Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
Critical FOSSBilling SSTI Flaw Enables Information Disclosure and Remote Code Execution
Excerpt
A critical server-side template injection (SSTI) vulnerability in FOSSBilling, tracked as CVE-2026-28496, is already being actively exploited in the wild. The flaw carries a CVSS v4 score of 9.4 and affects all FOSSBilling releases through version 0.7.2; a patch is available in version 0.8.0. The vulnerability, identified as CWE-1336 (Improper Neutralization of Special Elements in a Template Engine), resides in FOSSBilling’s Twig template rendering pipeline. Critical…
Read the original report →Diamond Model
Adversary
Infrastructure(1)
Capability
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 160.30.209.77 | High | Score 58/100 | First seen |
| CVE | CVE-2026-28496 | Medium | Score 51/100 | First seen |
IOC Relationship Graph
Building graph…