Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
Fake Proton VPN and NordVPN Chrome Extensions Route Users Through Unrelated Proxy Network
Excerpt
A large network of fake Chrome VPN extensions impersonating trusted brands such as Proton VPN and NordVPN has been found routing users’ browser traffic through a separate SOCKS5 proxy network. Socket’s Threat Research Team identified 737 free VPN and proxy extensions linked to at least 40 Chrome Web Store developer accounts. Of these, 274 extensions impersonated 66 well-known VPN and privacy brands, including Proton VPN, NordVPN, Surfshark, ExpressVPN, Cloudflare 1.1.1.1,…
Read the original report →Diamond Model
Adversary
Infrastructure(1)
Capability
Victim
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA1 | 344dd9c28e6669ae20053f25d52828bc7bc20fc8 | Medium | Score 53/100 | First seen |
| SHA1 | 2db42e6c7d3cdd8d94aa92ed930becc640a44978 | Medium | Score 53/100 | First seen |
| Domain | skyproxy.space | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…