.] |
| ipv4 | 5.181.21.75 | 19[.]116 37.228.129[.]224 185.53.179[.]136 185.126.239[.]77 5.181.21[.]75 146.70.53[.]171 45.15.65[.]134 185.250.181[.]207 81.30.10 |
| ipv4 | 81.30.105.71 | 81.21[.]75 146.70.53[.]171 45.15.65[.]134 185.250.181[.]207 81.30.105[.]71 File paths VBS scripts WriteToSchedulerKillSSH.vbs Create |
| ipv4 | 93.125.114.193 | .17.44[.]212 185.22.154[.]73 194.87.196[.]163 195.58.49[.]9 93.125.114[.]193 93.125.114[.]57 45.87.219[.]116 37.228.129[.]224 185.53.1 |
| ipv4 | 93.125.114.57 | 22.154[.]73 194.87.196[.]163 195.58.49[.]9 93.125.114[.]193 93.125.114[.]57 45.87.219[.]116 37.228.129[.]224 185.53.179[.]136 185.126 |
| md5 | 0320dd389fdbab25d46792bd2817675e | 2950D2E13B075001CE0C52AA97 A75DBED984963B9AB21309C5B2F8FD9B 0320DD389FDBAB25D46792BD2817675E 5339D1A666F3E40FE756505CF1D87D4B 67D7E3AEEB673BF60C59361C12 |
| md5 | 0577db70844e88b32b954906e2f20798 | B250F855C8C872FFFB9BB656ED ED34F5A136FBA4FDEA976570FAA33ED7 0577DB70844E88B32B954906E2F20798 28ECF8FB6719E14231B94B4D37629B0E 0857C84B62289A1A9F29E19244 |
| md5 | 0857c84b62289a1a9f29e19244e9a499 | 70844E88B32B954906E2F20798 28ECF8FB6719E14231B94B4D37629B0E 0857C84B62289A1A9F29E19244E9A499 0C514E137860F489E3801213460EF938 50568B1F9335A7E3BA4E5DF035 |
| md5 | 097ca205ad9e3b72018750280904718c | 19BFEC0DC4607C17112B9E3B2C A632858F14B36F03D0F213F5F5D6BFF2 097CA205AD9E3B72018750280904718C 69121C36EB8BF77962DCA825FCFFD873 C5702EB250F855C8C872FFFB9B |
| md5 | 0c514e137860f489e3801213460ef938 | FB6719E14231B94B4D37629B0E 0857C84B62289A1A9F29E19244E9A499 0C514E137860F489E3801213460EF938 50568B1F9335A7E3BA4E5DF035A8FB86 7F776AD200287D6DE14A29158C |
| md5 | 116f59e70a9df97f4adaea71eecb1e9a | D21C483A40156F4E40D08DADED 216CB7F31D383C0DD892B284DF05A495 116F59E70A9DF97F4ADAEA71EECB1E9A 7242AC065B50BCDE9308756B49DBADCB 8158552950D2E13B075001CE0C |
| md5 | 1a11b26dd0261ef27a112ce8b361c247 | cuted a suspicious PowerShell script named rdp_new.ps1 (MD5 1A11B26DD0261EF27A112CE8B361C247): The script is designed to allow multiple RDP sessions in |
| md5 | 1b39e86eb772a0e40060b672b7f574f1 | 1681455DAE1B6A26709DEF453 C:\Windows\pla\reports\winlog.exe 1B39E86EB772A0E40060B672B7F574F1 C:\Windows\System32\timecontrolsvc\vmnetdrv64.exe 1D401D6E6 |
| md5 | 1d401d6e6fc0b00aaa2c65a0ac0cfd6b | 2B7F574F1 C:\Windows\System32\timecontrolsvc\vmnetdrv64.exe 1D401D6E6FC0B00AAA2C65A0AC0CFD6B C:\Windows\setup\scripts\install\software\activation\aact\d |
