Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
117 IOCs
From Campus to C2: Tracking a Persistent Chinese Operation Against Vietnamese Universities
Threat Actors
Malware Families
Excerpt
https://ctrlaltintel.com/research/china-vietnam-campaign/ From Campus to C2: Tracking a Persistent Chinese Operation Against Vietnamese Universities By Ctrl-Alt-Intel Published: 2025-08-20 · Archived: 2026-10-09 02:01:44 UTC This personal research is based solely on open-source intelligence (OSINT) and technical analysis of available data. The attribution of activity to suspected Chinese threat actors is made on the basis of observed infrastructure, malware, and tactics,…
Read the original report →Diamond Model
Adversary(3)
Infrastructure(6)
Capability(6)
Victim
Indicators of Compromise
Open the mindmap →117 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 156.59.13.38 | High | Score 68/100 | First seen |
| MD5 | 1415c48ad7d8848191b0cd7a122a7cfb | High | Score 67/100 | First seen |
| MD5 | 6fe223ce568d919f80bea233738d0628 | High | Score 67/100 | First seen |
| Domain | e.md | High | Score 67/100 | First seen |
| SHA256 | 51c9d895c013a402d42841f52bae0bc5525b085d11ad2934f64068563a719132 | High | Score 67/100 | First seen |
| MD5 | c82698395e6a30cad74c0bc0a6cd51af | High | Score 67/100 | First seen |
| MD5 | f5de3ac3f12a2eee62a58d7ec77693dd | High | Score 67/100 | First seen |
| MD5 | 298f5096cda09151bd6b10ab605f0e7c | High | Score 67/100 | First seen |
| CVE | CVE-2023-46747 | High | Score 59/100 | First seen |
| MD5 | ceff651b3a7cbb667799510fe1d5d2c3 | High | Score 67/100 | First seen |
| URL | http://microsoft-symantec.art:8848/sl | High | Score 68/100 | First seen |
| MD5 | 351a765b352730fe5b66baaef6410cbd | High | Score 67/100 | First seen |
| IP | 221.2.22.145 | High | Score 68/100 | First seen |
| MD5 | 9e0e6f3e82a1a09228987ef496b5b9f3 | High | Score 67/100 | First seen |
| MD5 | 38ecb8e7ff4a034618082b3bb6116f90 | High | Score 67/100 | First seen |
| MD5 | 698d51a19d8a121ce581499d7b701668 | High | Score 67/100 | First seen |
| Domain | catserver.host | High | Score 67/100 | First seen |
| CVE | CVE-2023-36802 | High | Score 67/100 | First seen |
| IP | 27.210.0.131 | High | Score 68/100 | First seen |
| MD5 | a28ab9f7acdf3ced769ee44f47828504 | High | Score 67/100 | First seen |
| MD5 | 78b1fa873aabd54c1d73e2f7cd664a31 | High | Score 67/100 | First seen |
| URL | https://ctrlaltintel.com/research/china-vietnam-campaign/ | High | Score 67/100 | First seen |
| Domain | sqlmap.py | High | Score 67/100 | First seen |
| URL | http://103.215.77.214:8080/3.asmx | High | Score 68/100 | First seen |
| MD5 | fd6d0f45fab383257462a2b91fb7b169 | High | Score 67/100 | First seen |
| Domain | microsoft-defend.club | High | Score 68/100 | First seen |
| IP | 74.125.196.113 | High | Score 68/100 | First seen |
| MD5 | fc48ee15a4d16cee6cac9805cf8d0ec4 | High | Score 67/100 | First seen |
| IP | 27.150.112.38 | High | Score 68/100 | First seen |
| MD5 | 2058842e1799195a2f3c9971e4dea24e | High | Score 67/100 | First seen |
| MD5 | a11a1d761d757d367146f0f772632d8c | High | Score 67/100 | First seen |
