Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
Hackers Use Fake Fiscal Documents to Deliver NinjaOne RMM Agent for Remote Access
Threat Actors
Excerpt
An active phishing campaign targeting Brazilian organizations which attackers are tricking victims into downloading a legitimate remote management tool called NinjaOne. This tactic highlights a growing reality in the threat landscape, attackers no longer need exotic, complex malicious code to breach corporate networks. Familiar business workflows and trusted software are often enough to establish a foothold. The attackers focus heavily on the chemicals and advanced materials…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(5)
Capability
Victim
Attack Flow7 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | sefaz.services | High | Score 61/100 | First seen |
| Domain | lazybearpottery.net | High | Score 61/100 | First seen |
| Domain | rectalmania.com | High | Score 61/100 | First seen |
| Domain | hairdb.com | High | Score 61/100 | First seen |
| Domain | r64.org | High | Score 61/100 | First seen |
IOC Relationship Graph
Building graph…