Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
ToolMalware Family
Active Threat
SecretsDump
154
IOCs Tracked
2024
First Seen
Oct 28, 2026
Last Seen
0
YARA Rules
Associated IOCs154 total · showing 50
IP8
64.94.85.142026-10-26High
62.60.131.432026-10-26High
62.60.135.642026-10-26High
162.33.179.2492026-10-26High
193.169.194.212026-10-26High
193.24.123.1622026-10-26High
193.149.176.502026-10-26High
168.100.11.992026-10-26High
Domain14
fortnew.py2026-10-26High
exploit_2026_0257.py2026-10-26High
meshcentral.girydsfsggvb.com2026-10-26High
fort.py2026-10-26High
alknene.shop2026-10-26High
mesh.buttruyen.com2026-10-26High
radesashar.com2026-10-26High
internal.com2026-10-16High
help.com2026-10-16High
sso.com2026-10-16High
servicedesk.com2026-10-16High
cookie_file.name2026-10-26High
secretsdump.py2026-10-16Medium
ssl.blsouqs.com2026-10-09High
URL7
http://162.33.178.213:8888/clear-thinking_61.92.4_INSTALL.exe2026-10-26High
https://sthyjk.com:8443/clear-thinking_61.92.4_INSTALL.exe2026-10-26High
http://193.149.187.81:1287/1.exe2026-10-26High
http://162.33.178.213:8888/2026-10-26High
https://sthyjk.com:8443/2026-10-26High
https://64.94.85.14:4321/endpoint2026-10-26High
https://agent.afahimsa.top/meshagents2026-10-26High
SHA2565
1d1b76d30a69aa39b224053481483156f82dde026edd6f5d964f6e03f5f04a6d2026-10-26High
808145ec3351569083fda27a910ebdf9e054e8ca42e40c021af5d6712c2ab87c2026-10-26High
158215c7371e868f3d0c7fd2e92f05026a8678a3635629d89bd6042ee543278a2026-10-26High
39c4decc4881ec02a47cd01c0fd8c3030527b466124ad03c6f99cfaa0ba0b72e2026-10-26High
f9e95af4cda14dd5596c452a1a698f60412a7b2a9540321ee2a10b3bcbbd2a0e2026-10-26High
MD55
13367fbba4344de87de418ab17de76f02026-10-26High
20dc8f1b8a313336c14e03bcb71ff6c82026-10-26High
5318f29ef434341d989d543b14fd2a482026-10-26High
032473db4d66748eab524effe57a661d2026-10-26High
6f5d18157425aa9697913ae1310f588f2026-10-26High
SHA17
e47a2b7ca6a8c009962871dbb667d128ad6b61622026-10-26High
f05daaf66b200672d679a5ced8b67d4b48a4906e2026-10-26High
b686a811ad89671fbdb448d65f79488d2e5622652026-10-26High
bfd864ec0e6bd912f932e4f3ed80687736ee16e82026-10-26High
6546801898d0b32f5050f49c5302f0366d630cc92026-10-26High
e2c96e603323d8fc7c08678b793d56554faa69142026-10-26High
b39cf70a0194d32e00d7812c29ae1d6add77b8232026-10-26High
Email1
threatintel@nyxlab.com2026-10-26High
CVE3
CVE-2026-02572026-10-26High
CVE-2021-442282026-10-28High
CVE-2025-644462026-10-26High
Related Reports10 shown
Stray Cat, Open Doors: How k0t Wanders Through the Network Edge
Group-IB
Stray Cat, Open Doors: How K0t Wanders Through the Network Edge
ORKL Threat LibraryJan 1, 1
Why Are You Texting Me? Unc3944 Leverages Sms Phishing Campaigns for Sim Swapping, Ransomware, Extortion, and Notoriety
ORKL Threat Library
Threat Actor Profile: APT27
DeXposeSep 15, 2025
Scattered Spider: Social Engineering Meets Cloud Ransomware Tactics
Secure BlinkMay 20, 2025
Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use
TalosSep 17, 2026
Gunra Targets Primary and Disaster-Recovery Backups Before File Encryption
Cyber PressAug 13, 2026
Detecting Certighost (CVE-2026-54121): Sigma Coverage Across the Full Attack Chain
Nextron SystemsAug 4, 2026
OctLurk and SilkLurk: newly identified tailored backdoors in cyber-espionage campaign in Central Asia
SecurelistJul 30, 2026
Catch them while you can
DCSO CyTec BlogOct 13, 2025
Threat Profile
TypeTool
StatusActive
First SeenMar 11, 2024
Last SeenOct 28, 2026
IOCs tracked154