Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
24 IOCs
Going with the Flow(s): Distinct Clusters Target Individuals of Interest to Russia
Threat Actors
Malware Families
Excerpt
Written by: Gabby Roncone, Wesley Shields Overview Google Threat Intelligence Group (GTIG) is tracking three distinct suspected Russian cyber espionage threat clusters abusing legitimate authentication flows to target individuals working in academia, aerospace and defense, governments and think tanks across Europe, as well as academia and think tanks within the United States. Examples of these techniques can be found in our previous blog on UNC6293’s phishing operations. We…
Read the original report →Diamond Model
Adversary(2)
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →24 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | statistic-ms.live | High | Score 62/100 | First seen |
| SHA256 | 403b624e35777cbc07dbe66398b21bba70396a20b859c880732338ce1dd1f41f | High | Score 56/100 | First seen |
| SHA256 | a06a8fd1b6fa1924199a4540cf16d089217ce8f78c617739946f145fd1fc88c1 | Medium | Score 53/100 | First seen |
| Domain | foreignrelations.us | High | Score 66/100 | First seen |
| SHA256 | 6f7090895c1c3dee30de6b3f098ca3a788dc198646e5293a8b1210430b0add97 | High | Score 56/100 | First seen |
| SHA256 | 125752ad7c20d715920a3b2fb0fdde660f07b3f2b053665cf38c2d6d9de86e1e | Medium | Score 53/100 | First seen |
| SHA256 | 20e20b074967ed6f6e04d609ccec5ff7492665ef25f894c90c2ddc92fa47ac38 | High | Score 56/100 | First seen |
| SHA256 | 2c7f4165967d6f7737b3fef87959846920b57a5368b531ad1427c7214d4c41a2 | Medium | Score 53/100 | First seen |
| Domain | owa-ms365.com | High | Score 77/100 | First seen |
| SHA256 | be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c | High | Score 83/100 | First seen |
| IP | 104.194.159.150 | High | Score 80/100 | First seen |
| Domain | m365-owa.com | High | Score 77/100 | First seen |
| Domain | verify-drive.com | High | Score 58/100 | First seen |
| SHA256 | 5b8d50c2e8cc3038b7c6e6dbf1219f6e814930a1e3c0053143a1191ae67f8ffc | Medium | Score 53/100 | First seen |
| SHA256 | ca3be5885afb3eb3bb19341e2653212200c568f3f900e0b2f04de9ba209aed25 | High | Score 56/100 | First seen |
| SHA256 | c5826032207d623a7f6caec8465af7364eccc355f9a48897da2a54f3e4420265 | Medium | Score 53/100 | First seen |
| IP | 107.189.18.7 | High | Score 58/100 | First seen |
| Domain | my-invite.org | High | Score 73/100 | First seen |
| SHA256 | 1d9299799a7b8da67c44ebec064d64542c27645f8e84de4a22ca3f6cbc843e3c | Medium | Score 53/100 | First seen |
| Domain | ms365-device.com | High | Score 77/100 | First seen |
| SHA256 | 28f622028e690c943f7fa9aca426c07cab52b5aaba757ef8a3328609c0b3bec3 | High | Score 56/100 | First seen |
| SHA256 | 1f24443e2fc1843d59edcad6282898e3fa2a0917706ffb043229e3a555902b68 | Medium | Score 53/100 | First seen |
| Domain | wa-connect.eu | High | Score 58/100 | First seen |
| SHA256 | 1e3ee845fde739fcd3ca9ce62c7f142a7c501d11db4c4fb294d4939f12d0f916 | High | Score 56/100 | First seen |
IOC Relationship Graph
Building graph…