Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Excerpt
FortiMail Zero-Day Under Active Exploitation Fortinet has confirmed that CVE-2026-104286, a critical path traversal flaw in FortiMail, is being exploited in zero-day attacks, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on the same day the advisory went live. Fixed builds are not yet available for most affected branches, so the primary response right now is to apply Fortinet’s workarounds and check exposed appliances for compromise. This post answers…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability
Victim
Indicators of Compromise
Open the mindmap →10 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 79.141.169.187 | High | Score 68/100 | First seen |
| IP | 45.129.0.192 | High | Score 63/100 | First seen |
| SHA256 | 4000276a150a165d3c2537d1e19fb393c4de8333076a16655e28059cae82157b | High | Score 56/100 | First seen |
| SHA256 | 703e97c64e61e41dc3aaba580d82bb2aa7b6a11b54ee6fb467ed5d5a3bffdef5 | High | Score 56/100 | First seen |
| SHA256 | 77324ac428bde86d351fc5fc06f6d64a6bfe737dfb2743df1d4c5ac2418a5b6a | Medium | Score 52/100 | First seen |
| SHA256 | 8015f34dc84922b03688399d7f9fe7a00361789f7e420c7e2a2cdb23e75cef84 | Medium | Score 52/100 | First seen |
| CVE | CVE-2026-104286 | High | Score 66/100 | First seen |
| SHA256 | 7a6cea9f5c9e2e9994d4e3c4da73f86cf5acd05ea5d312c066c9d1dafd69ee38 | High | Score 56/100 | First seen |
| SHA256 | d6fe51c22b91776f4c961ea58bcac5917f15d560a619d7ce726d3d51795609d3 | Medium | Score 52/100 | First seen |
| SHA256 | 8953ec7960b09f544a880b072ad4e6cfda7a8303f486251d3478dcfdfbac23b6 | High | Score 56/100 | First seen |
IOC Relationship Graph
Building graph…