Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
26 IOCs
黑客利用 CVE-2026-26980 攻陷 Ghost CMS，大量站点沦为 ClickFix 攻击帮凶
Malware Families
Excerpt
背景介绍 2026年5月7日，XLab监测到一起针对重要客户Ghost CMS的投毒事件。攻击者利用Ghost CMS高危SQL注入漏洞CVE-2026-26980，未授权获取目标站点的Admin API Key，进而通过Ghost…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →26 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | updatefilescf.top | High | Score 81/100 | First seen |
| SHA1 | 9434fe686801742ef7d6da248fb0b900dc32208a | High | Score 56/100 | First seen |
| Domain | updatefile-cf.top | High | Score 79/100 | First seen |
| URL | https://jalwat.com/static/uploads/campaigns/6/update.zip | High | Score 63/100 | First seen |
| URL | https://com-apps.cc/NotepadPlusPlus.zip | High | Score 63/100 | First seen |
| Domain | download-file.today | High | Score 63/100 | First seen |
| URL | https://staticcloudflare.pro/api/css.js | High | Score 63/100 | First seen |
| URL | https://com-apps.cc/update.zip | High | Score 63/100 | First seen |
| MD5 | f280e12f51f996dae7fffc64a56ee527 | High | Score 56/100 | First seen |
| URL | https://cloud-verification.com/update.zip | High | Score 63/100 | First seen |
| Domain | web-telegram.ug | High | Score 72/100 | First seen |
| MD5 | fceca579efcef09eb507c6ca977ea281 | High | Score 71/100 | First seen |
| MD5 | 18a7251ddde77ed24bc54700d84d9be1 | High | Score 56/100 | First seen |
| URL | https://clo4shara.xyz/11z77u3.php | High | Score 64/100 | First seen |
| URL | https://com-apps.cc/11z77u3.php | High | Score 63/100 | First seen |
| Domain | script-dev.buzz | High | Score 86/100 | First seen |
| MD5 | ec5dfee13abf94e08d0f94e90b527db0 | High | Score 56/100 | First seen |
| MD5 | d30cc10d54ebc967c8538ff74f442eee | High | Score 80/100 | First seen |
| Domain | static-file.digital | High | Score 63/100 | First seen |
| URL | https://taketwolabs.com/wp-content/NotepadPlusPlus.dll | High | Score 63/100 | First seen |
| URL | https://cloud-verification.com | High | Score 63/100 | First seen |
| Domain | updatesecurity.pro | High | Score 81/100 | First seen |
| URL | https://script-dev.digital/api/css.js | High | Score 63/100 | First seen |
| MD5 | 5659292833ec421da11ebde005d9c9a8 | High | Score 56/100 | First seen |
| CVE | CVE-2026-26980 | High | Score 64/100 | First seen |
| Domain | script-dev.xyz | High | Score 63/100 | First seen |
IOC Relationship Graph
Building graph…