Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
6 IOCs
Cato CTRL™ Threat Research: From Fiscal Lures to Remote Access, A Previously Undocumented NinjaOne RMM Abuse Chain
Excerpt
Executive Summary Update (June 19, 2026): We have confirmed that the NinjaOne-related artifact referenced in this report is no longer accessible. Our investigation did not identify a vulnerability or compromise in NinjaOne’s platform. The campaign relied on social engineering and abuse of NinjaOne remote-management software, consistent with a broader industry trend in which threat actors abuse commercial RMM tools. Cato CTRL researchers recently identified an undocumented,…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →6 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | sefaz.services | High | Score 61/100 | First seen |
| Domain | reclameaqui.services | High | Score 58/100 | First seen |
| Domain | lazybearpottery.net | High | Score 61/100 | First seen |
| Domain | rectalmania.com | High | Score 61/100 | First seen |
| Domain | hairdb.com | High | Score 61/100 | First seen |
| Domain | r64.org | High | Score 61/100 | First seen |
IOC Relationship Graph
Building graph…