Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
espionageThreat Actor
Active Threat
UNC3944
14
IOCs Tracked
3
Intel Reports
Associated IOCs14 total
IP1
99.25.84.9
2026-10-09HighDomain11
servicedesk.com2026-10-16High
sso.com2026-10-16High
internal.com2026-10-16High
help.com2026-10-16High
secretsdump.py
2026-10-16Mediumhelpdesk.com2026-10-16High
twitter-okta.com2026-10-09High
victimname-cdn.com2026-10-09High
victimname-sso.com2026-10-09High
gucci-cdn.com2026-10-09High
victimname-servicedesk.com2026-10-09High
CVE2
CVE-2015-22912026-10-09Medium
CVE-2021-354642026-10-09Medium
Threat Profile
Motivationespionage
Last seenOct 2026
IOCs tracked14