Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
13 IOCs
From Invoice to AnyDesk: Uncovering a Phishing Campaign Targeting Russian Aerospace Organizations
Malware Families
Excerpt
Table of Contents Introduction Infection Chain Technical Analysis Conclusion Seqrite Coverage Indicators of Compromise (IOCs) MITRE ATT&CK Mapping Introduction The Seqrite Threat Research Team identified a targeted spear-phishing campaign disguised as a legitimate business invoice. The phishing email impersonates a legitimate Russian research institute associated with aerospace and aviation systems and is delivered using a spoofed domain designed to mimic the…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(1)
Victim
Attack Flow8 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →13 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | vniir-info.space | High | Score 58/100 | First seen |
| SHA256 | f57e010541fb4ccbf23aefc4a827f753a6ff3f8792d9c04c3eea83f6963c6bae | Medium | Score 53/100 | First seen |
| SHA256 | 12648cd9d425f78db2dbc6e03c14f11e6ac6aadf8b3975c23cce9519e2b58d33 | High | Score 85/100 | First seen |
| Domain | nova-stream.site | Medium | Score 56/100 | First seen |
| Domain | fgub-vniir.space | High | Score 58/100 | First seen |
| IP | 198.54.120.13 | High | Score 58/100 | First seen |
| IP | 2.23.88.201 | High | Score 58/100 | First seen |
| SHA256 | 47854deb456cb08c651b7f9ae2f9d87c72d0719de6af233340632efb3c1980f4 | Medium | Score 53/100 | First seen |
| Domain | aviatronika.online | High | Score 58/100 | First seen |
| sales@vniir-avia.space | High | Score 58/100 | First seen | |
| Domain | vniir-avia.space | High | Score 58/100 | First seen |
| IP | 194.87.57.81 | High | Score 58/100 | First seen |
| SHA256 | 0dc0fa727f900ed5033f46f8ba6cf2d97d20ab95fd334cabc0f216da6e0622b0 | High | Score 85/100 | First seen |
IOC Relationship Graph
Building graph…