Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
Ghostwriter Phishing Infrastructure Targets Gmail and Ukrainian Email Portal Users
Threat Actors
Excerpt
The threat actor known as UNC1151, also tracked under names like Ghostwriter and FrostyNeighbor, continues to expand its aggressive spear-phishing operations across Eastern Europe. Historically aligned with Belarusian and Russian state interests, this group originally gained notoriety in 2020 by hacking media websites to plant political disinformation. Recent threat intelligence reveals the group has shifted heavily into credential theft, scaling its infrastructure to target…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(3)
Capability
Victim
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 2434e1a88cf2effa13fc4eb335560e3cf49790ddd4bd0df7e100de9867a19748 | Medium | Score 53/100 | First seen |
| Domain | accounts-verification.cc.cd | High | Score 58/100 | First seen |
| Domain | mail.service-support.digital | High | Score 58/100 | First seen |
| SHA256 | 6542f8fa3e1f00a3c0e9994c34d8b49d2c3d2684cf73c23a0b1030daaaaa4786 | Medium | Score 53/100 | First seen |
| IP | 45.197.133.104 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…