| md5 | 2042eb5d52f0b535a1ce6b6f954c8c2b | F285E32A05E6591D1EB36EBFFC F42085522EC2EBB16EDCF814E7C330AD 2042EB5D52F0B535A1CE6B6F954C8C2B 2AA1E9765EF6B00B94A9B6BE0041436A 36120F5E9411BCBAC7104EF3FA |
| md5 | 216cb7f31d383c0dd892b284df05a495 | DEC8CD8F54F3F60A85F3ED600E EC076CD21C483A40156F4E40D08DADED 216CB7F31D383C0DD892B284DF05A495 116F59E70A9DF97F4ADAEA71EECB1E9A 7242AC065B50BCDE9308756B49 |
| md5 | 25c8ed0511375dca57ef136ac3fa0cca | 18A7E922FBA1A8 dfsvc.exe F6F62456FB0FCC396FB654CBED339BC3 – 25C8ED0511375DCA57EF136AC3FA0CCA C:\branding\dwmw.exe Browser checker 5329F7BFF9D0D5DB28821B |
| md5 | 28ecf8fb6719e14231b94b4d37629b0e | A136FBA4FDEA976570FAA33ED7 0577DB70844E88B32B954906E2F20798 28ECF8FB6719E14231B94B4D37629B0E 0857C84B62289A1A9F29E19244E9A499 0C514E137860F489E380121346 |
| md5 | 2aa1e9765ef6b00b94a9b6be0041436a | 522EC2EBB16EDCF814E7C330AD 2042EB5D52F0B535A1CE6B6F954C8C2B 2AA1E9765EF6B00B94A9B6BE0041436A 36120F5E9411BCBAC7104EF3FA964ED2 5000A353399500BC78381DC95B |
| md5 | 2b4ba4facf8c299749771a3a4369782e | C26D628F C:\ProgramData\checker_[redacted].exe ReverseSocks 2B4BA4FACF8C299749771A3A4369782E C:\Windows\PLA\System\bounce.exe C:\Windows\pla\print_statu |
| md5 | 2cabb721681455dae1b6a26709def453 | 64AADD948F9CE C:\Windows\migration\wtr\MicrosoftBrowser.exe 2CABB721681455DAE1B6A26709DEF453 C:\Windows\pla\reports\winlog.exe 1B39E86EB772A0E40060B672B |
| md5 | 344ca9ea07cd4ac90ef27f8890d4ec05 | 0ED20791A5AC9FC4267D67CCB0 B6AAE073E7BFEBF4D643C2BBEB5C02E1 344CA9EA07CD4AC90EF27F8890D4EC05 Domains and IPs Reverse SSH/Socks domains tenkoff[.]org clo |
| md5 | 36120f5e9411bcbac7104ef3fa964ed2 | 5D52F0B535A1CE6B6F954C8C2B 2AA1E9765EF6B00B94A9B6BE0041436A 36120F5E9411BCBAC7104EF3FA964ED2 5000A353399500BC78381DC95B6ED2DC 579A9952D31CAD801A3988DBE7 |
| md5 | 369b75bdcded16469ede7ab8bedcfae1 | s\ime\imetc\help\IMTCEN14.exe Malicious MS Office documents 369B75BDCDED16469EDE7AB8BEDCFAE1 9EAAE9491F6A50D6DF0BE393734A44CB 3E6E9DF00A764B348EC611EE85 |
| md5 | 38fa4306fa4406ba31cf171af4d36e34 | 52D31CAD801A3988DBE7914CE7 867B634588C0FD6B26684D502C15AB03 38FA4306FA4406BA31CF171AF4D36E34 83EDDE9F7EEEFAC0363413972F35572B CC751619BFEC0DC4607C17112B |
| md5 | 3c75cedb1196df5eab91f31411ed4b33 | 212A4A32763DE36732D40 C:\Windows\ime\imejp\dicts\i39884.exe 3C75CEDB1196DF5EAB91F31411ED4B33 C:\pla\reports.exe 42AC350BFBC5B4EB0FEDBA16C81919C7 C:\Prog |
| md5 | 3e6e9df00a764b348ec611ee8504aca0 | BDCDED16469EDE7AB8BEDCFAE1 9EAAE9491F6A50D6DF0BE393734A44CB 3E6E9DF00A764B348EC611EE8504ACA0 9BD788F285E32A05E6591D1EB36EBFFC F42085522EC2EBB16EDCF814E7 |
