Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
RansomwareMalware Family
Active Threat
Play
Critical severity
13.4k
IOCs Tracked
2020
First Seen
Oct 26, 2026
Last Seen
0
YARA Rules
Associated IOCs13,423 total · showing 50
IP48
91.202.233.2142026-10-21High
101.200.193.2112026-10-21High
67.219.102.2442026-10-21High
15.204.95.2282026-10-21High
46.151.182.2052026-10-21High
162.248.225.1652026-10-21High
221.207.101.1752026-10-21High
109.73.193.2422026-10-01High
5.101.86.982026-07-04High
5.101.86.1052026-07-06High
178.16.54.2482026-06-23High
88.119.167.1432026-08-17High
84.21.189.2252026-06-20High
107.175.148.682026-07-09High
144.172.64.1282026-10-26High
139.159.203.442026-10-21High
137.184.163.272026-10-21High
163.181.208.792026-10-21High
195.123.240.2362026-09-15High
8.152.2.862026-09-13High
SHA2562
c9d5dc956841e000bfd8762e2f0b48b66c79b79500e894b4efa7fb9ba17e4e9e2026-10-16High
1b39f9b2b96a6586c4a11ab2fdbff8fdf16ba5a0ac7603149023d73f33b844982026-10-09High
Related Reports30 shown
From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage
WizOct 20, 2026
The journey of a paper unicorn: adventures inside a modern warehouse
SecurelistOct 20, 2026
Loud, Fast, and Everywhere: Anatomy of a Real AI-Driven Cloud Attack
WizOct 19, 2026
Midnight Mimosa Malware Campaign Exploits Android Firmware Supply Chain
PolySwarmOct 19, 2026
Slaiclind: analyzing a campaign combining ClickFix and EtherHiding
StormshieldOct 19, 2026
Sekoia Honeypot Captures an Attack on GenAI Infrastructure
Sekoia BlogOct 14, 2026
Kudelski Security Research
ORKL Threat Library
Https://skanthak.homepage.t Online.de/sentinel.html
ORKL Threat Library
ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks
HuntressOct 16, 2026
An Analysis of Suo5-Based Tunneling and Pivoting Attack Techniques Through Case Studies
AhnLabOct 13, 2026
Chinese State-Linked Hackers Target US Critical Infrastructure with Automated Scanning and Cyber Espionage Tools
PolySwarmOct 16, 2026
AI-Powered Espionage Campaign Targets Government Linux Infrastructure
Palo Alto NetworksOct 15, 2026
Analysis of the Infrastructure of ARTEX, a Chinese AI Penetration Testing Tool #4 – The Birth of Copy Cat
AhnLabOct 14, 2026
The GhostX Ecosystem: Forged in Transit, Licensed to Deceive
CybleOct 15, 2026
Update Chrome: Google fixes 37 security flaws, including seven critical bugs
MalwarebytesOct 15, 2026
ASPM in the AI Era Part 1: Unified Visibility Across Your Stack
WizOct 14, 2026
Passkeys Raise the Bar. Here’s Where Attackers Can Still Get In.
HuntressOct 14, 2026
From Exposure to Lockdown: How AWS Neutralizes Compromised IAM Credentials through Managed Policies
Palo Alto NetworksSep 21, 2026
Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant
Palo Alto NetworksOct 14, 2026
Hirudo: From Fake Updates to Patched Banking Apps
ThreatFabricOct 14, 2026
KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize
Group-IB
Beware of Phishing Emails Disguised as Purchase Orders
AhnLabOct 8, 2026
Q3 2026 Statistical Report on Malware Targeting Windows Web Servers
AhnLabOct 7, 2026
Statistical Report on Malware Targeting Linux SSH Servers in the Third Quarter of 2026
AhnLabOct 7, 2026
Q3 2026 Statistical Report on Malware Targeting Windows Database Servers
AhnLabOct 7, 2026
The Threat of AI-Driven Autonomous Penetration Testing, as Examined by ARTEX
AhnLabOct 14, 2026
Case of AgentTesla Malware Distribution Disguised as a Business Proposal Email
AhnLabOct 13, 2026
ClingSTUN Turns Vulnerable Edge Devices Into Attacker Infrastructure
PolySwarmOct 13, 2026
October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)
SANS Internet Storm CenterOct 13, 2026
From Endpoint to Funhouse: Evolution of Ransomware Families and Kimsuky-Linked Distribution Cases
AhnLabSep 30, 2026
Threat Profile
TypeRansomware
StatusActive
First SeenOct 11, 2020
Last SeenOct 26, 2026
IOCs tracked13,423