Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
115 IOCs
Cloud Atlas activity in the second half of 2025 and early 2026: new tools and a new payload
Malware Families
Excerpt
In 2025, we observed pervasive SSH tunnel activity, which has remained active into 2026, affecting many government organizations and commercial companies in Russia and Belarus. Behind some of this activity is Cloud Atlas, a group we have known since 2014 . During our investigation, we identified new tools used by this group, as well as indicators of compromise. The group is back to sending out archives containing malicious shortcuts that launch PowerShell scripts. This…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →115 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | 25c8ed0511375dca57ef136ac3fa0cca | Medium | Score 53/100 | First seen |
| Domain | investika-club.com | High | Score 58/100 | First seen |
| IP | 81.30.105.71 | High | Score 58/100 | First seen |
| MD5 | 1a11b26dd0261ef27a112ce8b361c247 | Medium | Score 53/100 | First seen |
| MD5 | 9eaae9491f6a50d6df0be393734a44cb | Medium | Score 53/100 | First seen |
| MD5 | eba3bcdb19a7e256bf8e2cc5b9c1cca9 | Medium | Score 53/100 | First seen |
| Domain | tenkoff.org | High | Score 58/100 | First seen |
| MD5 | 867b634588c0fd6b26684d502c15ab03 | Medium | Score 53/100 | First seen |
| Domain | fishingflytackle.com | High | Score 58/100 | First seen |
| MD5 | 493b901d1b33eb577db64aadd948f9ce | Medium | Score 53/100 | First seen |
| Domain | landscapeuganda.com | High | Score 58/100 | First seen |
| IP | 195.58.49.9 | High | Score 58/100 | First seen |
| MD5 | 5329f7bff9d0d5db28821b86c26d628f | Medium | Score 53/100 | First seen |
| Domain | internationalcommoditiesllc.com | High | Score 58/100 | First seen |
| MD5 | 8158552950d2e13b075001ce0c52aa97 | Medium | Score 53/100 | First seen |
| Domain | kufar.org | High | Score 58/100 | First seen |
| MD5 | 1d401d6e6fc0b00aaa2c65a0ac0cfd6b | Medium | Score 53/100 | First seen |
| MD5 | b6aae073e7bfebf4d643c2bbeb5c02e1 | Medium | Score 53/100 | First seen |
| MD5 | 36120f5e9411bcbac7104ef3fa964ed2 | Medium | Score 53/100 | First seen |
| MD5 | f56b31a4b47ad3365b18a7e922fba1a8 | Medium | Score 53/100 | First seen |
| CVE | CVE-2018-0802 | Medium | Score 53/100 | First seen |
| MD5 | 2b4ba4facf8c299749771a3a4369782e | Medium | Score 53/100 | First seen |
| MD5 | 50568b1f9335a7e3ba4e5df035a8fb86 | Medium | Score 53/100 | First seen |
| MD5 | 5000a353399500bc78381dc95b6ed2dc | Medium | Score 53/100 | First seen |
| MD5 | 7242ac065b50bcde9308756b49dbadcb | Medium | Score 53/100 | First seen |
| IP | 46.17.45.49 | High | Score 58/100 | First seen |
| MD5 | 116f59e70a9df97f4adaea71eecb1e9a | Medium | Score 53/100 | First seen |
| MD5 | 344ca9ea07cd4ac90ef27f8890d4ec05 | Medium | Score 53/100 | First seen |
| Domain | goverru.com | High | Score 58/100 | First seen |
| MD5 | fb0f8027acf1b1e47e07a63d8812ed50 | Medium | Score 53/100 | First seen |
| MD5 | bc3739dec8cd8f54f3f60a85f3ed600e | Medium | Score 53/100 | First seen |
