Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
1 IOC
Connecting Cryptomus, Heleket and Mirocard
Malware Families
Excerpt
by Robin Dost Anyone who has spent some time in the Russian cyberspace has surely heard of Cryptomus or Heleket. When I look at cybercriminals and gray markets, I focus primarily on their infrastructure, which also includes the cryptocurrency exchanges that facilitate these transactions. Cryptomus is the crypto payment processor that Canada’s financial intelligence unit FINTRAC fined a record CAD 176.96 million in October 2025 . In April 2026, TRM Labs assessed with high…
Read the original report →Diamond Model
Adversary
Infrastructure
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →1 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | f80fa426a89eb62bd53997326865d850 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…