Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
43 IOCs
Beyond hacktivism: Insolent Hyena demonstrates mixed motives and objectives
Threat Actors
Malware Families
Excerpt
The hacktivist cluster is actively collaborating with cyber espionage operators and financially motivated actors. Insolent Hyena’s toolkit includes the previously undocumented NightWire trojan, the Excalibur stealer, as well as legitimate software and dual-use tools Overview From January through July 2026, we analyzed the activity of the Insolent Hyena cluster. The threat actor was found to use the following tools: NightWire, a previously undocumented remote access trojan…
Read the original report →Diamond Model
Adversary(2)
Infrastructure(6)
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →43 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | http://canarytokens.com/tags/feedback/static/1o6pm1zgcinkbnbkw1nkub86h/submit.aspx | High | Score 58/100 | First seen |
| SHA256 | bd534fcbd2c37e8ba751f4609ef046b7e1e82f7ea6c2d28c535f97b907d18e12 | Medium | Score 53/100 | First seen |
| Domain | microsoftpathes.com | High | Score 58/100 | First seen |
| SHA256 | 88243699d9aa42ff69b53f86462f597630df1c5650e27815887bc89e1f2b06c0 | Medium | Score 53/100 | First seen |
| URL | https://0.rospotrebru.com/0/midnig.ht | High | Score 58/100 | First seen |
| SHA256 | 7a7e92a311c49b5b766429e5d85c87e4270e1a08d7fbb1fe8b794f7a78e4edb6 | Medium | Score 53/100 | First seen |
| SHA256 | ab01eb9eccd3237318961d3a72320e53567a730f785955a544021be7aedb1961 | Medium | Score 53/100 | First seen |
| URL | https://intekopt.ru/yacaptcha/verification/id928012750/yande.x | High | Score 58/100 | First seen |
| SHA256 | fe5cedd40864963a2d5d3972e74c3563a9bcfd6f77a2ef1d228272cfff72ef59 | Medium | Score 53/100 | First seen |
| URL | https://unmoralreformeddehydrate.cfd:443 | High | Score 58/100 | First seen |
| URL | https://0.rospotrebru.com/0/p.la | High | Score 58/100 | First seen |
| SHA256 | d51c6b1b160f168fb936b94a67e5a6f3c5bc7d00fdd61d30ee17aa3e8e4b9078 | Medium | Score 53/100 | First seen |
| SHA256 | 7809497c82a705c73aeb9d226c2ec8cb5b174a4c5696867d01f3ef0b186c7188 | Medium | Score 53/100 | First seen |
| Domain | securityswindow.com | High | Score 58/100 | First seen |
| SHA256 | 79b182f581310548c5de0913deda2a99e24c6f8d651e714b6b98890931e0a5fb | Medium | Score 53/100 | First seen |
| SHA256 | 2463f321e6263c562dfde4a30012e0c699c28c62f3545578b02c93cbfe799929 | Medium | Score 53/100 | First seen |
| SHA256 | e5b57193cea47c80947f87d1ffa7e376eead6a0bbec740a89c7e161205410b09 | Medium | Score 53/100 | First seen |
| SHA256 | c08353db74c847d6bddab0f2a9aed6fde42014a66cf7abbbd46cdd964b9c1929 | Medium | Score 53/100 | First seen |
| SHA256 | 17a73c01e6dfc40b3b4a29f2630d8ead8e04a6f6588b705dbe0aaa6efdaa4214 | Medium | Score 53/100 | First seen |
| IP | 178.236.252.92 | High | Score 58/100 | First seen |
| SHA256 | 4824f6686b8746cc9aabe931f5e0acf9b474a72b8a07a76f78711e10ffb290cc | Medium | Score 53/100 | First seen |
| SHA256 | ad5b915766b0182202648ff9c5c4881a4fcabca8e8847cad497f47c01a5a02fb | Medium | Score 53/100 | First seen |
| SHA256 | a03ea11e5ea4808afaeb5189916dd3d62da65e004cb70b1d07703e24b6d6ee33 | Medium | Score 53/100 | First seen |
| SHA256 | 3536e20a177c79581cada5bc7008b246a00c3f9d9f4e98424d2db5802d3ac7f2 | Medium | Score 53/100 | First seen |
| URL | https://lorebird.com/p/a.u | High | Score 58/100 | First seen |
| IP | 81.26.179.144 | High | Score 58/100 | First seen |
| SHA256 | f074eaf5239af199369dd414aea7316610e8f7decbe5e1c936cbdcdbec6aabe9 | Medium | Score 53/100 | First seen |
| IP | 91.219.150.109 | High | Score 58/100 | First seen |
| SHA256 | 2f211c850d8bdd34bbfbea3fdf1a9b7089fdefb94768c3a2cf76243a29967ec8 | Medium | Score 53/100 | First seen |
| SHA256 | ee117e51e7c2aaf411af9c392863562441145d6efd764627f6461f8c614243a3 | Medium | Score 53/100 | First seen |
| URL | https://freeportcrm.com | High | Score 58/100 | First seen |
| SHA256 | 2b8d278297c08bc44236daf5c1b1f964b1d514217cfd2205c3a0dc835dbdf05c | Medium | Score 53/100 | First seen |
| Domain | unmoralreformeddehydrate.cfd | High | Score 61/100 | First seen |
| SHA256 | 4e9fc3d61d41be8f52223a8d24cbcb4f8c962c780b470da6e1e3824fbb5b8ecc | Medium | Score 53/100 | First seen |
| Domain | micrasoftwindow.com | High | Score 58/100 | First seen |
| URL | https://0.rospotrebru.com/0/ferr.um | High | Score 58/100 | First seen |
| SHA256 | 4856ddb55e8f6a901a8690e22a697662369055f386ab7059d47a38cb9ee792e8 | Medium | Score 53/100 | First seen |
| URL | http://canarytokens.com/tags/feedback/uymgavxl9bgj2jeei1o8fluu4/post.jsp | High | Score 58/100 | First seen |
| SHA256 | 25714ca20b2ce8eecbacc59d34b2c6712fa4f1913b4dc8c8d7a0e4375aefa356 | Medium | Score 53/100 | First seen |
| SHA256 | 5df0b28276c8d9dfd185949621ea5b46952b032f88e9775db84e42ca208456f5 | Medium | Score 53/100 | First seen |
| SHA256 | 15c9f99289a8918f21d9689d8d2cc9e099cc58219a1268570764668fc0a8abff | Medium | Score 53/100 | First seen |
| SHA256 | 39a336c4066647cd02042ce72780cb5f9129bcbcca7f87177af862b5efbc47d7 | Medium | Score 53/100 | First seen |
| URL | https://lorebird.com | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…