| md5 | 40a562b8600f843b717bc5951b2e3c29 | ws\setup\scripts\install\software\activation\aact\dfsvc.exe 40A562B8600F843B717BC5951B2E3C29 C:\Windows\branding\scat.exe F721A76DEB28FD0B80D27FCE6B8F50 |
| md5 | 42ac350bfbc5b4eb0fedba16c81919c7 | 884.exe 3C75CEDB1196DF5EAB91F31411ED4B33 C:\pla\reports.exe 42AC350BFBC5B4EB0FEDBA16C81919C7 C:\ProgramData\update_[redacted].exe 493B901D1B33EB577DB64A |
| md5 | 493b901d1b33eb577db64aadd948f9ce | C5B4EB0FEDBA16C81919C7 C:\ProgramData\update_[redacted].exe 493B901D1B33EB577DB64AADD948F9CE C:\Windows\migration\wtr\MicrosoftBrowser.exe 2CABB72168145 |
| md5 | 5000a353399500bc78381dc95b6ed2dc | 765EF6B00B94A9B6BE0041436A 36120F5E9411BCBAC7104EF3FA964ED2 5000A353399500BC78381DC95B6ED2DC 579A9952D31CAD801A3988DBE7914CE7 867B634588C0FD6B26684D502C |
| md5 | 50568b1f9335a7e3ba4e5df035a8fb86 | 4B62289A1A9F29E19244E9A499 0C514E137860F489E3801213460EF938 50568B1F9335A7E3BA4E5DF035A8FB86 7F776AD200287D6DE14A29158C457179 51F7F794ED43FB90D0F8EBBB5E |
| md5 | 51f7f794ed43fb90d0f8ebbb5effe628 | 1F9335A7E3BA4E5DF035A8FB86 7F776AD200287D6DE14A29158C457179 51F7F794ED43FB90D0F8EBBB5EFFE628 B8C753DD254509FBA5077FFD5067EAB0 BC3739DEC8CD8F54F3F60A85F3 |
| md5 | 5329f7bff9d0d5db28821b86c26d628f | tionally, the attackers used another PowerShell script (MD5 5329F7BFF9D0D5DB28821B86C26D628F), compiled into an executable file via PS2EXE, which checks |
| md5 | 5339d1a666f3e40fe756505cf1d87d4b | D984963B9AB21309C5B2F8FD9B 0320DD389FDBAB25D46792BD2817675E 5339D1A666F3E40FE756505CF1D87D4B 67D7E3AEEB673BF60C59361C12A4ED81 89572F0ED20791A5AC9FC4267D |
| md5 | 579a9952d31cad801a3988dbe7914ce7 | 5E9411BCBAC7104EF3FA964ED2 5000A353399500BC78381DC95B6ED2DC 579A9952D31CAD801A3988DBE7914CE7 867B634588C0FD6B26684D502C15AB03 38FA4306FA4406BA31CF171AF4 |
| md5 | 63b6be9ae8d8024a40b200cccb438f1d | A6D62E C:\Users\[redacted]\AppData\Local\1c\1cv8\1cv8ud.exe 63B6BE9AE8D8024A40B200CCCB438F1D C:\Windows\notepad.exe 6AA586BCC45CA2E92A4F0EF47E086FA1 C:\ |
| md5 | 67d7e3aeeb673bf60c59361c12a4ed81 | 389FDBAB25D46792BD2817675E 5339D1A666F3E40FE756505CF1D87D4B 67D7E3AEEB673BF60C59361C12A4ED81 89572F0ED20791A5AC9FC4267D67CCB0 B6AAE073E7BFEBF4D643C2BBEB |
| md5 | 69121c36eb8bf77962dca825fcffd873 | 8F14B36F03D0F213F5F5D6BFF2 097CA205AD9E3B72018750280904718C 69121C36EB8BF77962DCA825FCFFD873 C5702EB250F855C8C872FFFB9BB656ED ED34F5A136FBA4FDEA976570FA |
