Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
Borrowed Trust – Systematic Exploitation of Abandoned Cloud DNS Delegations to serve Thai Gambling SEO Content
Excerpt
Executive Summary Cyble Research & Intelligence Labs (CRIL) has identified an active SEO poisoning campaign exploiting abandoned cloud DNS zone delegations to serve Thai-language gambling content under the domain authority of reputed enterprise organizations. The campaign has compromised 163 organizations across 30+ countries, spanning federal government agencies, national healthcare systems, financial institutions, critical infrastructure operators, and major…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability
Victim
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | 7df3d7cf3358af3f470ac7229387ef94 | Medium | Score 53/100 | First seen |
| SHA1 | d9799ca2f08af6992dc80c49f9889fef40ed27c7 | Medium | Score 53/100 | First seen |
| URL | https://link99.nova555.rest/register/ | High | Score 58/100 | First seen |
| MD5 | a4952b46ff9c4f6b8d5529cd21f9a1e3 | Medium | Score 53/100 | First seen |
| IP | 38.127.8.49 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…