Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
6 IOCs
Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit
Threat Actors
Malware Families
Excerpt
Threat Research would like to thank the Proofpoint Cloudmark Authority team for their collaboration. Key Findings On 22 July 2026, one day prior to Proofpoint’s recent joint release with the NSA on Russia-aligned threat actor TA488 (Void Blizzard, Laundry Bear), the actor began a campaign abusing CVE-2026-42897, a cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA). The campaign targeted US and European government entities, as well as…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(4)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →6 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | asecdns.com | High | Score 86/100 | First seen |
| SHA256 | 6897b649f29e54d8910459963bbf94ed5c7a4fe66a56bc5962540b226b8e48c4 | High | Score 85/100 | First seen |
| Domain | dnsrecursive.eu | Medium | Score 43/100 | First seen |
| CVE | CVE-2026-42897 | High | Score 69/100 | First seen |
| Domain | acocdn.com | High | Score 86/100 | First seen |
| Domain | tdndns.com | Medium | Score 43/100 | First seen |
IOC Relationship Graph
Building graph…