|
Malware:
|
Anubis, Arkei, AryStinger, Chisel, Coathanger, CryptoBandits, CyberStrike Harvester, DarkComet, DarkKomet, DragonForce, EKZ Infostealer, EKZ Stealer, FakeUpdates, fg_sniffer, FGSniffer, FortigateSniffer, FortiGate Sniffer, GentleKiller, Gentlemen, GOLD IONIC, harvest_orig, HavocKiller, HexKiller, HwAudKiller, Incransom, Inc Ransom, INC Ransom, INC Ransomware, Infamous Chisel, Lumma, LummaC2, Lumma Stealer, Lynx, Lynx ransomware, Lynx Ransomware, Neo-reGeorg, OxideHarvest, RainINC, reGeorg, RenEngine, RenEngine Loader, RisePro, SNIFTRAN, SocGholish, Sphinx, TA569, Tarnished Scorpion, ThrottleBlood, Trojan:Win32/CryptoBandits.A, Vidar, Vidar Stealer, Water Anito, Water Lalawag |
|
CVEs:
|
CVE-2018-13379, CVE-2022-42475, CVE-2023-27997, CVE-2023-3519, CVE-2024-21762, CVE-2024-55591, CVE-2025-24472, CVE-2025-59718, CVE-2025-59719, CVE-2026-21643, CVE-2026-24858, CVE-2026-25089, CVE-2026-25815, CVE-2026-35616, CVE-2026-39808, CVE-2026-39813, CVE-2026-50656 |
|
Technologies:
|
Citrix Gateway, Citrix Secure Access, Fortinet, Fortinet FortiAnalyzer, Fortinet FortiClient EMS, Fortinet FortiGate, Fortinet FortiManager, Fortinet FortiOS, Fortinet FortiSandbox, Fortinet FortiWeb, Fortinet SSL VPN, Microsoft Entra ID, Microsoft Remote Desktop Web Access, Microsoft SQL Server, Microsoft Windows, Microsoft Windows Active Directory, Microsoft Windows Server, Nextcloud, Oracle MySQL, PostgreSQL, Sophos, Sophos Firewall, Sophos SSL VPN, Synology Network Attached Storage |
|
Threat Actors:
|
BelsenGroup, Clarksome, INC, INCRansomware, Lynx, Storm0494, VanillaTempest, VoltTyphoon |
|
Attacker Countries:
|
Russia, Yemen |
|
Attacker IPs:
|
167[.]179[.]76[.]111, 175[.]155[.]64[.]221, 185[.]229[.]26[.]83, 193[.]8[.]187[.]2, 193[.]8[.]187[.]26, 193[.]8[.]187[.]42, 194[.]113[.]39[.]71, 198[.]53[.]64[.]194, 199[.]247[.]7[.]82, 213[.]169[.]49[.]142, 38[.]117[.]87[.]37, 38[.]54[.]88[.]203, 38[.]54[.]95[.]226, 38[.]60[.]212[.]97, 45[.]32[.]153[.]218, 45[.]61[.]136[.]7, 77[.]91[.]122[.]13, 83[.]138[.]53[.]110, 85[.]11[.]187[.]28, 85[.]11[.]187[.]8 |
|
Attacker Domains:
|
exploit[.]in, lynxblog[.]net, vast[.]ai |
|
Attacker URLs:
|
85[.]11[.]187[.]8[:]8443, hxxps[://]www[.]hudsonrock[.]com/fortinet, hXXp[:]//lynxblog.net/ |
|
Attacker Hashes:
|
268a8420b791df46380ed9ad69905207e15d8a7c, 2758f4d71a2a2dfdefab81737c2d776b2a3dafe5844fdd2157e089a28447ca98, 2c98c86e6bd6f46cbd6c89d855541b9da91515b1bb986641a77e31c5c6aa2abb, 38353f95fff270f4e3a9d7add8c64666020dd668ce66e15969a736ec48cadc59, 4253dd1a4c0867b0be7732f75b2f630cebfb7fed94270e15fb3b12ae40546d01, 479ae5fd7274439ddfa27bc03298ebfdfc5ff17f6412acccf74d4dbd90d94218, 4d0b62d3162d4be391e3ba1e191dad28e5e5d5b161cfdef60eeb4361a92d8413, 6e65483764d7c25523a5bbef5be99eb42349eef39d5517c46b3a4af262a80ceb, 7f74bb6ba185978134c318bc5f91d23c, 80d83eb01f28c87a61b51f1f83805e63a791905f019bd3b87f10a10f66efab1e, 874bcb1c3d050a5b5b333a2198f504fcb27927c2abdd43b07440188a380c52d5, 9eaa577c8ba71646928c1c34c3145536b0498f65f26060a6ba00744bcef57644, a8b09fd4f7ff2f298b45ca602992f44b3c2ac3746bcdb182c59ab2a20c690954, c02b014d88da4319e9c9f9d1da23a743a61ea88be1a389fd6477044a53813c72 |
|
Victim Industries:
|
Aerospace, Agriculture, Architecture, Automotive, Business Services, Cloud Infrastructure, Construction, Consulting Services, Defense, Education, Energy, Financials, Financial Services, Government, Healthcare, Health Care Technology, Hospitality, Industrials, Information Technology, IT and DevOps, IT Services, Legal Services, Logistics, Manufacturing, Media and Entertainment, Multimedia, Oil & Gas, Professional Services, Public Administration, Real Estate, Retail, Technology Hardware, Telecommunications, Transportation, Utilities |
|
Victim Countries:
|
Afghanistan, Albania, Antigua and Barbuda, Argentina, Armenia, Australia, Azerbaijan, Bahamas, Bahrain, Bangladesh, Barbados, Belgium, Belize, Bhutan, Bolivia, Brazil, Brunei, Bulgaria, Cambodia, Canada, Chile, China, Colombia, Cook Islands, Costa Rica, Croatia, Cuba, Cyprus, Czech Republic, Denmark, Dominica, Dominican Republic, Ecuador, El Salvador, Estonia, Fiji, Finland, France, Georgia, Germany, Greece, Grenada, Guatemala, Guyana, Haiti, Honduras, Hong Kong, Hungary, Iceland, India, Indonesia, Iran, Iraq, Ireland, Israel, Italy, Jamaica, Japan, Jordan, Kazakhstan, Kiribati, Kuwait, Kyrgyzstan, Laos, Latvia, Lebanon, Lithuania, Luxembourg, Malaysia, Maldives, Marshall Islands, Mexico, Micronesia, Mongolia, Montenegro, Myanmar, Nauru, Nepal, Netherlands, New Zealand, Nicaragua, North Korea, North Macedonia, Norway, Oman, Pakistan, Palau, Panama, Papua New Guinea, Paraguay, Peru, Philippines, Poland, Portugal, Qatar, Romania, Russia, Saint Kitts and Nevis, Saint Lucia, Saint Vincent and the Grenadines, Samoa, Singapore, Slovakia, Slovenia, Solomon Islands, South Korea, Spain, Sri Lanka, Suriname, Sweden, Syria, Taiwan, Tajikistan, Thailand, Timor-Leste, Tonga, Trinidad and Tobago, Turkey, Turkmenistan, Tuvalu, United Arab Emirates, United Kingdom, United States, Uruguay, Uzbekistan, Vanuatu, Venezuela, Vietnam, Yemen |
