Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
106 IOCs
Microsoft’s MSHTA Legacy Tool Still Powers Malware Campaigns on Windows
Malware Families
Excerpt
Microsoft’s MSHTA Legacy Tool Still Powers Malware Campaigns on Windows Company Blog For Home For Business For Partners Consumer Insights Labs Business Insights Anti-Malware Research 20 min read Microsoft’s MSHTA Legacy Tool Still Powers Malware Campaigns on Windows Janos Gergo SZELES May 19, 2026 Bitdefender security researchers have discovered that attackers continue to exploit Microsoft HTML Application Host (MSHTA), a legacy utility available by default on Windows systems…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(3)
Victim
Indicators of Compromise
Open the mindmap →106 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | web3-walletnotify.cc | High | Score 58/100 | First seen |
| IP | 173.208.166.226 | High | Score 58/100 | First seen |
| IP | 201.138.238.195 | High | Score 58/100 | First seen |
| IP | 156.224.232.98 | High | Score 58/100 | First seen |
| SHA256 | 1e0e375f3ee82d5af5dfe6f7df0e2fac9a7d37c67add3390d05a93afd85b7c84 | Medium | Score 53/100 | First seen |
| IP | 103.83.212.194 | High | Score 58/100 | First seen |
| IP | 103.124.106.194 | High | Score 58/100 | First seen |
| Domain | my-smart-house1.com | High | Score 81/100 | First seen |
| Domain | hell7-kitty.cc | High | Score 58/100 | First seen |
| Domain | explorer.vg | High | Score 58/100 | First seen |
| Domain | files-storage.cc | High | Score 58/100 | First seen |
| Domain | hell4-kitty.cc | High | Score 58/100 | First seen |
| IP | 195.189.28.244 | High | Score 58/100 | First seen |
| Domain | google-services.cc | High | Score 87/100 | First seen |
| IP | 110.42.51.229 | High | Score 58/100 | First seen |
| Domain | msgrouppolicy.vg | High | Score 58/100 | First seen |
| Domain | immortal-service.cc | High | Score 58/100 | First seen |
| SHA256 | 333e2192f2551415659fb4094e81b911708921bb588eecf65e27f51c9938dfc2 | Medium | Score 53/100 | First seen |
| IP | 61.136.101.152 | High | Score 58/100 | First seen |
| Domain | hell1-kitty.cc | High | Score 58/100 | First seen |
| Domain | microservice.gl | High | Score 58/100 | First seen |
| Domain | azure-s3-bucket.cc | High | Score 58/100 | First seen |
| IP | 89.117.2.159 | High | Score 58/100 | First seen |
| Domain | forest-entity.cc | High | Score 90/100 | First seen |
| Domain | acio-patron.cc | Medium | Score 53/100 | First seen |
| Domain | hell10-kitty.cc | High | Score 58/100 | First seen |
| Domain | s2-microservice-updatehub.cc | High | Score 58/100 | First seen |
| Domain | communicationfirewall-security.cc | High | Score 58/100 | First seen |
| Domain | geo-foundation.vg | High | Score 58/100 | First seen |
| IP | 222.73.29.92 | High | Score 58/100 | First seen |
| IP | 157.66.153.154 | High | Score 58/100 | First seen |
| Domain | microservice-update-s2-bucket.cc | High | Score 58/100 | First seen |
| Domain | hell5-kitty.cc | High | Score 58/100 | First seen |
| Domain | holiday-forever.cc | High | Score 58/100 | First seen |
| IP | 103.55.70.212 | High | Score 58/100 | First seen |
| Domain | hosting-control.cc | High | Score 58/100 | First seen |
| Domain | s8-microservice-updatehub.cc | High | Score 58/100 | First seen |
| Domain | ms-team-ping6.com | High | Score 58/100 | First seen |
| IP | 103.115.17.90 | High | Score 58/100 | First seen |
| SHA256 | aa845a8fb4ab38aebe6a16a2a8f80ca4467ac0991d3eef4d8a10bdf97dedb1e9 | Medium | Score 53/100 | First seen |
| Domain | s4-microservice-updatehub.cc | High | Score 58/100 | First seen |
| Domain | s5-microservice-updatehub.cc | High | Score 58/100 | First seen |
| Domain | health-smooth-eu2.com | High | Score 58/100 | First seen |
| Domain | hell9-kitty.cc | Medium | Score 44/100 | First seen |
| Domain | s1-microservice-updatehub.cc | High | Score 58/100 | First seen |
| SHA256 | 7d0487afc91b0fe8b2fbf732ab54c3c07e86bf69471bba6c283aabea190499ba | Medium | Score 53/100 | First seen |
| IP | 103.113.195.244 | High | Score 58/100 | First seen |