| md5 | 6aa586bcc45ca2e92a4f0ef47e086fa1 | exe 63B6BE9AE8D8024A40B200CCCB438F1D C:\Windows\notepad.exe 6AA586BCC45CA2E92A4F0EF47E086FA1 C:\Windows\splwow32.exe EBA3BCDB19A7E256BF8E2CC5B9C1CCA9 C: |
| md5 | 6d7b2d1172bbdb7340972d844f6f0717 | AA306FF659DB1FAC28574A C:\ProgramData\update_[redacted].exe 6D7B2D1172BBDB7340972D844F6F0717 C:\Users\[redacted]\AppData\Local\1c\1cv8\1cv8ud.exe C:\Use |
| md5 | 7242ac065b50bcde9308756b49dbadcb | F31D383C0DD892B284DF05A495 116F59E70A9DF97F4ADAEA71EECB1E9A 7242AC065B50BCDE9308756B49DBADCB 8158552950D2E13B075001CE0C52AA97 A75DBED984963B9AB21309C5B2 |
| md5 | 7a95360b7e0eb5b107a3d231abbc541a | ted, please contact intelreports@kaspersky.com . PowerCloud 7A95360B7E0EB5B107A3D231ABBC541A C:\Windows\wininet.exe C0D1EAA15A2CEFBAB9735787575C8D8E C:\ |
| md5 | 7f776ad200287d6de14a29158c457179 | 137860F489E3801213460EF938 50568B1F9335A7E3BA4E5DF035A8FB86 7F776AD200287D6DE14A29158C457179 51F7F794ED43FB90D0F8EBBB5EFFE628 B8C753DD254509FBA5077FFD50 |
| md5 | 8158552950d2e13b075001ce0c52aa97 | E70A9DF97F4ADAEA71EECB1E9A 7242AC065B50BCDE9308756B49DBADCB 8158552950D2E13B075001CE0C52AA97 A75DBED984963B9AB21309C5B2F8FD9B 0320DD389FDBAB25D46792BD28 |
| md5 | 83edde9f7eeefac0363413972f35572b | 4588C0FD6B26684D502C15AB03 38FA4306FA4406BA31CF171AF4D36E34 83EDDE9F7EEEFAC0363413972F35572B CC751619BFEC0DC4607C17112B9E3B2C A632858F14B36F03D0F213F5F5 |
| md5 | 867b634588c0fd6b26684d502c15ab03 | 53399500BC78381DC95B6ED2DC 579A9952D31CAD801A3988DBE7914CE7 867B634588C0FD6B26684D502C15AB03 38FA4306FA4406BA31CF171AF4D36E34 83EDDE9F7EEEFAC0363413972F |
| md5 | 89572f0ed20791a5ac9fc4267d67ccb0 | A666F3E40FE756505CF1D87D4B 67D7E3AEEB673BF60C59361C12A4ED81 89572F0ED20791A5AC9FC4267D67CCB0 B6AAE073E7BFEBF4D643C2BBEB5C02E1 344CA9EA07CD4AC90EF27F8890 |
| md5 | 9769f43b9de8d19e803263267fa6d62e | cv8ud.exe C:\Users\[redacted]\AppData\Local\1c\1cv8\svc.exe 9769F43B9DE8D19E803263267FA6D62E C:\Users\[redacted]\AppData\Local\1c\1cv8\1cv8ud.exe 63B6BE |
| md5 | 9bd788f285e32a05e6591d1eb36ebffc | 491F6A50D6DF0BE393734A44CB 3E6E9DF00A764B348EC611EE8504ACA0 9BD788F285E32A05E6591D1EB36EBFFC F42085522EC2EBB16EDCF814E7C330AD 2042EB5D52F0B535A1CE6B6F95 |
| md5 | 9eaae9491f6a50d6df0be393734a44cb | icious MS Office documents 369B75BDCDED16469EDE7AB8BEDCFAE1 9EAAE9491F6A50D6DF0BE393734A44CB 3E6E9DF00A764B348EC611EE8504ACA0 9BD788F285E32A05E6591D1EB3 |
| md5 | a632858f14b36f03d0f213f5f5d6bff2 | 9F7EEEFAC0363413972F35572B CC751619BFEC0DC4607C17112B9E3B2C A632858F14B36F03D0F213F5F5D6BFF2 097CA205AD9E3B72018750280904718C 69121C36EB8BF77962DCA825FC |
