Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Excerpt
There is an active phishing campaign targeting EU and US companies, originating from 51.89.86.103 and 23.26.201.168 Having a closer look at the IPs, we can immediatly see that there are hundreds of eml files referring them. Some are shared as eml file hash but others include the name which clearly shows the financial lure theme. The emails contain a pdf file and within the file there a QR code which redirects to identical credential harvesting websites…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | dallasonrasolutions.cloud | High | Score 58/100 | First seen |
| Domain | withbible.com | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…