Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
35 IOCs
Adversaries exploit CVE-2025-55182 to attack Russian companies
Malware Families
Excerpt
In December 2025, BI.ZONE TDR detected malicious activity targeting companies in the Russian insurance, e-commerce, and IT sectors. The threat actors leveraged the CVE‑2025‑55182 (React2Shell) vulnerability. The campaign primarily distributed the XMRig cryptocurrency miner and, occasionally, the Kaiji and Rustobot botnets or the Sliver implant. BI.ZONE Threat Intelligence also identified campaigns exploiting React2Shell that were not targeting Russia. In these attacks, threat…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(3)
Victim
Indicators of Compromise
Open the mindmap →35 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | ilefttotolinkalone.anondns.net | High | Score 58/100 | First seen |
| Domain | bitcoinbandit.anondns.net | High | Score 58/100 | First seen |
| URL | http://103.135.101.15/wocaosinm.sh | High | Score 58/100 | First seen |
| URL | http://45.134.174.235:443/. | High | Score 58/100 | First seen |
| IP | 107.173.89.153 | High | Score 58/100 | First seen |
| URL | wss://156.67.221.96:443/agent.ashx | High | Score 58/100 | First seen |
| URL | http://107.173.89.153:60051/slt. | High | Score 58/100 | First seen |
| Domain | dontblockme.anondns.net | High | Score 58/100 | First seen |
| URL | https://156.67.221.96/meshagents?id=hrfDDhB@yNf4oBrCH@R$KfVp27XfA78LiX@IZUxoTgs3zCwG$bjdpR@0oa8@BhTf&installflags=0&meshinstall=6.</p><p>During | High | Score 58/100 | First seen |
| URL | http://193.24.123.68:3001/gfdsgsdfhfsd_ghsfdgsfdgsdfg.sh. | High | Score 58/100 | First seen |
| URL | http://176.117.107.154/bot; | High | Score 58/100 | First seen |
| Domain | cryptoenjoyers.anondns.net | High | Score 58/100 | First seen |
| URL | http://109.238.92.111:8000/upload. | High | Score 58/100 | First seen |
| Domain | keep.camdvr.org | High | Score 58/100 | First seen |
| URL | https://tr.earn.top/Log.php?id=MIIKN<br | High | Score 58/100 | First seen |
| URL | https://tr.earn.top/nginxs | High | Score 58/100 | First seen |
| URL | https://tr.earn.top/apaches.sh | High | Score 58/100 | First seen |
| SHA256 | 420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14 | Medium | Score 53/100 | First seen |
| Domain | rustbot.anondns.net | High | Score 58/100 | First seen |
| URL | http://109.238.92.111/ch.sh. | High | Score 58/100 | First seen |
| Domain | api.my-ip.io | High | Score 58/100 | First seen |
| SHA1 | 22f96d61cf118efabc7c5bf3384734fad2f6ead4 | Medium | Score 53/100 | First seen |
| Domain | 6krinewb458nhqqmueotgawip9v1jr7g.oastify.com | High | Score 58/100 | First seen |
| URL | https://webhook.site/63575795-ee27-4b29-a15d-e977e7dc8361 | High | Score 58/100 | First seen |
| URL | http://128.199.194.97:9001/setup2.sh | High | Score 58/100 | First seen |
| IP | 154.89.152.240 | High | Score 62/100 | First seen |
| URL | http://91.215.85.42:3000/crypto/keys | High | Score 58/100 | First seen |
| URL | http://keep.camdvr.org:8000/d5.sh | High | Score 58/100 | First seen |
| Domain | oia0lwut2n65f8o4swmbesu0nrtih95y.oastify.com | High | Score 58/100 | First seen |
| URL | http://128.199.194.97:9001/runnv.tar.gz | High | Score 58/100 | First seen |
| URL | https://tr.earn.top/config.json. | High | Score 58/100 | First seen |
| URL | http://91.215.85.42:3000 | High | Score 58/100 | First seen |
| URL | http://216.158.232.43:12000/sex.sh | High | Score 58/100 | First seen |
| URL | http://keep.camdvr.org:8000/BREAKABLE_PARABLE5. | High | Score 58/100 | First seen |
| URL | https://sitiolibre.com/wp/wp-content/plugins/gassembly/js/love0. | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…