| md5 | a75dbed984963b9ab21309c5b2f8fd9b | 065B50BCDE9308756B49DBADCB 8158552950D2E13B075001CE0C52AA97 A75DBED984963B9AB21309C5B2F8FD9B 0320DD389FDBAB25D46792BD2817675E 5339D1A666F3E40FE756505CF1 |
| md5 | b4e183627b7399006c1bc47b3711e419 | 6BF8E2CC5B9C1CCA9 C:\Users\[redacted]\Desktop\soc\stant.exe B4E183627B7399006C1BC47B3711E419 C:\WINDOWS\ime\service.exe F56B31A4B47AD3365B18A7E922FBA1A8 |
| md5 | b6aae073e7bfebf4d643c2bbeb5c02e1 | AEEB673BF60C59361C12A4ED81 89572F0ED20791A5AC9FC4267D67CCB0 B6AAE073E7BFEBF4D643C2BBEB5C02E1 344CA9EA07CD4AC90EF27F8890D4EC05 Domains and IPs Reverse SS |
| md5 | b8c753dd254509fba5077ffd5067eab0 | D200287D6DE14A29158C457179 51F7F794ED43FB90D0F8EBBB5EFFE628 B8C753DD254509FBA5077FFD5067EAB0 BC3739DEC8CD8F54F3F60A85F3ED600E EC076CD21C483A40156F4E40D0 |
| md5 | ba9ce06641067742f2afc9691faff1dc | ndows\PLA\System\bounce.exe C:\Windows\pla\print_status.exe BA9CE06641067742F2AFC9691FAFF1DC C:\ProgramData\hp\client.exe FB0F8027ACF1B1E47E07A63D8812ED |
| md5 | bbf1fa694122e07635deeac11ad712f8 | D8812ED50 C:\Windows\System32\timecontrolsvc\vmnetdrv64.exe BBF1FA694122E07635DEEAC11AD712F8 C:\Windows\System32\HostManagement.exe F301AA3D62B5095EEC4D |
| md5 | bc3739dec8cd8f54f3f60a85f3ed600e | 94ED43FB90D0F8EBBB5EFFE628 B8C753DD254509FBA5077FFD5067EAB0 BC3739DEC8CD8F54F3F60A85F3ED600E EC076CD21C483A40156F4E40D08DADED 216CB7F31D383C0DD892B284DF |
| md5 | c0d1eaa15a2cefbab9735787575c8d8e | oud 7A95360B7E0EB5B107A3D231ABBC541A C:\Windows\wininet.exe C0D1EAA15A2CEFBAB9735787575C8D8E C:\Windows\LiveKernelReports\update.exe D5B38B252CF212A4A32 |
| md5 | c5702eb250f855c8c872fffb9bb656ed | 05AD9E3B72018750280904718C 69121C36EB8BF77962DCA825FCFFD873 C5702EB250F855C8C872FFFB9BB656ED ED34F5A136FBA4FDEA976570FAA33ED7 0577DB70844E88B32B954906E2 |
| md5 | cc751619bfec0dc4607c17112b9e3b2c | 06FA4406BA31CF171AF4D36E34 83EDDE9F7EEEFAC0363413972F35572B CC751619BFEC0DC4607C17112B9E3B2C A632858F14B36F03D0F213F5F5D6BFF2 097CA205AD9E3B720187502809 |
| md5 | d3c8afd22baa306ff659db1fac28574a | 28FD0B80D27FCE6B8F5016 C:\Windows\ime\imekr\dicts\dfsvc.exe D3C8AFD22BAA306FF659DB1FAC28574A C:\ProgramData\update_[redacted].exe 6D7B2D1172BBDB7340972D |
| md5 | d5b38b252cf212a4a32763de36732d40 | FBAB9735787575C8D8E C:\Windows\LiveKernelReports\update.exe D5B38B252CF212A4A32763DE36732D40 C:\Windows\ime\imejp\dicts\i39884.exe 3C75CEDB1196DF5EAB91F |
