Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
financialThreat Actor
Active Threat
TA0042
79
IOCs Tracked
3
Intel Reports
Associated IOCs50 total
IP18
178.92.162.38
2026-10-26High2.59.170.20
2026-10-26High104.219.250.37
2026-10-26High188.114.97.1
2026-10-26High188.114.96.12026-10-26Medium104.21.69.1302026-10-26High172.67.208.1812026-10-26High216.203.21.402026-10-26High172.67.200.1342026-10-26High88.99.149.241
2026-10-26High209.99.185.204
2026-10-26High104.21.68.2502026-10-26High72.251.7.232026-10-26High144.172.112.2392026-10-26High176.98.187.47
2026-10-26High104.21.2.1312026-10-26High45.90.13.772026-10-26High37.16.74.1002026-10-26MediumDomain15
node-js.prentiva99.info2026-10-26High
cal.snehamumbai.org
2026-10-26Highhurgadatour.shop2026-10-26Highcal.joycedoula.com.br2026-10-26Highdonalurdesconfeitos.site2026-10-26High
find-postman.ddesdokww.workers.dev2026-10-26High
harialurdes.site2026-10-26High
wblob.forum2026-10-26High
marialurdes.site2026-10-26High
connection.timesmaluku.com2026-10-26High
lojinhadoluiz.online2026-10-26High
californicationdetroit.com2026-10-26High
luizestrelhashapr.online2026-10-26High
version.checkeligibitily.workers.dev2026-10-26High
lojinhadaana.org2026-10-26High
URL11
https://volmira.site/api/ext?p=98d8049e-804f-11f1-b79f-ae3a8bb85d012026-10-26High
https://codecaudiog.site/generate?domain=codecvideowin.online&payload=991589b0-4cc9-11f0-b9f4-1402ec3d56f0&prefix=NF&prefix_count=10&output=base642026-10-26High
https://granderevolucao.store/5c92d3b8734b4f498752f735a1ca0987/2026-10-26High
https://cremeb.com/kremlin?p=########-####-####-####-############&prefix=NF&prefix_count=10&output=base642026-10-26High
https://acrobat-updater.com/api/v2/acrobat/latest2026-10-26High
https://steamcommunity.com//profiles/765611997058012192026-10-26High
https://memshowblob.forum/api/index.php?a=grab2026-10-26High
https://connection.upgradeonline.site2026-10-26High
https://codecaudiog.site/87b76a60ba7c474dbf8f689df2808e1a?payload=f1d7b074-b81f-11ef-a763-1402ec3d56f02026-10-26High
https://acrobat-updater.com/generate2026-10-26High
https://volmira.site//api/savecreds2026-10-26High
SHA2566
580b441e2961739fd26e54e0a0ea08351cb10a51839519fc722cfa39ecd0c9542026-10-26High
39019279686c820c3af5684012a0085a7e2109f612c9fab886dd0577ace5b5c62026-10-26High
58aec6e3835aaf20f7b4a7e308b36a19e7454673a6f71783871e9bcf6cae8eed2026-10-26Mediumed391a16389234f9ebb6727711baaf3e068d7f77c465708fa3e8b7d0565d7fb92026-10-26Medium
d0bba09f1bf9253816511731dd376e1cbbc8437c6225fda8b04c0bf1787236b92026-10-26Medium
c85f2765a6c3c3f3907c17e57df12f8f68826f74bff3bbfd272af50666d065fe2026-10-26Medium
Related Reports3 total
TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains
Elasticsearch Security LabsJul 16, 2026
Lost in relocation: analysis of a new loader distributing CASTLESTEALER
Elasticsearch Security LabsJun 19, 2026
The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions
Elasticsearch Security LabsSep 14, 2026
Threat Profile
Motivationfinancial
Last seenOct 2026
IOCs tracked79