Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
113 IOCs
CSuite Targets US and EU Organizations with Device-Code Phishing and Remote Access
Malware Families
Excerpt
ANY.RUN researchers investigated CSuite , a phishing and remote-access operation that combines credential theft, Microsoft 365 session hijacking, and the abuse of legitimate management tools. The campaign showed a strong US focus, with 60% of identified victim organizations based in the United States . By blending trusted business services with legitimate remote-access software, CSuite can give attackers both account and endpoint access while making malicious activity harder…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →113 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | c5f7083722fc5bee4e7a7109495348d3731e6b077919a6b679b9f5af885923cd | Medium | Score 53/100 | First seen |
| Domain | sharerpoint.cam | High | Score 58/100 | First seen |
| SHA256 | 463786717f51b710dbbb013437141e416b98d810dfaa9f4de90a4c4939bc66b9 | Medium | Score 53/100 | First seen |
| SHA256 | 394d7be5ecbe326062c1de1fb674bdcbb4dbe3ce03b4227994607047b832debd | Medium | Score 53/100 | First seen |
| Domain | usoffweb69.top | High | Score 58/100 | First seen |
| IP | 102.88.167.38 | High | Score 58/100 | First seen |
| SHA256 | 74e306072561731adf55afd4de461ec0736ca22c0b458a78e7512b2701341f28 | Medium | Score 53/100 | First seen |
| Domain | corporate-sync-gate.net | High | Score 58/100 | First seen |
| IP | 31.57.38.60 | High | Score 58/100 | First seen |
| Domain | netcoxweb.top | High | Score 58/100 | First seen |
| Domain | docusign.web-viewww.es | High | Score 58/100 | First seen |
| Domain | asambitiousaboutautismorguk.com | High | Score 58/100 | First seen |
| Domain | documentationreviewdocument2026review.sbs | High | Score 58/100 | First seen |
| Domain | mail.boratlongyear.com | High | Score 58/100 | First seen |
| Domain | documentensono.sbs | High | Score 58/100 | First seen |
| Domain | shared.file.cnrv.tech | High | Score 58/100 | First seen |
| Domain | pdfsecurtoviewothers.cfd | High | Score 58/100 | First seen |
| SHA256 | ae7af8159f06a059411411e5e816b415e32213371fb085ced1dc5679a0112c48 | Medium | Score 53/100 | First seen |
| Domain | sqrd.m36s.sharedfile.tech | High | Score 58/100 | First seen |
| Domain | escrowadmin.com.au | High | Score 58/100 | First seen |
| Domain | mail.wirsann.com | High | Score 58/100 | First seen |
| Domain | docseedn.online | High | Score 58/100 | First seen |
| SHA256 | 07682ca34a9bf18beb664088e55035a83306b95b31d4aaba242e9d67f8c378a3 | Medium | Score 53/100 | First seen |
| Domain | coxnetwork.top | High | Score 58/100 | First seen |
| Domain | conferenceuniverses.buzz | High | Score 58/100 | First seen |
| Domain | pdfsecurtoview365.cfd | High | Score 58/100 | First seen |
| Domain | instance-t7o41i-relay.screenconnect.com | High | Score 58/100 | First seen |
| Domain | pdfsecurtoview365.sbs | High | Score 58/100 | First seen |
| Domain | doc.lauraice.xyz | High | Score 58/100 | First seen |
| Domain | expressdocumentdelivery.org | High | Score 58/100 | First seen |
| SHA256 | 6f62a8380eb5038e253772033c0ebc1ddb951a042c4a1a90ba8755819dc74e53 | Medium | Score 53/100 | First seen |
