Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
69 IOCs
Midnight Mimosa Malware Campaign Exploits Android Firmware Supply Chain
Threat Actors
Malware Families
Excerpt
Midnight Mimosa Malware Campaign Exploits Android Firmware Supply Chain Blog Home Company Marketplace The PolySwarm Blog Analyze suspicious files and URLs, at scale, millions of times per day. Get real-time threat intel from a crowdsourced network of security experts and antivirus companies competing to protect you. Midnight Mimosa Malware Campaign Exploits Android Firmware Supply Chain Oct 19, 2026, 2:13:48 PM / by The Hivemind Tweet Related Families: Midnight Mimosa,…
Read the original report →Diamond Model
Adversary(34)
Infrastructure
Capability(41)
Victim
Indicators of Compromise
Open the mindmap →69 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 4657191f26927e22018495a9e8da9044f76d0644d56eab0a553d57cc9735c63d | Medium | Score 53/100 | First seen |
| SHA256 | 880c7c369497fbc515b96eaea63c01d879895e1efc4b1ed71d58dd8e5aaf0284 | Medium | Score 53/100 | First seen |
| SHA256 | 4b3080c1cd2c669dff3144f332013dd6db0aaf1115e6b04efcb4e25fea884fd2 | Medium | Score 53/100 | First seen |
| SHA256 | d434d6cb954d404789f652040d761b07e12aaae0129dc6c25ec1732afc5d92f3 | Medium | Score 53/100 | First seen |
| SHA256 | 97d37c33b2332072da7ca16d99ab047b64939745c82dab3b17e6b69f14ad8ada | Medium | Score 53/100 | First seen |
| CVE | CVE-2023-1389 | High | Score 82/100 | First seen |
| SHA256 | 245b0b9b3583d37ae9eedac2665b09f656bd67f3985df0cdc0af9c7cd95bceed | Medium | Score 53/100 | First seen |
| CVE | CVE-2025-49704 | High | Score 82/100 | First seen |
| CVE | CVE-2022-30190 | High | Score 79/100 | First seen |
| SHA256 | 819f87c7c310c4491192cd87bc1a3e65297c2133819b2b4f672204787693f87b | Medium | Score 53/100 | First seen |
| CVE | CVE-2025-0994 | High | Score 82/100 | First seen |
| SHA256 | 55605320099d8b351e9c0fbbe0b9806058ba644de9c1f384914b4f1445a028e9 | Medium | Score 53/100 | First seen |
| CVE | CVE-2022-47986 | High | Score 82/100 | First seen |
| SHA256 | 1fce280388341989856991b09d0a82b8872061b739641241bc30e57241a27dcb | Medium | Score 53/100 | First seen |
| SHA256 | 1ba97892f9631d0609116325eace408a4d2b28ff8f0639a4303b5cff2fb6b4f9 | Medium | Score 53/100 | First seen |
| SHA256 | e33624c0d69bc71c68ce5b84757efcd27943757c24f14d2abbff1c564587c104 | Medium | Score 53/100 | First seen |
| SHA256 | 8f35a3844b3bc3f5d44b278568bae8933e36cddb4e9074ad1b29a64e7c197e26 | Medium | Score 53/100 | First seen |
| SHA256 | 6cb1b929dc98d6b1725fb4566a1b58bd3211c5da31697c962099ef585b1e7853 | Medium | Score 53/100 | First seen |
| SHA256 | 63d2417f93b4e434d231f00cb9ba16e6636792a96e21acf1be76f411dd1c5ed5 | Medium | Score 53/100 | First seen |
| SHA256 | 3398bdb7180bc9d3c6755e6cd3ddb351c751e64c3bf346a1857cb2c1c7406483 | Medium | Score 53/100 | First seen |
| SHA256 | 980ee11f141ca4983c2e5457d48a994a61aa5a537c60d89a0999ce8a69996e0f | Medium | Score 53/100 | First seen |
| SHA256 | 771744786d0da8a530cbfe921408a3ddb11af797dff3ad9716d9b57ef7ab48b5 | Medium | Score 53/100 | First seen |
| CVE | CVE-2025-55182 | High | Score 82/100 | First seen |
| CVE | CVE-2021-3493 | High | Score 82/100 | First seen |
| SHA256 | 1b423665896a40d31bc7feec8b0fa78d7f27552fd25f4a72917519feed3e59f5 | Medium | Score 53/100 | First seen |
| CVE | CVE-2023-34362 | High | Score 79/100 | First seen |
| CVE | CVE-2025-3248 | High | Score 79/100 | First seen |
| CVE | CVE-2025-53770 | High | Score 79/100 | First seen |
| SHA256 | 207758bad044c25f89fabf78892aa0f845a9b44a73b7aa16fd1fab1139c2297a | Medium | Score 53/100 | First seen |
