Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Threat Actors
Excerpt
https://www.kelacyber.com/blog/i-soon-leak-kelas-insights/ I-Soon Leak: Kela’s Insights By KELA Cyber Team, Ben Kapon, Ben Kapon Published: 2024-03-07 · Archived: 2026-10-10 02:00:56 UTC On February 16, 2024, a repository titled “I-S00N” was uploaded to Github, allegedly intended to expose insider information about I-Soon (Anxun Information Technology Co., 安洵信息技术有限公司,i-soon[.]net), a Chinese technology company in the cybersecurity field. The dump may indeed be a breach of…
Read the original report →Diamond Model
Adversary(9)
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →8 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 74.120.172.10 | High | Score 72/100 | First seen |
| IP | 118.31.3.116 | High | Score 70/100 | First seen |
| CVE | CVE-2021-44228 | High | Score 80/100 | First seen |
| URL | https://www.kelacyber.com/blog/i-soon-leak-kelas-insights/ | High | Score 67/100 | First seen |
| Domain | mailnotes.online | High | Score 72/100 | First seen |
| IP | 8.218.67.52 | High | Score 70/100 | First seen |
| Domain | unix.s3amazonbucket.com | High | Score 70/100 | First seen |
| Domain | s3amazonbucket.com | High | Score 70/100 | First seen |
IOC Relationship Graph
Building graph…