Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
13 IOCs
Cato CTRL™ Threat Research: Operation Poisson – Analyzing a Cybercriminal’s Entire Operation
Malware Families
Excerpt
TL;DR Cato CTRL recently analyzed an operator’s command-and-control (C2) server’s entire 33 days operation, including the steps he took to preserve access after the takedown. 339 commands. Four French victims. Between March 30 and May 1, 2026, Cato CTRL studied every command issued by a French-speaking threat actor (“Poisson”) against one French automotive small business and four French individuals. With that insight, we can say with certainty, not as a…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →13 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | pois43.s3.eu-central-003.backblazeb2.com | High | Score 58/100 | First seen |
| Domain | wawsenti.duckdns.org | High | Score 58/100 | First seen |
| SHA256 | 1f00fd604bb18bbe3081f9ce8d741c4029d2a2125eb8888ac4e0d955938059d6 | Medium | Score 53/100 | First seen |
| Domain | sentiwaw.s3.eu-central-003.backblazeb2.com | High | Score 58/100 | First seen |
| SHA256 | 3b7642b0f84e83a36334c608655c6cb7aae774839a6a3488526b853d89830a60 | Medium | Score 53/100 | First seen |
| IP | 217.154.162.45 | High | Score 58/100 | First seen |
| SHA256 | f06e7e1a4363a01ba2a4fee2e28abdd623abf4194bda373f23ff0e151b5c2b45 | Medium | Score 53/100 | First seen |
| SHA256 | aa7ea19e34567458b4ee66a7cd274181764984bf32123f756a7fdc64d5857b31 | Medium | Score 53/100 | First seen |
| SHA256 | 0378a5ef51b008aa2d6b76bd44a0bf061339bc3b737a188ec82029444d4d18fe | Medium | Score 53/100 | First seen |
| SHA256 | c79091ceae7cd592fc08e4854cda7c1182af762b6b126371cc604debdc995fc7 | Medium | Score 53/100 | First seen |
| IP | 217.154.217.139 | High | Score 58/100 | First seen |
| Domain | w456w5.s3.eu-central-003.backblazeb2.com | High | Score 58/100 | First seen |
| SHA256 | 291cb1fd0f2709b4457447cbb87adacf5c36c1bcb0f8754524024d44174bb195 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…