| CVE | CVE-2022-31199 | High | Score 82/100 | First seen |
| SHA256 | 58b95add72b23acce491516c4d0eaa4291ff902199b806446587ed147dfd1a1e | Medium | Score 53/100 | First seen |
| SHA256 | 21d8ff68344b589d05626dce48a3b29573ee6c2e2a1ce81c392d69afd758c124 | Medium | Score 53/100 | First seen |
| CVE | CVE-2021-21974 | High | Score 82/100 | First seen |
| SHA256 | e1b600dc014eed0e59e4345021ec0e9e210edf364fffdb655baeb4dc6c058822 | Medium | Score 53/100 | First seen |
| CVE | CVE-2022-21894 | High | Score 82/100 | First seen |
| SHA256 | 731634848622ba0b32b03d03766d01990c1ce63c85b5a701e15dd2a96bd5f47e | Medium | Score 53/100 | First seen |
| SHA256 | a12844e4e1007ec143200d8192589593c22b6cf143ac51b320eabf08260ab2d4 | Medium | Score 53/100 | First seen |
| CVE | CVE-2025-49706 | High | Score 82/100 | First seen |
| SHA256 | 1fe24e80eed64eb28ea1d31e949445eaa85095e33a03e6bc835d688b81f40875 | Medium | Score 53/100 | First seen |
| SHA256 | c38714cd8f77fca773d97b86c9a3122ef5e4991a6e70f901c64672cff8bf3956 | Medium | Score 53/100 | First seen |
| CVE | CVE-2023-46604 | High | Score 84/100 | First seen |
| CVE | CVE-2021-4034 | High | Score 79/100 | First seen |
| SHA256 | 502090cf297cd5fbffe6caf57fed196e737c07075895cd26d93662c16c95c4fe | Medium | Score 53/100 | First seen |
| SHA256 | 53e1d7dc079dc2ffcff9fea9dccd23d9d206ffaede2274a2e6d8259c26b1a4a2 | Medium | Score 53/100 | First seen |
| CVE | CVE-2022-26134 | High | Score 82/100 | First seen |
| CVE | CVE-2023-2868 | High | Score 79/100 | First seen |
| SHA256 | e66d62bba82a5452fd9cb99a2b304c32f461cbc7f411a0fd555ae9db6ce34eec | Medium | Score 53/100 | First seen |
| SHA256 | 468d2d12ededba0733acc32b4a0da776fac592cdc5fdf49015728f4586322b79 | Medium | Score 53/100 | First seen |
| SHA256 | f67f5a4415ca63037f6a543a900ca622d13b169fced6064d91e7082e8557b53c | Medium | Score 53/100 | First seen |
| SHA256 | 543922608fa97dca7e13e70a8538ef60722d32069542551f218eafcee99e80fb | Medium | Score 53/100 | First seen |
| SHA256 | 5cd66605c1a299ac58a0686c2d52547d43d3eb60fcf7a2fc9474f5752ebb8105 | Medium | Score 53/100 | First seen |
| SHA256 | 88ee3c961ccd8dbad9c5e8f02da118caf1ead51fef0fcd4cebb311be3fd622a1 | Medium | Score 53/100 | First seen |
| SHA256 | 32b0dcb8429f6b049424ef08be58f641e2ba3b8292d38d0f7ebfdcd495b697df | Medium | Score 53/100 | First seen |
| CVE | CVE-2024-3400 | High | Score 79/100 | First seen |
| SHA256 | 3351728f6fba0c65d1c1c678e80c36ed7bdc8be1ea6bf85e826c27e689c3db07 | Medium | Score 53/100 | First seen |
| CVE | CVE-2023-22518 | High | Score 82/100 | First seen |
| CVE | CVE-2024-21412 | High | Score 82/100 | First seen |
| SHA256 | bcad5575a549137af0e44463b3cdda315848ed93c2ca6acf486dbc20c4f57f0c | Medium | Score 53/100 | First seen |
| CVE | CVE-2021-33044 | High | Score 79/100 | First seen |
| SHA256 | 3b8519d6412546c4c1c622e842e0d9b34a540169c974325d053ff227407133ad | Medium | Score 53/100 | First seen |
| CVE | CVE-2026-21509 | High | Score 79/100 | First seen |
| SHA256 | a427a8e3bfeaa66f017535669905763d7af1cf2c394d8ba80ebe3f489e2bb54f | Medium | Score 53/100 | First seen |
| CVE | CVE-2017-7921 | High | Score 79/100 | First seen |
| SHA256 | 70baca89bb6b76f26076c01c35cf531018064fe5ab3d6332312500e7c1def9e1 | Medium | Score 53/100 | First seen |
| CVE | CVE-2024-7344 | High | Score 82/100 | First seen |
| CVE | CVE-2023-36025 | High | Score 82/100 | First seen |
| CVE | CVE-2025-53771 | High | Score 82/100 | First seen |
| CVE | CVE-2024-40766 | High | Score 80/100 | First seen |
| CVE | CVE-2025-21042 | High | Score 82/100 | First seen |
IOC Relationship Graph
Building graph…