|
Malware:
|
Agenda, AgendaCrypt, Akira, Gold Feather, INC, INC Ransom, Makop, Phobos, Qilin, QilinCrypt, Qilin Locker, Shanya, VX Crypt, Warlock, Water Galura, Water Manaul |
|
CVEs:
|
CVE-2019-19781, CVE-2020-1472, CVE-2021-40444, CVE-2022-30190, CVE-2023-27532, CVE-2023-27997, CVE-2023-3519, CVE-2023-48788, CVE-2023-4966, CVE-2024-21762, CVE-2024-27198, CVE-2024-55591, CVE-2025-31324, CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771, CVE-2025-68947, CVE-2025-7771 |
|
Technologies:
|
Citrix ADC, Citrix Gateway, Fortinet, Fortinet FortiGate, Fortinet FortiOS, Fortinet FortiProxy, JetBrains TeamCity, Linux, Microsoft 365, Microsoft Defender Antivirus, Microsoft Remote Desktop Services, Microsoft SharePoint, Microsoft Windows, Microsoft Windows Active Directory, NetScaler ADC, ThrottleStop, Veeam Backup & Replication, VMware ESXi, VMware vCenter Server, Zoho Mail |
|
Threat Actors:
|
Agenda, Akira, Qilin, Shanya, Storm1567, Warlock, WaterManaul |
|
Attacker Countries:
|
China, North Korea, Russia, South Korea |
|
Attacker IPs:
|
185[.]196[.]10[.]19, 185[.]208[.]156[.]157, 80[.]64[.]16[.]87 |
|
Attacker Domains:
|
cloudflariz[.]com, ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion |
|
Attacker URLs:
|
hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=05d0168e-d612-372f-a138-a539c20e6af6, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=06958e37-9494-3cfc-9691-dbff2c1b7b15, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=09fe0944-ef5f-3d12-ba5b-e92f45f8ac7f, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=0f0c766b-df6a-3ed3-9625-37491ef4fbb1, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=13772aa6-e17d-3ee8-b66f-841127db4a6d, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=160ec3c5-325f-3383-9efb-54ce9d41cca7, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=172a0c0b-0e11-3dca-9679-be3c35f7b51d, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=24434a9c-41ad-3c65-8b43-75b90b9e2724, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=260adced-0f52-3b82-a41f-7c33f3f84547, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=29384992-7b2b-358c-93a4-09c370558db3, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=2f25268a-eb51-3665-8e2f-2f2281c18069, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=2fec27e5-785a-3ed9-9df1-9e2c21deffb8, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=30582aba-6b50-39a0-aae2-54d423e3b33a, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=3105a8f7-027c-354f-a788-85b0fa50640d, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=394b2ad0-70c2-3671-be11-c905d0b35773, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=3faeb8ae-d1d1-359a-aa93-4838364ffe7d, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=4143509c-5888-304e-b429-f619e32068af, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=44ef1dbe-d696-3034-94b7-37d05dd2a4b7, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=46636a14-8107-3960-8979-aaa6e867336d, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=4eaab58e-96ae-32a4-840f-a235732f1fbf, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=5f7b8fa7-30fd-3afc-9a62-4ac7c2466955, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=60bdc9de-7958-3194-8bf0-4ea43bda4ffa, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=7131070f-c2a1-3e52-bd54-9d60ecda3263, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=78ed959a-66b1-3328-9d16-53e58f3b84f6, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=7cd3db5c-d36a-37c6-bdaf-abd8daac311c, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=901e0684-3db7-3a3a-a11d-ac287eff9dd4, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=99440aae-cecb-3eb0-872a-68cfd4cd1e6f, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=9949d38c-52b0-3ba9-8ba0-74d00d426f6b, