Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
1 IOC
Malicious LNK Files and PowerShell Deploy Dual Remote-Access Tools Against Indian Applicants
Threat Actors
Excerpt
Indian government job seekers are being targeted in a multi-stage malware campaign that uses a fake Cabinet Secretariat recruitment notice to deploy both a legitimate remote-management tool and a custom remote-access Trojan (RAT) . Researchers at Seqrite’s APT Research Team dubbed the activity “Operation ShadowRecruit.” The campaign targets applicants for Senior Field Officer (Technical) roles. It uses a ZIP archive named Approved Documents 2026.pdf.zip as the initial lure.…
Read the original report →Diamond Model
Adversary(1)
Infrastructure
Capability
Victim
Indicators of Compromise
Open the mindmap →1 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 2b33b5185e93e1655eb27dbaa025d7ee088627db3d640fe4709be705646b189c | High | Score 56/100 | First seen |
IOC Relationship Graph
Building graph…