Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
30 IOCs
Auditing the auditor: Unmasking Apex Accelerator
Threat Actors
Excerpt
Elastic Security Labs identified a malicious npm package, @apexacc/cli , which led us to an operation posing as a Web3 accelerator. That operation had spent months building a public presence, targeting cryptocurrency start-ups and founders with offers of free AI credits and coding tools, along with security audits. The group also advertised an in-person event through a dedicated invitation page, adding to its efforts to appear legitimate. The tools delivered…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →30 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 985829083f3937df6c82419216f7697afae0caac8efca6257a756066fe2c0abb | Medium | Score 53/100 | First seen |
| Domain | arena.apexfdn.xyz | High | Score 68/100 | First seen |
| Domain | token.apexaccs.org | High | Score 58/100 | First seen |
| URL | https://ccmihr.com/macos/jquery.js | High | Score 58/100 | First seen |
| SHA256 | 42a760b15fea7c9af718ee45386c1c3ea1bec9e30c95d16c287bcc8b2efdc72e | Medium | Score 53/100 | First seen |
| SHA256 | 127ae4cad80b6605157ca2a1feada8a235e16aacc5d2119337a98115a4e13274 | Medium | Score 53/100 | First seen |
| Domain | apexaccs.org | High | Score 58/100 | First seen |
| Domain | arenapex.cloud | High | Score 58/100 | First seen |
| URL | https://vrf.apexaccs.org/api/v1/vrf | High | Score 58/100 | First seen |
| URL | https://verify.apexfdn.xyz/macos/installer/terminal/interactive/bash | High | Score 58/100 | First seen |
| SHA256 | 20f0a401676292d4ae34932e61f34afa97bcfc47ee517cda2afeb7222264a193 | Medium | Score 53/100 | First seen |
| SHA256 | ed5cb4af1d2cb067b8d23783ebf05d70278728462ba4f1bf29da0a3a41efc35e | Medium | Score 53/100 | First seen |
| URL | https://ehegisnightmare.icu/build/J2BkQFArlBUXf4MF/install.exe | High | Score 58/100 | First seen |
| SHA256 | d719bf57e65ba09de1bacdb182c99118edafd518fd3a4a9797bcad221adb8151 | Medium | Score 53/100 | First seen |
| URL | https://arena.apexaccs.org/dashboard/pilot | High | Score 58/100 | First seen |
| SHA256 | e98f37d7f4e1fa433d19304dc2258042090e2d1d7eea7670d41f738d08729660 | Medium | Score 53/100 | First seen |
| Domain | fdn4apex.com | High | Score 58/100 | First seen |
| URL | https://main.router-apex.com/updater.sh | High | Score 58/100 | First seen |
| URL | https://arena.apexaccs.org/api/llm/v1/chat/completions | High | Score 58/100 | First seen |
| SHA256 | 68f5a00eafa8ecebf5d93328e0fec23b24d6f91808c8384db002946a13656c71 | Medium | Score 53/100 | First seen |
| Domain | cloudmain365duo.top | High | Score 58/100 | First seen |
| URL | https://arena.apexaccs.org/api/llm/v1 | High | Score 58/100 | First seen |
| SHA256 | 5ee7145061f05779f7f6f9b72e216713d17d53e183a92f408bfbbc44f2bfb95d | Medium | Score 53/100 | First seen |
| URL | https://arena.apexaccs.org/api/copilot/mcp | High | Score 58/100 | First seen |
| URL | https://update.apex-arena-router.com/loader.sh | High | Score 58/100 | First seen |
| URL | https://ehegisnightmare.icu/build/nTOugj-fWWMurYHg/bludness.exe | High | Score 58/100 | First seen |
| SHA256 | a50cdb508d13884630945a98eea0615b866d938eb0a16c5d958e6c8c181a6df8 | Medium | Score 53/100 | First seen |
| SHA256 | ee8cd9aba420f1b26b5d43e5bcdd6025a277b4946bb5daf76ab45c0e5f7ecd0b | Medium | Score 53/100 | First seen |
| SHA256 | ccf8a1cec56605b8517552ba1a2d061c03a29e90274fb2fcf59ba4b75c392390 | Medium | Score 53/100 | First seen |
| SHA256 | b31c6e241ac846728da9c1fac4936651cffb944d143ab816276bcc6da0284787 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…