|
Malware:
|
BEACON, Cobalt Strike, EKZ Infostealer, EKZ Stealer, GOLD IONIC, Inc, INC, Incransom, INC Ransom, INC Ransomware, Lynx, Lynx Ransomware, RainINC, Ransom.Inc, Tarnished Scorpion, Warble, Water Anito |
|
CVEs:
|
CVE-2019-6693, CVE-2020-9289, CVE-2023-35082, CVE-2023-3519, CVE-2023-48788, CVE-2023-4966, CVE-2024-4885, CVE-2024-55591, CVE-2025-24472, CVE-2026-15409, CVE-2026-15410, CVE-2026-35616 |
|
Technologies:
|
AnyDesk, Citrix ADC, Citrix Application Delivery Controller (ADC), Citrix Gateway, Citrix NetScaler, Citrix NetScaler ADC, Citrix NetScaler Gateway, ConnectWise ScreenConnect, Fortinet FortiClient EMS, Fortinet FortiGate, Google Chrome, Linux, Microsoft 365, Microsoft Windows, Microsoft Windows Active Directory, Mozilla Firefox, NetScaler, Nextcloud, Progress WhatsUp Gold, SimpleHelp, SonicWall SMA 1000 Series, TeamViewer, Veeam Backup & Replication, VMware ESXi, WordPress |
|
Threat Actors:
|
DEV-0832, G1032, GoldIonic, GroupG1032, INC, Incransom, INCRansomware, Lynx, Storm-0494, Storm0494, VanillaTempest, ViceSociety, WaterAnito, WaterLalawag |
|
Attacker Countries:
|
Russia |
|
Attacker IPs:
|
173[.]239[.]211[.]0/24, 185[.]214[.]132[.]35, 193[.]37[.]32[.]179, 193[.]37[.]32[.]214, 208[.]67[.]220[.]220, 216[.]73[.]163[.]151, 216[.]73[.]163[.]158, 217[.]144[.]189[.]136, 45[.]131[.]194[.]0/24, 45[.]146[.]54[.]0/24, 45[.]80[.]228[.]227, 63[.]135[.]161[.]0/24, 83[.]138[.]53[.]110 |
|
Attacker Domains:
|
incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onion, incblog[.]su, inc-decrypt[.]onion, inc-ransom[.]com, lynxblog[.]net |
|
Attacker URLs:
|
hxxp[://]incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onion/blog/disclosures/6a36e3205ae71db30cedda2d, hxxp[://]incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onion/blog/disclosures/6a39bd685ae71db30c36b16f, hxxp[://]incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onion/blog/disclosures/6a3db3e25ae71db30ca592ca, hxxp[://]incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onion/blog/disclosures/6a3db5855ae71db30ca5c454, hxxp[://]incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onion/blog/disclosures/6a3ec89a5ae71db30cc28853, hxxp[://]incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onion/blog/disclosures/6a3ecaeb5ae71db30cc2d19e, hxxp[://]incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onion/blog/disclosures/6a3ed7185ae71db30cc451c5, hxxp[://]incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onion/blog/disclosures/6a43bac85ae71db30c4f3cb1, hxxp[://]incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onion/blog/disclosures/6a45a1b85ae71db30c88ab68, hxxp[://]incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onion/blog/disclosures/6a46888b5ae71db30ca3fad9, hxxp[://]incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onion/blog/disclosures/6a468abe5ae71db30ca4400d, hxxp[://]incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onion/blog/disclosures/6a468b5b5ae71db30ca45835, hxxp[://]incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onion/blog/disclosures/6a468c355ae71db30ca47b2d, hxxp[://]incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onion/blog/disclosures/6a468eaf5ae71db30ca4ccc0, hxxp[://]incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onion/blog/disclosures/6a468fe25ae71db30ca4f6ae, hxxp[://]incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onion/blog/disclosures/6a4691a75ae71db30ca5296a, hxxp[://]incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onion/blog/disclosures/6a4704745ae71db30cb3362a, hxxp[://]incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onion/blog/disclosures/6a4706c25ae71db30cb381c1, hxxp[://]incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onion/blog/disclosures/6a4d514e5ae71db30c5e3261, hxxp[://]incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onion/blog/disclosures/6a5984205ae71db30c99e780, hxxp[://]incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onion/blog/disclosures/6a5ad6bb5ae71db30cbcec59, hxxp[://]incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onion/blog/disclosures/6a5ad7205ae71db30cbcf9e2, hXXp[:]//lynxblog.net/ |
|
Attacker Hashes:
|
2cc40ba8aebc0e41becff1b953f27fc5e27ff24b0d0e2204a141f3367fa4c6bd, 6e65483764d7c25523a5bbef5be99eb42349eef39d5517c46d3a4af262a80ceb, 97f473737b2b625c0f68987ab867e40d7e47cf829e25ddc9d6ddd451d01e538c, c02b014d88da4319e9c9f9d1da23a743a61ea88be1a389fd6477044a53813c72, d0c1662ce239e4d288048c0e3324ec52962f6ddda77da0cb7af9c1d9c2f1e2eb |
|
Victim Industries:
|
Agriculture, Agriculture & Food Production, Automotive, Construction, Education, Energy, Environmental, Financial Services, Food & Beverage, Government, Healthcare, Industrials, Legal Services, Logistics, Manufacturing, Media and Entertainment, Petrochemical, Professional Services, Retail, Technology Hardware, Transportation & Logistics, Utilities, Waste Management, Wholesale |
|
Victim Countries:
|
Afghanistan, Antigua and Barbuda, Argentina, Armenia, Australia, Azerbaijan, Bahamas, Bahrain, Bangladesh, Barbados, Belize, Bhutan, Bolivia, Brazil, Brunei, Cambodia, Chile, China, Colombia, Cook Islands, Costa Rica, Cuba, Cyprus, Dominica, Dominican Republic, Ecuador, El Salvador, Fiji, Georgia, Germany, Grenada, Guatemala, Guyana, Haiti, Honduras, India, Indonesia, Iran, Iraq, Israel, Italy, Jamaica, Japan, Jordan, Kazakhstan, Kiribati, Kuwait, Kyrgyzstan, Laos, Lebanon, Malaysia, Maldives, Marshall Islands, Mexico, Micronesia, Mongolia, Myanmar, Nauru, Nepal, New Zealand, Nicaragua, North Korea, Oman, Pakistan, Palau, Panama, Papua New Guinea, Paraguay, Peru, Philippines, Qatar, Russia, Saint Kitts and Nevis, Saint Lucia, Saint Vincent and the Grenadines, Samoa, Saudi Arabia, Singapore, Solomon Islands, South Africa, South Korea, Sri Lanka, Suriname, Syria, Taiwan, Tajikistan, Thailand, Timor-Leste, Tonga, Trinidad and Tobago, Turkey, Turkmenistan, Tuvalu, United Arab Emirates, United States, Uruguay, Uzbekistan, Vanuatu, Venezuela, Vietnam, Yemen |
