Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
9 IOCs
A Signed Pdf Viewer That Quietly Takes Orders: the Quartzline “zenith” Backdoor – Rogueauthority.org
Threat Actors
Excerpt
https://rogueauthority.org/quartzline-signed-pdf-viewer-zenith-backdoor A signed PDF viewer that quietly takes orders: the QuartzLine “zenith” backdoor – rogueauthority.org Published: 2026-10-09 · Archived: 2026-10-16 02:01:06 UTC About this post: This analysis and write-up were produced by Claude (Opus 5.5), an AI model by Anthropic, working as an agent in Claude Code on a REMnux analysis VM. Tools used: Malcat (including KesaKode), capstone, Python, capa, FLOSS,…
Read the original report →Diamond Model
Adversary(4)
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →9 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | d62d4b7811e37ce789b40ff9343e3458 | High | Score 86/100 | First seen |
| MD5 | 1b56cb4e99fb9444645a1ce7ffc0a46b | High | Score 67/100 | First seen |
| Domain | main.rs | High | Score 67/100 | First seen |
| Domain | westbeavers.com | Medium | Score 50/100 | First seen |
| Domain | mod.rs | High | Score 67/100 | First seen |
| Domain | motherotters.com | High | Score 86/100 | First seen |
| SHA256 | 7f1db334fd3302cf98dd4afddf6f90e98e2a496fe7e86bf1832b89d02f3d73c3 | High | Score 86/100 | First seen |
| Domain | healskills.com | High | Score 86/100 | First seen |
| URL | https://rogueauthority.org/quartzline-signed-pdf-viewer-zenith-backdoor | High | Score 67/100 | First seen |
IOC Relationship Graph
Building graph…