| SHA256 | 02630fa994b1566ad1515fd87220fc037b967f07495985a3637d68d7e08c57ee | Medium | Score 53/100 | First seen |
| Domain | hardware-office.cc | High | Score 58/100 | First seen |
| Domain | msedge.vg | High | Score 69/100 | First seen |
| Domain | memory-scanner.cc | High | Score 58/100 | First seen |
| URL | http://92.255.57.155/b.jpg | High | Score 58/100 | First seen |
| IP | 187.102.48.229 | High | Score 58/100 | First seen |
| IP | 58.221.252.210 | High | Score 58/100 | First seen |
| IP | 61.147.108.92 | High | Score 58/100 | First seen |
| SHA256 | 38fe562136ade372fc4cedde67826aeea8404e93a54a4a4736ddb4c8c8d4c96d | Medium | Score 53/100 | First seen |
| Domain | deluxe.gl | High | Score 58/100 | First seen |
| Domain | globalsnn1-new.cc | High | Score 76/100 | First seen |
| IP | 58.221.59.20 | High | Score 58/100 | First seen |
| Domain | memory-protection-layer1.cc | High | Score 58/100 | First seen |
| IP | 110.45.196.155 | High | Score 58/100 | First seen |
| Domain | system-monitor.cc | High | Score 58/100 | First seen |
| Domain | some-othertag.cc | High | Score 58/100 | First seen |
| Domain | health-smooth-eu3.com | High | Score 58/100 | First seen |
| Domain | polystore9-servicebucket.cc | High | Score 74/100 | First seen |
| IP | 190.111.12.242 | High | Score 58/100 | First seen |
| Domain | s10-microservice-updatehub.cc | High | Score 58/100 | First seen |
| MD5 | f8d33485bec26b2b1969f910c131f027 | Medium | Score 53/100 | First seen |
| Domain | hell6-kitty.cc | High | Score 58/100 | First seen |
| IP | 193.112.70.226 | High | Score 58/100 | First seen |
| Domain | holiday-updateservice.com | High | Score 58/100 | First seen |
| Domain | s3-updatehub.cc | High | Score 58/100 | First seen |
| Domain | critical-service.cc | High | Score 58/100 | First seen |
| Domain | microservice-update-s1-bucket.cc | High | Score 74/100 | First seen |
| Domain | globalsnn2-new.cc | High | Score 58/100 | First seen |
| Domain | s6-microservice-updatehub.cc | High | Score 58/100 | First seen |
| Domain | s3-microservice-updatehub.cc | High | Score 58/100 | First seen |
| Domain | network-defender.cc | High | Score 58/100 | First seen |
| Domain | hell8-kitty.cc | High | Score 58/100 | First seen |
| Domain | offshore-storage.cc | High | Score 58/100 | First seen |
| Domain | urugvai.cc | High | Score 58/100 | First seen |
| Domain | globalsnn3-new.cc | High | Score 58/100 | First seen |
| Domain | hell2-kitty.cc | High | Score 58/100 | First seen |
| Domain | alphazero1-endscape.cc | High | Score 58/100 | First seen |
| Domain | s7-microservice-updatehub.cc | High | Score 58/100 | First seen |
| Domain | indeanapolice.cc | High | Score 58/100 | First seen |
| Domain | fileless-storage-s3.cc | High | Score 58/100 | First seen |
| IP | 122.165.219.142 | High | Score 58/100 | First seen |
| Domain | bigbrainsholdings.com | High | Score 58/100 | First seen |
| Domain | s9-microservice-updatehub.cc | High | Score 58/100 | First seen |
| Domain | fileless-market.cc | High | Score 58/100 | First seen |
| IP | 103.36.223.87 | High | Score 58/100 | First seen |
| Domain | holypriest.gl | High | Score 58/100 | First seen |
| Domain | silverhost.vg | High | Score 58/100 | First seen |
| Domain | sentinel1-endpoint-security.cc | High | Score 58/100 | First seen |
| IP | 100.1.121.27 | High | Score 58/100 | First seen |
| Domain | alpha-centavr.cc | High | Score 58/100 | First seen |
| Domain | py-installer.cc | High | Score 58/100 | First seen |
| Domain | debank-api.cc | High | Score 58/100 | First seen |
| IP | 107.175.187.11 | High | Score 58/100 | First seen |
| Domain | hell3-kitty.cc | High | Score 58/100 | First seen |
| Domain | parent-control.cc | High | Score 58/100 | First seen |
| Domain | domain-monitoring.cc | High | Score 58/100 | First seen |
| IP | 204.44.110.216 | High | Score 58/100 | First seen |
| Domain | ccleaner.gl | High | Score 58/100 | First seen |
| IP | 60.173.116.152 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…