Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
ToolMalware Family
Active Threat
Chisel
3.3k
IOCs Tracked
2026
First Seen
Oct 26, 2026
Last Seen
0
YARA Rules
Associated IOCs3,257 total · showing 50
Domain1
update.zip2026-10-26High
URL37
http://220.202.91.248:55001/bin.sh2026-10-19High
http://45.205.1.122/bot_ppc642026-10-21High
http://176.65.139.135/bins/telnet.sh2026-10-20High
http://119.179.238.153:48300/bin.sh2026-10-20High
http://119.117.251.43:56180/i2026-10-20High
http://123.14.36.48:37791/bin.sh2026-10-19High
http://176.65.139.41/mpsl2026-10-20High
http://171.221.41.6:56049/i2026-10-21High
http://39.90.186.84:35345/bin.sh2026-10-19High
http://85.137.53.167:24380/bins/payloads/w.sh2026-10-19High
http://217.60.195.187/st_x86_642026-10-19High
http://94.154.43.26/main_ppc2026-10-20High
http://170.254.10.219:51354/i2026-10-20High
http://109.97.45.66:34071/i2026-10-20High
http://119.102.60.44:43236/i2026-10-19High
http://42.235.86.173:33127/i2026-10-19High
https://niggersmp.net/downloads/krypton.jar2026-10-20High
http://175.149.67.216:46495/bin.sh2026-10-20High
http://85.137.53.167:24380/bins/android/akuma_i5862026-10-19High
http://175.174.99.21:54093/i2026-10-21High
MD512
85855802adeeeed96f30b6cf92b5f4aa2026-10-21High
207ab92b237fa3f9d6f3bba83c0f5e8c2026-10-21High
872d94ed54926f33545854a1cf11fbfe2026-10-21High
a6117af8edc7c983674c64024bf97d702026-10-21High
a0423b2409e35ea890a081cb3f6c86612026-10-21High
21536834842c4db06cb8d1ce0b26e6462026-10-21High
7ec4180cd731cef7884a475b1a9199402026-10-21High
3704d1a4f40fac200696832d79d743ae2026-10-21High
058126b0da5d8aaba182e78b3f67fe802026-10-21High
94e6ad4ff982e9d9402425eadc2e37702026-10-21High
e0429300e6b31179d1ccde401e9b57082026-10-21High
3f8b9fc2b1a06cc8d69f3d930c5994f42026-10-21High
Related Reports10 shown
INC and The Gentlemen Ransomware: Exposed AI Infrastructure
SOCRadarOct 20, 2026
Aoki: Infostealer Targets AI Coding Assistant Credentials
SymantecOct 15, 2026
Blinder Tunnel Campaign Targets Iraqi Infrastructure
Palo Alto NetworksOct 6, 2026
Warlock Ransomware Attackers Hit Water and Telecom Operators
SymantecOct 1, 2026
Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use
TalosSep 17, 2026
Financially Motivated Threat Actor BREEZE COMET Targets Brazil
Google Threat Intelligence (GTIG / Mandiant)Sep 1, 2026
Gotta Breach 'Em All! The Journey Of ShinyHunters
Sekoia BlogSep 24, 2026
The Gentlemen Ransomware Affiliate Deploys EtherRAT via Ethereum Smart Contract C2
Cyber PressAug 5, 2026
Access Broker Steals Kerberos Secrets to Gain Permanent Control of Enterprise Domains
Cyber PressAug 4, 2026
Spirals Attackers Disable Windows Defender and Kill Backup Services Before Encrypting Systems
Cyber PressJul 17, 2026
Threat Profile
TypeTool
StatusActive
First SeenSep 12, 2026
Last SeenOct 26, 2026
IOCs tracked3,257