Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Threat Actors
Excerpt
https://github.com/cert-orangecyberdefense/cti/blob/main/runster/readme.md cti/runster/readme.md at main · cert-orangecyberdefense/cti By cert-orangecyberdefense Archived: 2026-10-16 02:03:00 UTC Update (2026-06-17): our related "Payload C" is likely tied to MetaStealer and was recently detailed by Huntress, which named it Potemkin loader. Another blog by Walmart on this new DGA is available here. Orange Cyberdefense CERT has been tracking a previously unnamed modular…
Read the original report →Diamond Model
Adversary(4)
Infrastructure(5)
Capability
Victim
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | events.msft23.com | High | Score 68/100 | First seen |
| Domain | word1-word2-word3.xyz | High | Score 67/100 | First seen |
| URL | blog.eclecticiq.com/seo-poisoning-campaign-leverages-gemini- | High | Score 67/100 | First seen |
| Domain | iocs.md | High | Score 72/100 | First seen |
| Domain | secure_prefs.zip | High | Score 67/100 | First seen |
IOC Relationship Graph
Building graph…