| MD5 | 1b39e86eb772a0e40060b672b7f574f1 | Medium | Score 53/100 | First seen |
| MD5 | 7a95360b7e0eb5b107a3d231abbc541a | Medium | Score 53/100 | First seen |
| Domain | allgoodsdirect.com.au | High | Score 58/100 | First seen |
| Domain | cloudguide.in | High | Score 58/100 | First seen |
| Domain | bigbang.me | High | Score 58/100 | First seen |
| MD5 | 67d7e3aeeb673bf60c59361c12a4ed81 | Medium | Score 53/100 | First seen |
| IP | 185.250.181.207 | High | Score 58/100 | First seen |
| IP | 45.87.219.116 | High | Score 58/100 | First seen |
| MD5 | 28ecf8fb6719e14231b94b4d37629b0e | Medium | Score 53/100 | First seen |
| MD5 | f9c3bbe108566d1a6b070f9c5fb03160 | Medium | Score 53/100 | First seen |
| MD5 | 40a562b8600f843b717bc5951b2e3c29 | Medium | Score 53/100 | First seen |
| IP | 185.22.154.73 | High | Score 58/100 | First seen |
| Domain | istochnik.org | High | Score 58/100 | First seen |
| Domain | alnakhlah.com.sa | High | Score 58/100 | First seen |
| MD5 | f721a76deb28fd0b80d27fce6b8f5016 | Medium | Score 53/100 | First seen |
| Domain | onedrivesupport.net | High | Score 58/100 | First seen |
| MD5 | ba9ce06641067742f2afc9691faff1dc | Medium | Score 53/100 | First seen |
| Domain | firsai.tipshub.net | High | Score 58/100 | First seen |
| MD5 | 63b6be9ae8d8024a40b200cccb438f1d | Medium | Score 53/100 | First seen |
| MD5 | 69121c36eb8bf77962dca825fcffd873 | Medium | Score 53/100 | First seen |
| MD5 | 83edde9f7eeefac0363413972f35572b | Medium | Score 53/100 | First seen |
| MD5 | 38fa4306fa4406ba31cf171af4d36e34 | Medium | Score 53/100 | First seen |
| MD5 | 0577db70844e88b32b954906e2f20798 | Medium | Score 53/100 | First seen |
| MD5 | 369b75bdcded16469ede7ab8bedcfae1 | Medium | Score 53/100 | First seen |
| IP | 194.102.104.207 | High | Score 58/100 | First seen |
| MD5 | 2042eb5d52f0b535a1ce6b6f954c8c2b | Medium | Score 53/100 | First seen |
| MD5 | 0320dd389fdbab25d46792bd2817675e | Medium | Score 53/100 | First seen |
| IP | 185.53.179.136 | High | Score 86/100 | First seen |
| MD5 | b4e183627b7399006c1bc47b3711e419 | Medium | Score 53/100 | First seen |
| MD5 | 5339d1a666f3e40fe756505cf1d87d4b | Medium | Score 53/100 | First seen |
| Domain | totallegacy.org | High | Score 58/100 | First seen |
| MD5 | bbf1fa694122e07635deeac11ad712f8 | Medium | Score 53/100 | First seen |
| MD5 | ec076cd21c483a40156f4e40d08daded | Medium | Score 53/100 | First seen |
| MD5 | 0c514e137860f489e3801213460ef938 | Medium | Score 53/100 | First seen |
| MD5 | 9bd788f285e32a05e6591d1eb36ebffc | Medium | Score 53/100 | First seen |
| Domain | znews.net | High | Score 58/100 | First seen |
| Domain | wizzifi.com | High | Score 58/100 | First seen |
| IP | 194.87.196.163 | High | Score 58/100 | First seen |
| Domain | lafortunaitalian.co.uk | High | Score 58/100 | First seen |
| MD5 | 3c75cedb1196df5eab91f31411ed4b33 | Medium | Score 53/100 | First seen |
| MD5 | d5b38b252cf212a4a32763de36732d40 | Medium | Score 53/100 | First seen |
| Domain | humanitas.si | High | Score 58/100 | First seen |
