Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
41 IOCs
Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties
Threat Actors
Malware Families
Excerpt
Executive Summary Following disclosure of the TraderTraitor attack against LayerZero Labs in April 2026, SentinelOne identified an additional victim with the same macOS backdoors. Our analysis explores the mechanics of these backdoors and the expanded targeting against a victim in the IT services sector with no relationship to cryptocurrency trading. We also identified more weaponized GitHub repositories from the social engineering schemes used to target job seekers in these…
Read the original report →Diamond Model
Adversary(2)
Infrastructure(6)
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →41 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | registry.hashicorp-aws.com | High | Score 58/100 | First seen |
| Domain | 213-111-146-132.cprapid.com | High | Score 58/100 | First seen |
| SHA1 | c491d477dbe0ae04e9aed9dbe237144c03f73ec4 | Medium | Score 53/100 | First seen |
| SHA1 | 930e5be6d34511bedbfb0d762bd08fffe64e9630 | Medium | Score 53/100 | First seen |
| SHA1 | 4ad92bf92ee614b05c340ce17bef7b6ef5a25e82 | Medium | Score 53/100 | First seen |
| Domain | hashicorp-terraform.io | High | Score 63/100 | First seen |
| Domain | grenight.com | High | Score 58/100 | First seen |
| Domain | game.galaxy-royal.online | High | Score 58/100 | First seen |
| SHA1 | 19af09ebe8b7ad03419677dda515507dd099bc39 | Medium | Score 53/100 | First seen |
| Domain | ns4.galaxy-royal.online | High | Score 58/100 | First seen |
| Domain | www.anesthesiaschool.com | High | Score 58/100 | First seen |
| Domain | www.freehealth.lat | High | Score 58/100 | First seen |
| Domain | tinklify.com | High | Score 58/100 | First seen |
| SHA1 | 02df07a173ab03b82a4fb6a08973fff8b1467f28 | Medium | Score 53/100 | First seen |
| Domain | app.heyhay.online | High | Score 58/100 | First seen |
| Domain | hashicorp-aws.io | High | Score 58/100 | First seen |
| SHA256 | 4b2d3e8ccce8920a6d01e7d02b84236545a20e5f754b3eec253f8b416b731daa | Medium | Score 53/100 | First seen |
| IP | 45.11.59.140 | High | Score 58/100 | First seen |
| Domain | mactroubleshoots.pro | High | Score 58/100 | First seen |
| Domain | www.mactroubleshoots.pro | High | Score 58/100 | First seen |
| Domain | storage.hubpage.cloud | High | Score 58/100 | First seen |
| Domain | mx01.galaxy-royal.online | High | Score 58/100 | First seen |
| Domain | www.tinklify.com | High | Score 58/100 | First seen |
| Domain | hashicorp-aws.com | High | Score 58/100 | First seen |
| Domain | 185-66-91-112.cprapid.com | High | Score 58/100 | First seen |
| Domain | heyhay.online | High | Score 58/100 | First seen |
| IP | 176.97.114.232 | High | Score 58/100 | First seen |
| Domain | anesthesiaschool.com | High | Score 58/100 | First seen |
| Domain | galaxy-royal.online | High | Score 58/100 | First seen |
| Domain | registry.hashicorp-aws.io | High | Score 58/100 | First seen |
| MD5 | 1cd6d13ff15adbf7a42025d10ec99b4a | Medium | Score 53/100 | First seen |
| Domain | wss.sytes.net | High | Score 58/100 | First seen |
| Domain | vaimage.com | High | Score 58/100 | First seen |
| IP | 85.137.56.245 | High | Score 58/100 | First seen |
| SHA1 | 5728b11d30586bbfc1d8bd12df1c722a06e767a2 | Medium | Score 53/100 | First seen |
| Domain | update.heyhay.online | High | Score 58/100 | First seen |
| IP | 85.137.56.10 | High | Score 58/100 | First seen |
| Domain | www.heyhay.online | High | Score 58/100 | First seen |
| Domain | dela.servehttp.com | High | Score 58/100 | First seen |
| Domain | technicais.sytes.net | High | Score 58/100 | First seen |
| Domain | registry.hashicorp-terraform.io | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…