Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Threat Actors
Malware Families
Excerpt
https://www.netskope.com/blog/100k-in-crypto-drained-by-the-underground-operation $100k in Crypto Drained by the Underground Operation By Vini Egerland Published: 2026-10-01 · Archived: 2026-10-08 02:02:00 UTC Netskope Threat Labs analyzed a crypto-stealing operation that drains victims’ cryptocurrency exchange accounts. An Aotera/Tedy loader injects a Vidar-class stealer into a Windows process, which then launches Chrome or Edge and injects its scripts into the pages the…
Read the original report →Diamond Model
Adversary(4)
Infrastructure(6)
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →13 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | sky.com | High | Score 68/100 | First seen |
| Domain | mempool.space | High | Score 67/100 | First seen |
| URL | http://95.164.53.76/new/log/8320e1a4/startloader/1767499038 | High | Score 68/100 | First seen |
| URL | http://95.164.53.76/new/log/8320E1A4/success/1767499039 | High | Score 68/100 | First seen |
| Domain | slow-sky.com | High | Score 68/100 | First seen |
| URL | http://95.164.53.76/new/log/29A5FDA7/failed/1769331221 | High | Score 68/100 | First seen |
| URL | https://www.netskope.com/blog/100k-in-crypto-drained-by-the-underground-operation | High | Score 67/100 | First seen |
| URL | http://95.164.53.76/new/log/29A5FDA7/startLoader/1769331211 | High | Score 68/100 | First seen |
| Domain | true-lie.com | High | Score 68/100 | First seen |
| Domain | quick-neo.com | High | Score 68/100 | First seen |
| URL | http://95.164.53.76/new/log/D9D278DD/success/1696492954 | High | Score 68/100 | First seen |
| URL | http://95.164.53.76/new/log/048466C5/startCrypt | High | Score 68/100 | First seen |
| URL | https://easybooters.com/newlog.php | High | Score 68/100 | First seen |
IOC Relationship Graph
Building graph…