| MD5 | a75dbed984963b9ab21309c5b2f8fd9b | Medium | Score 53/100 | First seen |
| MD5 | c0d1eaa15a2cefbab9735787575c8d8e | Medium | Score 53/100 | First seen |
| Domain | agenciakharis.com.br | High | Score 58/100 | First seen |
| MD5 | 2aa1e9765ef6b00b94a9b6be0041436a | Medium | Score 53/100 | First seen |
| MD5 | 6aa586bcc45ca2e92a4f0ef47e086fa1 | Medium | Score 53/100 | First seen |
| MD5 | d3c8afd22baa306ff659db1fac28574a | Medium | Score 53/100 | First seen |
| MD5 | c5702eb250f855c8c872fffb9bb656ed | Medium | Score 53/100 | First seen |
| Domain | mamurjor.com | High | Score 58/100 | First seen |
| MD5 | f6f62456fb0fcc396fb654cbed339bc3 | Medium | Score 53/100 | First seen |
| IP | 37.228.129.224 | High | Score 58/100 | First seen |
| Domain | amerikastaj.com | High | Score 58/100 | First seen |
| Domain | spbnews.net | High | Score 58/100 | First seen |
| MD5 | 42ac350bfbc5b4eb0fedba16c81919c7 | Medium | Score 53/100 | First seen |
| MD5 | 6d7b2d1172bbdb7340972d844f6f0717 | Medium | Score 53/100 | First seen |
| IP | 146.70.53.171 | High | Score 58/100 | First seen |
| MD5 | 097ca205ad9e3b72018750280904718c | Medium | Score 53/100 | First seen |
| IP | 46.17.44.212 | High | Score 58/100 | First seen |
| IP | 5.181.21.75 | High | Score 58/100 | First seen |
| MD5 | 0857c84b62289a1a9f29e19244e9a499 | Medium | Score 53/100 | First seen |
| MD5 | 9769f43b9de8d19e803263267fa6d62e | Medium | Score 53/100 | First seen |
| MD5 | ed34f5a136fba4fdea976570faa33ed7 | Medium | Score 53/100 | First seen |
| MD5 | a632858f14b36f03d0f213f5f5d6bff2 | Medium | Score 53/100 | First seen |
| Domain | ultimatecore.net | High | Score 58/100 | First seen |
| MD5 | 579a9952d31cad801a3988dbe7914ce7 | Medium | Score 53/100 | First seen |
| IP | 185.126.239.77 | High | Score 58/100 | First seen |
| IP | 45.15.65.134 | High | Score 58/100 | First seen |
| MD5 | 216cb7f31d383c0dd892b284df05a495 | Medium | Score 53/100 | First seen |
| MD5 | f301aa3d62b5095eec4d8e34201a4769 | Medium | Score 53/100 | First seen |
| IP | 46.17.44.125 | High | Score 58/100 | First seen |
| MD5 | f42085522ec2ebb16edcf814e7c330ad | Medium | Score 53/100 | First seen |
| MD5 | 3e6e9df00a764b348ec611ee8504aca0 | Medium | Score 53/100 | First seen |
| MD5 | cc751619bfec0dc4607c17112b9e3b2c | Medium | Score 53/100 | First seen |
| MD5 | 89572f0ed20791a5ac9fc4267d67ccb0 | Medium | Score 53/100 | First seen |
| Domain | kommando.live | High | Score 58/100 | First seen |
| IP | 46.17.45.56 | High | Score 58/100 | First seen |
| IP | 93.125.114.193 | High | Score 58/100 | First seen |
| MD5 | 7f776ad200287d6de14a29158c457179 | Medium | Score 53/100 | First seen |
| Domain | paleturquoise-dragonfly-364512.hostingersite.com | High | Score 58/100 | First seen |
| IP | 93.125.114.57 | High | Score 58/100 | First seen |
| MD5 | 51f7f794ed43fb90d0f8ebbb5effe628 | Medium | Score 53/100 | First seen |
| MD5 | b8c753dd254509fba5077ffd5067eab0 | Medium | Score 53/100 | First seen |
| MD5 | 2cabb721681455dae1b6a26709def453 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…