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=9c324476-eb4b-39b9-884b-98baa22c9d21, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=b2ee3f6f-a899-33d3-96c4-6baa623321cc, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=b9493a73-8548-330f-9f9e-66ba732b4f70, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=bd40fb13-ecde-323d-ac86-d89deb3612e2, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=bd427b2f-c8cd-30f3-a2b1-2718e23ab855, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=c5441ba3-cc79-3152-9747-07c872a96faa, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=ce720cbe-9973-3142-8d32-0ee69d248dc6, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=cecefc09-2f41-3838-8223-000d3ad145f2, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=d22abc53-c565-31c2-b4d9-fab70161918a, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=d7cfdb29-1a34-31f7-bdbf-16a7a99e9b53, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=dffe3961-d699-3290-ba7c-8b3b9a912b04, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=e54ec58d-0030-3e9e-ae8a-431a29825373, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=ebc25d38-20f6-34c6-b807-fe269015e502, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=ee502f3e-d3ab-37d7-89ff-011997f664b0, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=fd5f6cee-982c-386c-a7b3-2ebcfe161a41, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=fdf4dfe9-838d-31ff-86ad-f251e462789e, hxxp[://]ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd[.]onion/site/view?uuid=feb9c071-d0e2-3c2c-9e8e-7ba0512d3638 |
|
Attacker Hashes:
|
01d00d3dd8bc8fd92dae9e04d0f076cb3158dc9c, 12fcde06ddadf1b48a61b12596e6286316fd33e850687fe4153dfd9383f0a4a0, 1305e8b0f9c459d5ed85e7e474fbebb1, 16f83f056177c4ec24c7e99d01ca9d9d6713bd0497eeedb777a3ffefa99c97f0, 31c3574456573c89d444478772597db40f075e25c67b8de39926d2faa63ca1d8, 3bb14eb610885692bd1e4e9d268d8c8d, 6bc8e3505d9f51368ddf323acb6abc49, 7787da25451f5538766240f4a8a2846d0a589c59391e15f188aa077e8b888497, 82ed942a52cdcf120a8919730e00ba37619661a3, 84e2d2084fe08262c2c378a377963a1482b35ac5, 89ee7235906f7d12737679860264feaf, 92bb4ddb98eeaf11fc15bb32e71d0a63256a0ed826a03ba293ce3a8bf057a514, 99325e2ee68a1c22d39bd508e6d216e06177817be325b131848a23ca786a2c54, bd1f381e5a3db22e88776b7873d4d2835e9a1ec620571d2b1da0c58f81c84a56, c748ad6828f8f401ebfa859a3fec40ce47a1e30d, c9707a3bc0f177e1d1a5587c61699975b1153406962d187c9a732f97d8f867c5, cf7cad39407d8cd93135be42b6bd258fce1b9909cef820e5281618a7a0099a27, d3af11d6bb6382717bf7b6a3aceada24f42f49a9489811a66505e03dd76fd1af, f6f89e070ed9be62b9ca284f2f7af9e5 |
|
Victim Industries:
|
Administrative and Support Services, Aerospace, Agriculture, Architecture, Arts & Culture, Automation, Automotive, Broadcasting, Business Services, Cloud Infrastructure, Construction, Consumer Packaged Goods, Consumer Services, Defense, Defense Contractor, Education, Energy, Financial Services, Food & Beverage, Food Distribution, Food Processing, Government, Healthcare, Health Care Technology, Hospitality, Industrials, Information Security, IT and DevOps, Logistics, Manufacturing, Maritime, Media & Publishing, Medical Technology, Nonprofit, Oil & Gas, Professional, Scientific, and Technical Services, Professional Services, Real Estate, Retail, Security Services, Technology Hardware, Telecommunications, Trade, Transportation, Travel & Tourism, Utilities, Wholesale & Distribution |
|
Victim Countries:
|
Aruba, Australia, Austria, Bangladesh, Belgium, Brazil, Canada, China, Colombia, Egypt, France, Germany, Indonesia, Ireland, Israel, Italy, Japan, Malaysia, Netherlands, New Zealand, Panama, Peru, Saudi Arabia, Serbia, Singapore, Slovakia, South Korea, Spain, Sweden, Switzerland, Taiwan, Thailand, United Arab Emirates, United Kingdom, United States |
