Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
Compromised WordPress Site Uses Traffic Direction System to Target Windows Users With GULoader
Excerpt
A compromised WordPress website used a traffic filtering system and blockchain-hosted payload delivery to push a ClickFix lure at Windows visitors, leading to an attempted GULoader infection that was stopped by endpoint protection in less than 300300 milliseconds. The intrusion was confirmed through two sources: an ANY.RUN sandbox detonation of the infected site and real endpoint telemetry from a corporate Windows system. Together, they exposed the full attack chain, from the…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | s1.bnbchain.org | High | Score 58/100 | First seen |
| Domain | testnet.drpc.org | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…