| SHA256 | f34bd1d485de437fe18360d1e850c3fd64415e49d691e610711d8d232071a0b1 | High | Score 85/100 | First seen |
| MD5 | ea5705041c355cc87c4aaedca6203840 | High | Score 67/100 | First seen |
| URL | symantec.art:8848/slt | High | Score 67/100 | First seen |
| Domain | microsoft-symantec.art | High | Score 68/100 | First seen |
| MD5 | ae3e7304122469f2de3ecbd920a768d1 | High | Score 67/100 | First seen |
| MD5 | c1b11a39ef693fa6bf1bb3282fafb640 | High | Score 67/100 | First seen |
| MD5 | a65b99553494cd178c72b2bc7ae44554 | High | Score 67/100 | First seen |
| IP | 103.56.52.61 | High | Score 68/100 | First seen |
| IP | 27.219.79.226 | High | Score 68/100 | First seen |
| MD5 | 0659f21cb8422c830af696a947eeff6c | High | Score 67/100 | First seen |
| MD5 | 75341ae79be66b2e09d578fcd6fa8441 | High | Score 67/100 | First seen |
| Domain | gost.x64.so | High | Score 67/100 | First seen |
| URL | http://microsoft-symantec.art:8848/swt | High | Score 68/100 | First seen |
| MD5 | 29efd64dd3c7fe1e2b022b7ad73a1ba5 | High | Score 88/100 | First seen |
| MD5 | abcf9d28603eee7630ed93ef9f729888 | High | Score 67/100 | First seen |
| MD5 | f87afacff9c44b94db109e3e956a4b33 | High | Score 67/100 | First seen |
| MD5 | 6ba0dbcd2db8f44243799c891dbd2a59 | High | Score 67/100 | First seen |
| MD5 | cbdc6e33deb4daac12bdce086165c8f1 | High | Score 67/100 | First seen |
| MD5 | eb80f7bddb699784baa9fbf2941eaf4a | High | Score 86/100 | First seen |
| MD5 | ab59a40273401b69d019877be0190fce | High | Score 67/100 | First seen |
| IP | 38.181.79.15 | High | Score 68/100 | First seen |
| MD5 | 0aa8a3cd0ac247d5eeca2661e88f71b7 | High | Score 67/100 | First seen |
| IP | 27.150.113.1 | High | Score 68/100 | First seen |
| Domain | cfcert.store | High | Score 67/100 | First seen |
| IP | 27.150.114.115 | High | Score 68/100 | First seen |
| IP | 123.132.37.188 | High | Score 68/100 | First seen |
| Domain | edu.vn | High | Score 67/100 | First seen |
| MD5 | 7d372351d7629ab7bf694812d03674c5 | High | Score 67/100 | First seen |
| MD5 | bed7058beeeefc3efeb8b408ec68e5fa | High | Score 67/100 | First seen |
| CVE | CVE-2017-0213 | High | Score 64/100 | First seen |
| MD5 | 140a0f81a7b1e76efa914dd688edc5e5 | High | Score 67/100 | First seen |
| MD5 | 0d4ee255c91405a9f270c94862ea1361 | High | Score 67/100 | First seen |
| CVE | CVE-2022-39197 | High | Score 67/100 | First seen |
| SHA256 | 44cc5d20ba8b692fd10d358aab5694c21caf1c63e7a1ecb0f989010b7dfa830a | High | Score 67/100 | First seen |
| Domain | id_rsa.pub | High | Score 67/100 | First seen |
| CVE | CVE-2023-28252 | High | Score 60/100 | First seen |
| MD5 | e06aacd6139288d5bea4a676ee0c2404 | High | Score 86/100 | First seen |
| MD5 | 895d4e39649399d7e7010510ae17750b | High | Score 67/100 | First seen |
| MD5 | 1643a53dc2a0117e0a66612bb3f341fe | High | Score 67/100 | First seen |
| MD5 | 61cd12c70e9b6125a8d8b5784bdefc4b | High | Score 67/100 | First seen |
| SHA256 | 61c0810a23580cf492a6ba4f7654566108331e7a4134c968c2d6a05261b2d8a1 | High | Score 88/100 | First seen |
| URL | http://microsoft-symantec.art:8848/?h=microsoft-symantec.art&p=8848&t=tcp&a=w64&stage=true | High | Score 68/100 | First seen |
| Domain | encoding.default.ge | High | Score 67/100 | First seen |
