Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
ToolMalware Family
Active Threat
Impacket
306
IOCs Tracked
2021
First Seen
Oct 28, 2026
Last Seen
0
YARA Rules
Associated IOCs306 total · showing 50
IP13
46.8.236.1212026-08-21High
64.94.85.142026-10-26High
109.205.195.2112026-10-09High
188.40.187.1452026-10-09High
171.22.183.432026-10-09High
172.96.137.1602026-10-09High
62.60.135.642026-10-26High
62.60.131.432026-10-26High
193.149.176.502026-10-26High
162.33.179.2492026-10-26High
168.100.11.992026-10-26High
193.24.123.1622026-10-26High
193.169.194.212026-10-26High
Domain21
ks501oz9nm3v05.org2026-10-09High
2rxyt8yrhq0bgj.org2026-10-09High
8doj8uvx604eck.org2026-10-09High
kwywztxoo2xdot.org2026-10-09High
6cimu4mc085em8.org2026-10-09High
download-center.online2026-10-09High
5ka8rxp6t6eup2.org2026-10-09High
v5rjsdqogstopr.org2026-10-09High
ewujsfb1dp5ran.org2026-10-09High
ovh1kn1tcqw5kp.org2026-10-09High
ky1d1p1daahe5t.org2026-10-09High
yj6jurm5qqkye5.org2026-10-09High
ev2sirbd269o5j.org2026-10-09High
opmanager.pro2026-10-09High
fortnew.py2026-10-26High
meshcentral.girydsfsggvb.com2026-10-26High
exploit_2026_0257.py2026-10-26High
fort.py2026-10-26High
radesashar.com2026-10-26High
mesh.buttruyen.com2026-10-26High
URL5
http://162.33.178.213:8888/clear-thinking_61.92.4_INSTALL.exe2026-10-26High
http://193.149.187.81:1287/1.exe2026-10-26High
https://sthyjk.com:8443/clear-thinking_61.92.4_INSTALL.exe2026-10-26High
https://64.94.85.14:4321/endpoint2026-10-26High
https://sthyjk.com:8443/2026-10-26High
SHA2566
e842dd7642c8e04b5ec20b6393848a9c904e4832930950c16664fe7800ba382e2026-10-13High
3b22605244dbace8f0c07c2c599f88c4b831bb07e9998b869a5da2759d27ceec2026-10-09High
d2aa40cc53b40c6e76ac0677c4a54387b3f27ee94c85d9b2c3a3d66aeef92a662026-10-09High
51fdd83b3737add7f3832bd0ad0b56863c0a8f7cf9bcc16fd787d1ae4b403ce62026-10-09High
18f0898d595ec054d13b02915fb7d3636f65b8e53c0c66b3c7ee3b6fc37d35662026-10-09High
de730d969854c3697fd0e0803826b4222f3a14efe47e4c60ed749fff6edce19d2026-10-09High
MD52
1dcafb7f8448683281106b06dd22409a2026-09-21High
8c113b3aa82c81eee7c6b4ed0ba9a90f2026-10-09High
CVE3
CVE-2023-466042026-10-26High
CVE-2026-02572026-10-26High
CVE-2021-442282026-10-28High
Related Reports24 shown
Stray Cat, Open Doors: How k0t Wanders Through the Network Edge
Group-IB
Hackers Breach Enterprise Firewalls and Vpns, Exposing over 70,000 Credentials
ORKL Threat LibraryJan 1, 1
Stray Cat, Open Doors: How K0t Wanders Through the Network Edge
ORKL Threat LibraryJan 1, 1
Why Are You Texting Me? Unc3944 Leverages Sms Phishing Campaigns for Sim Swapping, Ransomware, Extortion, and Notoriety
ORKL Threat Library
The Threat of AI-Driven Autonomous Penetration Testing, as Examined by ARTEX
AhnLabOct 14, 2026
Needymantis: Unpacking a Post Compromise Malware Family Used in Targeted Operations
ORKL Threat Library
Threat Actor Profile: APT27
DeXposeSep 15, 2025
From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira
The DFIR ReportJun 29, 2026
Blurring the Lines: Intrusion Shows Connection With Three Major Ransomware Gangs
The DFIR ReportSep 8, 2025
Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use
TalosSep 17, 2026
Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer
HuntressOct 8, 2026
Financially Motivated Threat Actor BREEZE COMET Targets Brazil
Google Threat Intelligence (GTIG / Mandiant)Sep 1, 2026
Microsoft Tracks NeedyMantis Post-Compromise Malware Targeting Telecoms and Government Contractors
Cyber PressSep 29, 2026
NeedyMantis: Unpacking a post-compromise malware family used in targeted operations
Microsoft Threat IntelligenceSep 28, 2026
NightEagle Deploys GhostContainer Backdoor on Microsoft Exchange Servers in Russian Attacks
Cyber PressSep 21, 2026
NightEagle targets Russian companies
SecurelistSep 16, 2026
The Good, the Bad and the Ugly in Cybersecurity – Week 33
SentinelOne BlogAug 14, 2026
Gunra Targets Primary and Disaster-Recovery Backups Before File Encryption
Cyber PressAug 13, 2026
Access Broker Steals Kerberos Secrets to Gain Permanent Control of Enterprise Domains
Cyber PressAug 4, 2026
Detecting Certighost (CVE-2026-54121): Sigma Coverage Across the Full Attack Chain
Nextron SystemsAug 4, 2026
OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia
SecurelistJul 30, 2026
Windows Authentication Reflection Bypass Lets Attackers Gain SYSTEM Shells
Cyber PressJun 30, 2026
Storm-1175 focuses gaze on vulnerable web-facing assets in high-tempo Medusa ransomware operations
Microsoft Threat IntelligenceApr 6, 2026
Catch them while you can
DCSO CyTec BlogOct 13, 2025
Threat Profile
TypeTool
StatusActive
First SeenSep 8, 2021
Last SeenOct 28, 2026
IOCs tracked306