Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
10 IOCs
Data from Chinese Security Services Company I Soon Linked to Previous Chinese Apt Campaigns
Threat Actors
Excerpt
https://unit42.paloaltonetworks.com/i-soon-data-leaks/ Data From Chinese Security Services Company i-Soon Linked to Previous Chinese APT Campaigns By Unit 42 Published: 2024-02-24 · Archived: 2026-10-10 02:01:15 UTC Executive Summary On Feb. 16, 2024, someone uploaded data to GitHub that included possible internal company communications, sales- related materials and product manuals belonging to the Chinese IT security services company i-Soon, also known as Anxun Information…
Read the original report →Diamond Model
Adversary(5)
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →10 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 74.120.172.10 | High | Score 72/100 | First seen |
| IP | 118.31.3.116 | High | Score 70/100 | First seen |
| Domain | analyaze.s3amazonbucket.com | High | Score 74/100 | First seen |
| Domain | mailnotes.online | High | Score 72/100 | First seen |
| IP | 207.246.101.169 | High | Score 68/100 | First seen |
| Domain | unix.s3amazonbucket.com | High | Score 70/100 | First seen |
| SHA256 | db4497090a94d0189aa3c3f4fcee30d5381453ec5aa38962e2ca971074b74e8b | High | Score 67/100 | First seen |
| Domain | gmail.isooncloud.com | Medium | Score 58/100 | First seen |
| Domain | mailteso.online | High | Score 68/100 | First seen |
| Domain | s3amazonbucket.com | High | Score 70/100 | First seen |
IOC Relationship Graph
Building graph…