| MD5 | 69f40aa49b4ac18700c3499f167bd845 | High | Score 67/100 | First seen |
| IP | 119.165.225.129 | High | Score 68/100 | First seen |
| MD5 | 9b0e4652a0317e6e4da66f29a74b5ad7 | High | Score 67/100 | First seen |
| MD5 | 650be782605daa164ad7d1f971ef76a3 | High | Score 67/100 | First seen |
| MD5 | 723d364d402760641ec172e27e9b6a56 | High | Score 67/100 | First seen |
| URL | http://microsoft-symantec.art:8848/slt | High | Score 68/100 | First seen |
| CVE | CVE-2018-8120 | High | Score 67/100 | First seen |
| MD5 | 5982a720a2f0834e5d04ea4ad49900dd | High | Score 67/100 | First seen |
| URL | http://microsoft-symantec.art:8848/?h=microsoft-symantec.art&p=8848&t=tcp&a=w32&stage=true | High | Score 68/100 | First seen |
| CVE | CVE-2024-30088 | High | Score 67/100 | First seen |
| MD5 | 4facb81f57e515a508040270849bcd35 | High | Score 67/100 | First seen |
| CVE | CVE-2022-24521 | High | Score 67/100 | First seen |
| MD5 | 64aa88125366a1787919b5ec61befa1d | High | Score 67/100 | First seen |
| MD5 | 809f3a686c379e3567db71585b169d4d | High | Score 67/100 | First seen |
| IP | 27.199.77.113 | High | Score 68/100 | First seen |
| MD5 | 875cd28cf7b4fa7abd0d4e079a13bf26 | High | Score 67/100 | First seen |
| URL | http://victm.edu.vn/3.asmx/Tas9er | High | Score 68/100 | First seen |
| MD5 | a39696e95a34a017be1435db7ff139d5 | High | Score 67/100 | First seen |
| CVE | CVE-2019-18935 | High | Score 61/100 | First seen |
| MD5 | 8bc54a3ae402e1c3e158010169e97c38 | High | Score 67/100 | First seen |
| CVE | CVE-2020-0796 | High | Score 67/100 | First seen |
| SHA256 | bf7120a63483a2e4300a4d1405ac7525f11dd1f6d6a7120767bc42566da35891 | High | Score 67/100 | First seen |
| IP | 103.56.52.142 | High | Score 68/100 | First seen |
| IP | 148.66.16.226 | High | Score 68/100 | First seen |
| MD5 | bb7326689f40a1190676770dd59a3ca9 | High | Score 67/100 | First seen |
| URL | edu.vn:80/ | High | Score 67/100 | First seen |
| MD5 | ec76edde147207156f6de31f6ecc5bef | High | Score 67/100 | First seen |
| IP | 27.150.113.183 | High | Score 68/100 | First seen |
| MD5 | 5d882e918248790794a07cabe72cf2b1 | High | Score 67/100 | First seen |
| Domain | catserver.properties | High | Score 67/100 | First seen |
| MD5 | f91cc2b904a778d77da1ca2f0772c1b1 | High | Score 67/100 | First seen |
| URL | http://baidu.com | High | Score 67/100 | First seen |
| MD5 | 3fed1004befb9834b699a88ccdce757e | High | Score 67/100 | First seen |
| IP | 27.210.226.254 | High | Score 68/100 | First seen |
| Domain | catserver.store | High | Score 67/100 | First seen |
| IP | 39.85.164.6 | High | Score 68/100 | First seen |
| IP | 103.215.77.214 | High | Score 68/100 | First seen |
| MD5 | 3388b033f6a92e22f47f094b3c38df4f | High | Score 67/100 | First seen |
| MD5 | 40b96d9df310d5f448c0908c3231ff4e | High | Score 67/100 | First seen |
| Domain | micrcs.microsoft-defend.club | High | Score 68/100 | First seen |
| MD5 | 0b2e3a199df127abba4e1f468d674cbe | High | Score 67/100 | First seen |
| MD5 | 5c106ea9a277b8489be3059750c3f6ec | High | Score 67/100 | First seen |
| MD5 | 131e9c99a7be59afb2f8763e07963c69 | High | Score 67/100 | First seen |
IOC Relationship Graph
Building graph…