| md5 | eba3bcdb19a7e256bf8e2cc5b9c1cca9 | xe 6AA586BCC45CA2E92A4F0EF47E086FA1 C:\Windows\splwow32.exe EBA3BCDB19A7E256BF8E2CC5B9C1CCA9 C:\Users\[redacted]\Desktop\soc\stant.exe B4E183627B7399006 |
| md5 | ec076cd21c483a40156f4e40d08daded | DD254509FBA5077FFD5067EAB0 BC3739DEC8CD8F54F3F60A85F3ED600E EC076CD21C483A40156F4E40D08DADED 216CB7F31D383C0DD892B284DF05A495 116F59E70A9DF97F4ADAEA71EE |
| md5 | ed34f5a136fba4fdea976570faa33ed7 | 36EB8BF77962DCA825FCFFD873 C5702EB250F855C8C872FFFB9BB656ED ED34F5A136FBA4FDEA976570FAA33ED7 0577DB70844E88B32B954906E2F20798 28ECF8FB6719E14231B94B4D37 |
| md5 | f301aa3d62b5095eec4d8e34201a4769 | E07635DEEAC11AD712F8 C:\Windows\System32\HostManagement.exe F301AA3D62B5095EEC4D8E34201A4769 C:\Windows\ime\imejp\msfu.exe F9C3BBE108566D1A6B070F9C5FB03 |
| md5 | f42085522ec2ebb16edcf814e7c330ad | F00A764B348EC611EE8504ACA0 9BD788F285E32A05E6591D1EB36EBFFC F42085522EC2EBB16EDCF814E7C330AD 2042EB5D52F0B535A1CE6B6F954C8C2B 2AA1E9765EF6B00B94A9B6BE00 |
| md5 | f56b31a4b47ad3365b18a7e922fba1a8 | B4E183627B7399006C1BC47B3711E419 C:\WINDOWS\ime\service.exe F56B31A4B47AD3365B18A7E922FBA1A8 dfsvc.exe F6F62456FB0FCC396FB654CBED339BC3 – 25C8ED0511375D |
| md5 | f6f62456fb0fcc396fb654cbed339bc3 | \ime\service.exe F56B31A4B47AD3365B18A7E922FBA1A8 dfsvc.exe F6F62456FB0FCC396FB654CBED339BC3 – 25C8ED0511375DCA57EF136AC3FA0CCA C:\branding\dwmw.exe Bro |
| md5 | f721a76deb28fd0b80d27fce6b8f5016 | A562B8600F843B717BC5951B2E3C29 C:\Windows\branding\scat.exe F721A76DEB28FD0B80D27FCE6B8F5016 C:\Windows\ime\imekr\dicts\dfsvc.exe D3C8AFD22BAA306FF659DB |
| md5 | f9c3bbe108566d1a6b070f9c5fb03160 | 1AA3D62B5095EEC4D8E34201A4769 C:\Windows\ime\imejp\msfu.exe F9C3BBE108566D1A6B070F9C5FB03160 C:\Windows\ime\imetc\help\IMTCEN14.exe Malicious MS Office |
| md5 | fb0f8027acf1b1e47e07a63d8812ed50 | 9CE06641067742F2AFC9691FAFF1DC C:\ProgramData\hp\client.exe FB0F8027ACF1B1E47E07A63D8812ED50 C:\Windows\System32\timecontrolsvc\vmnetdrv64.exe BBF1FA694 |
From the original article
9 min read at securelist.com
In 2025, we observed pervasive SSH tunnel activity, which has remained active into 2026, affecting many government organizations and commercial companies in Russia and Belarus. Behind some of this activity is Cloud Atlas, a group we have known since 2014 . During our investigation, we identified new tools used by this group, as well as indicators of compromise.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.