Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
8 IOCs
From Guest Complaints to Malware: Blockchain Abuse Targets Hotels
Malware Families
Excerpt
By: Kahng An, Intelligence Team Cofense Intelligence has been tracking a series of email campaigns that target the accommodation industry with fake guest complaints or reviews that deliver blockchain technology-abusing malware. These emails appear to likely be a continuation of a prior series of predominantly Booking.com-spoofing emails that were seen delivering various remote access trojans (RAT) via ClickFix fake CAPTCHA websites. Cofense Intelligence assesses this with…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →8 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | nuypoiaklber.lol | High | Score 86/100 | First seen |
| Domain | hsaertyuoang34.sbs | High | Score 62/100 | First seen |
| Domain | njzlopghznkamkl.cfd | High | Score 86/100 | First seen |
| SHA256 | c66119f0e5635c4380441d7a79baf0c02a0ab7ea6cd78de06507fc5dc2c1a5d9 | Medium | Score 53/100 | First seen |
| Domain | fdffofofofo4.com | High | Score 71/100 | First seen |
| Domain | amanohuguta.cfd | High | Score 62/100 | First seen |
| Domain | zloapobikahy23.bond | High | Score 62/100 | First seen |
| Domain | tonajukbhuakpo2.shop | High | Score 86/100 | First seen |
IOC Relationship Graph
Building graph…