| SHA256 | fd98c6881cadc47e7d425bbd4b992237a832e69fdfe872a90ba567ed58a148ad | Medium | Score 53/100 | First seen |
| Domain | docseed.online | High | Score 58/100 | First seen |
| SHA256 | 2b89225801591cd223e0cf0b1faa8e7b12e88d6b6bc6ec9f5e715171137553ac | Medium | Score 53/100 | First seen |
| SHA256 | d995ea6f1621c29cdd4353cfb8b36cd1336b34bc8b180b73ce52cd939060bf0f | Medium | Score 53/100 | First seen |
| Domain | onmaillive.sbs | High | Score 58/100 | First seen |
| IP | 190.123.46.122 | High | Score 58/100 | First seen |
| Domain | selectivelife03.sbs | High | Score 58/100 | First seen |
| IP | 64.204.180.203 | High | Score 58/100 | First seen |
| IP | 102.67.5.132 | High | Score 58/100 | First seen |
| SHA256 | 842f0236ea2c2b7773054920e7a870e07869c4e99f84bd31ccfd215781b4f267 | Medium | Score 53/100 | First seen |
| IP | 31.57.147.133 | High | Score 58/100 | First seen |
| SHA256 | 7b03111fa24ce01054332f013b3fe8189d2b61897e7306666c73b086588a64a5 | Medium | Score 53/100 | First seen |
| IP | 212.189.40.73 | High | Score 58/100 | First seen |
| SHA256 | aac51e4016c50a705a26bd56435f0fd9685e53d6bc0cc6034b7370e76d7cb376 | Medium | Score 53/100 | First seen |
| IP | 207.189.19.40 | High | Score 58/100 | First seen |
| SHA256 | aefd71902453cc83104aa963d8d9051c875d93ddf40680616e8fa5e68565ea69 | Medium | Score 53/100 | First seen |
| Domain | pdfsecurtoview.info | High | Score 58/100 | First seen |
| SHA256 | b1e55c9679f9aca94d66fdb08195cf8752f69f1d6896a5b2e60d979fca5a4036 | Medium | Score 53/100 | First seen |
| Domain | file.shared.myscript.sbs | High | Score 58/100 | First seen |
| IP | 141.133.174.208 | High | Score 58/100 | First seen |
| Domain | maillive.sbs | High | Score 58/100 | First seen |
| Domain | gddfzxa.online | High | Score 58/100 | First seen |
| Domain | qrcoderuser.cfd | High | Score 58/100 | First seen |
| Domain | shared.file.nn365.cloud | High | Score 58/100 | First seen |
| Domain | shared.note.nn365.cloud | High | Score 58/100 | First seen |
| Domain | pikecac.cfd | High | Score 58/100 | First seen |
| Domain | zerichoproject.org | High | Score 58/100 | First seen |
| Domain | allshore-io.cam | High | Score 58/100 | First seen |
| SHA256 | 375e49680fe4b4a62320bdcfd16b7bd75f6223a15d620c475c6988803b67d416 | Medium | Score 53/100 | First seen |
| SHA256 | eb9274a1fb6064e784f9c0ce95c78007efcadc279d4ffcac13998a45ebf7b49f | Medium | Score 53/100 | First seen |
| Domain | downloaddocumentcontechbuilding.sbs | High | Score 58/100 | First seen |
| Domain | documentsonitustechnologies.sbs | High | Score 58/100 | First seen |
| Domain | loq.file.cnrv.online | High | Score 58/100 | First seen |
| SHA256 | a89a31ec605c0ed9cd263cbdea6ee4a2c6502ec81e5b3e8a3c9fb3de945405f9 | Medium | Score 53/100 | First seen |
| Domain | sqrd.m365.sharedfile.online | High | Score 58/100 | First seen |
| Domain | solarengyloanfunds.com | High | Score 58/100 | First seen |
| Domain | docsendsr.online | High | Score 58/100 | First seen |
| SHA256 | b59e7cb539c0b81a58f60d5ca0ed3df62d1856b29076720efbb7dd9411d99eec | Medium | Score 53/100 | First seen |
| SHA256 | e769b2b4463e7d39320b65a49183ce4ff8c20459fa183e7b03f02e1b44420eb0 | Medium | Score 53/100 | First seen |
| Domain | mmswerod.sbs | High | Score 58/100 | First seen |
| Domain | aviationpioneers.info | High | Score 58/100 | First seen |
