Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
18 IOCs
Ibm X Force Discovers New Sheriff Backdoor Used to Target Ukraine | Ibm
Threat Actors
Excerpt
https://www.ibm.com/think/x-force/x-force-discovers-new-sheriff-backdoor-target-ukraine IBM X-Force Discovers New Sheriff Backdoor used to target Ukraine | IBM By Golo Mühr Published: 2025-04-09 · Archived: 2026-10-10 02:00:53 UTC Author IBM X-Force discovered a set of previously unknown malware (Sheriff backdoor) used in a cyber espionage attack against an entity within Ukraine’s defense sector in the first half of 2024. The threat actor used a popular news portal in…
Read the original report →Diamond Model
Adversary(5)
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →18 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | mainclass.run | High | Score 67/100 | First seen |
| Domain | loader.directory | High | Score 67/100 | First seen |
| URL | https://content.dropboxapi.com/2/files/upload_session/append_v2 | High | Score 67/100 | First seen |
| URL | http://ukr.net/8V3fDJ0U/RDZXVh | High | Score 67/100 | First seen |
| Domain | loader.maincycle.run | High | Score 67/100 | First seen |
| Domain | yyyy.mm.dd_hh.mm.ss | High | Score 67/100 | First seen |
| URL | https://api.dropboxapi.com/2/files/delete | High | Score 67/100 | First seen |
| URL | https://content.dropboxapi.com/2/files/upload | High | Score 67/100 | First seen |
| URL | http://ukr.net/8V3fDJ0U/RDZXV | High | Score 67/100 | First seen |
| URL | https://api.dropboxapi.com | High | Score 67/100 | First seen |
| Domain | loaddll.directory | High | Score 67/100 | First seen |
| URL | https://api.dropboxapi.com/2/files/list_folder | High | Score 67/100 | First seen |
| URL | https://content.dropboxapi.com/2/files/download | High | Score 67/100 | First seen |
| URL | https://content.dropboxapi.com | High | Score 67/100 | First seen |
| URL | https://content.dropboxapi.com/2/files/upload_session/start | High | Score 67/100 | First seen |
| URL | https://api.dropboxapi.com/2/files/create_folder | High | Score 67/100 | First seen |
| Domain | ukr.net | High | Score 70/100 | First seen |
| URL | https://content.dropboxapi.com/2/files/upload_session/finish | High | Score 67/100 | First seen |
IOC Relationship Graph
Building graph…