Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
9 IOCs
Exploit Analysis | ShapeShift FOX Colony Authorization Trust Chain Flaw
Malware Families
Excerpt
Background In May 2026, the EtherRouterCreate3 contract deployed by the ShapeShift FOX Colony project on Arbitrum was exploited. The attacker abused the “arbitrary self-call” capability within the contract’s meta-transaction mechanism, combined with DSAuth’s automatic authorization logic for address(this), to bypass the auth modifier and replace the contract’s core routing component, resolver, with a malicious version. The attacker then used delegatecall to drain all ERC20…
Read the original report →Diamond Model
Adversary
Infrastructure
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →9 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA1 | 12d66f87a04a9e220743712ce6d9bb1b5616b8fc | Medium | Score 53/100 | First seen |
| SHA1 | 4752ba5dbc23f44d87826276bf6fd6b1c372ad24 | Medium | Score 53/100 | First seen |
| SHA1 | 835a701fd76b96a76ee84de037d41f059ee29f5c | Medium | Score 53/100 | First seen |
| SHA1 | 0b971e0a8ecc7d5b2465c903cf75aeaedbfc39e2 | Medium | Score 53/100 | First seen |
| SHA1 | 4e7f1e1e263678590007e89b7e129686ba7758d4 | Medium | Score 53/100 | First seen |
| SHA1 | eed236afb6967f74099a0a6bf078bc6b865fbf28 | Medium | Score 53/100 | First seen |
| SHA1 | 7490022b0e44aa65c030ac0d6728382a29458fc5 | Medium | Score 53/100 | First seen |
| SHA1 | 4e321af09012e15a67756522187c05b108b7ee0a | Medium | Score 53/100 | First seen |
| SHA1 | 5c59d0ec51729e40c413903be6a4612f4e2452da | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…