Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
8 IOCs
Inside The Com: Understanding the Ecosystem Behind Scattered Spider, LAPSUS$, ShinyHunters, and FALCON
Threat Actors
Malware Families
Excerpt
What is “The Com”? The Community, or The Com is a decentralized, predominantly English-speaking cybercriminal ecosystem with no fixed leadership and no unified targeting objective apart from financial gain and reputation. The collective’s origins trace back to forums like OGUsers, later moving to RaidForums. Researchers, including teams at Flashpoint , describe it as loosely organized around "pillars," with a financially motivated hacking and…
Read the original report →Diamond Model
Adversary(2)
Infrastructure(6)
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →8 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | helpdesk-organization.com | High | Score 58/100 | First seen |
| Domain | sso-organization.com | High | Score 58/100 | First seen |
| Domain | organization-okta.com | High | Score 58/100 | First seen |
| Domain | organization-sso.com | High | Score 58/100 | First seen |
| Domain | organization-helpdesk.com | High | Score 58/100 | First seen |
| Domain | passkey.com | High | Score 58/100 | First seen |
| Domain | ticket-organization.com | High | Score 58/100 | First seen |
| CVE | CVE-2025-61882 | High | Score 62/100 | First seen |
IOC Relationship Graph
Building graph…