Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
An Open Server, an Exposed Toolkit Inside a Viva Aerobus-Linked Intrusion
Malware Families
Excerpt
Blog October 1, 2026 Cyber Threat Landscape An Open Server, an Exposed Toolkit Inside a Viva Aerobus-Linked Intrusion On September 25, 2026, an attacker-controlled staging server used to host tools and stolen material was left exposed to the public internet with no authentication. At 16:20, a victim-side Microsoft SQL Server retrieved a payload from the infrastructure. Within minutes, an unrelated external host began enumerating the same server and its exposed directories. By…
Read the original report →Diamond Model
Adversary
Infrastructure
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | c38f49ba68b891bb476510704cddf080798f3c70075e2a517e98e04e833f64fa | Medium | Score 38/100 | First seen |
| SHA256 | 8b6c53e3d57b4c3049f3d0765a44d9a52feb6af78f1eaa5aff19daf1b9665998 | Medium | Score 38/100 | First seen |
| SHA256 | 33aeaaa3d57b7785ef2be5b8ccd39d534b8af50e0cd32a5036fdb64601a52fc9 | Medium | Score 38/100 | First seen |
IOC Relationship Graph
Building graph…