Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
24 IOCs
GhostShell (MB-0009): Targeting Ukraine’s UAV Operations and Defense Supply Chain
Threat Actors
Malware Families
Excerpt
by Robin Dost Today, we are taking a look at malware linked to yet another threat actor, one that has been active since at least February 2026. Since I could not associate the malware with any previously attributed threat actor, I am naming the actor GhostShell (you’ll find out why later in this article) and assigning it the Malwarebox identifier MB-0009 . The corresponding file has the following SHA-256 hash: 28f58061348a1c54fa6e7ff6618630259618d4afdf78514d5fccfc993797cdff…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(4)
Capability(3)
Victim
Indicators of Compromise
Open the mindmap →24 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 423c98b9a8ad09bbb0aa24e86c23095ef6a26e30b3db07358927929d2fb2ecb3 | Medium | Score 53/100 | First seen |
| URL | https://cloudaxis.cc/gsmft/yueu/fkvqld/tvqqwh/ushu/122.exe | High | Score 58/100 | First seen |
| SHA256 | e4d377b339f96c69c3001b854b22decae41883bd31f2f5a8c20f57d931ae0b44 | Medium | Score 53/100 | First seen |
| SHA256 | c83272741d42a7aa738fbad85e21d0565e50cbf3b72f32b835c225965b3cc207 | High | Score 86/100 | First seen |
| SHA1 | 11145a2322aa5595d27e25cc977ad1b53ce88dcd | Medium | Score 53/100 | First seen |
| SHA256 | cff6007dbb9826d0a08865f47a71b31e90c5067c637ac863e360315da984f107 | Medium | Score 53/100 | First seen |
| CVE | CVE-2025-8088 | High | Score 72/100 | First seen |
| SHA256 | ab5681266f70af7df24383f15de876e411fc18e35cb6f24603b12f580b05ccb3 | High | Score 86/100 | First seen |
| SHA256 | a8dfa5a35f30c1789ce08b7e16660423bb1545fc8ec7411d24cfd41d1439bb45 | Medium | Score 53/100 | First seen |
| SHA256 | 8de34006dafd990853a45cbe9aaab4ee18c8cd4c1ad0a98fe71f8d63cd60db25 | High | Score 86/100 | First seen |
| SHA256 | c91874dc34e991e614060d6f16da7d4680e5eb7d36fba489644863f4c6c8cf66 | Medium | Score 53/100 | First seen |
| SHA256 | 59842745dafd1537c3e2187f82fae7791e646a74251fe20d6c8ebaadf5720880 | Medium | Score 53/100 | First seen |
| SHA256 | a938b7291dbdcdcadb67d560b94bfee366e7f97f06d6f666b25e298c442d8542 | Medium | Score 53/100 | First seen |
| CVE | CVE-2025-6218 | High | Score 64/100 | First seen |
| SHA256 | b1834634820ae696f0514ca2b6723061f115857232306e573f4d115bc6ead012 | High | Score 86/100 | First seen |
| Domain | cdnexpress.cc | High | Score 58/100 | First seen |
| IP | 86.54.25.2 | High | Score 58/100 | First seen |
| URL | https://cloudaxis.cc/gsmft/yueu/fkvqld/tvqqwh/ushu/update.exe | High | Score 58/100 | First seen |
| SHA256 | 3ec6c91d68b416381ac9f6310a9e011f4060369c63416021864a6d5b91e97dc4 | Medium | Score 53/100 | First seen |
| SHA256 | 28f58061348a1c54fa6e7ff6618630259618d4afdf78514d5fccfc993797cdff | High | Score 86/100 | First seen |
| SHA256 | 54218a8f2d1acc5d1beb576b970bb5333a4b78b05493754d2d1457ebf22a0ac1 | Medium | Score 53/100 | First seen |
| MD5 | df587c58c82d7cfb41d966d2fe21cecb | Medium | Score 53/100 | First seen |
| SHA256 | 1d6f3e8583ce84b892097a03b0d4525850f8d3c59dea56482f17e5c44422dc89 | Medium | Score 53/100 | First seen |
| SHA256 | c5c458a7b1bdfa3cbffdbcd0791912ff19267ad2808a5266a9975b22a53e73e0 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…