| SHA256 | 41734f8e6cc75b66f51638b76780f61a0b21ad9f77586e2665b7ab8d7e131936 | Medium | Score 53/100 | First seen |
| SHA256 | 3a8daf4e992ea34b71b259af85d4d12ca52d80b9e2b262bd5aa5922a5a955f9f | Medium | Score 53/100 | First seen |
| Domain | emsafetoproceedtaward.top | High | Score 58/100 | First seen |
| Domain | greaterheights.sbs | High | Score 58/100 | First seen |
| Domain | pdfsecurtoview.cfd | High | Score 58/100 | First seen |
| Domain | legacy-bridge-node.net | High | Score 58/100 | First seen |
| Domain | ambitiousaboutautismorguk.com | High | Score 86/100 | First seen |
| SHA256 | 9a03a0b65b2a2d27b348e583237d512a55f3f8287989abf7ffca0285d5f8e43d | Medium | Score 53/100 | First seen |
| Domain | file.shared.cnrv.tech | High | Score 58/100 | First seen |
| Domain | arubanetworks-inc.com | High | Score 58/100 | First seen |
| SHA256 | c0eb04dcfa745653c466c34978a1f3b4e5041f526be8c2e46b8c722498ca746a | Medium | Score 53/100 | First seen |
| Domain | pdfsecurtoviewothers.sbs | High | Score 58/100 | First seen |
| Domain | checkingweb.net | High | Score 58/100 | First seen |
| IP | 191.101.130.42 | High | Score 58/100 | First seen |
| Domain | giiro.net | High | Score 58/100 | First seen |
| SHA256 | fdd171cc26704218b0762a33650c0d1246c42cbe583a858684e1b6ac12b9bbe7 | Medium | Score 53/100 | First seen |
| SHA256 | 90f8e6259ce27592c460d235aff104d7507dfff4e7889c34ab714cdb19944473 | Medium | Score 53/100 | First seen |
| Domain | sharepointer-dr.com | High | Score 58/100 | First seen |
| IP | 185.174.102.34 | High | Score 58/100 | First seen |
| Domain | m36nx.file.cnrv.online | High | Score 58/100 | First seen |
| Domain | file.shared.m36s.site | High | Score 58/100 | First seen |
| Domain | ghs.coorpes.com | High | Score 58/100 | First seen |
| IP | 91.92.41.114 | High | Score 58/100 | First seen |
| Domain | fincapitalxcom.cfd | High | Score 58/100 | First seen |
| Domain | pdfsecurtoview.sbs | High | Score 58/100 | First seen |
| URL | https://localcontex.online/review.signal-doc.cloud/.DocuSign/ | High | Score 58/100 | First seen |
| Domain | andsolarengyloanfunds.com | High | Score 58/100 | First seen |
| IP | 188.127.227.18 | High | Score 58/100 | First seen |
| Domain | selectivelife01.sbs | High | Score 58/100 | First seen |
| Domain | cellumbio.com | High | Score 58/100 | First seen |
| SHA256 | 0d6b451bd58b904e7dd15ce3e28ea129f7f95c9d248944fbdacdf6fb1d2adc99 | Medium | Score 53/100 | First seen |
| SHA256 | a450a84a60ce6646596feb2d6bea4c89a1b5b4e7d6325d5b7c2000982987411c | Medium | Score 53/100 | First seen |
| Domain | stubborn-academy.icu | High | Score 58/100 | First seen |
| SHA256 | 38ba6bfe0cc2b7c5ff38f1f698e2c9bfdb52dd7937111967fddf785ba001e1f2 | Medium | Score 53/100 | First seen |
| Domain | docuread.im | High | Score 58/100 | First seen |
| URL | https://localcontex.online/AdobecloudReader/pdf_Reader_en_install.msi | High | Score 58/100 | First seen |
| Domain | voicermailsmessager.cam | High | Score 58/100 | First seen |
| Domain | keepsecurepasserword.cam | High | Score 58/100 | First seen |
| Domain | greenbullet.ba | High | Score 58/100 | First seen |
| Domain | pdfsecurtoviewsuite.sbs | High | Score 58/100 | First seen |
| IP | 155.254.26.180 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…