Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Threat Actors
Malware Families
Excerpt
Over the past year, our Global Emergency Response Team (GERT) has investigated several incidents involving the NightEagle group (APT-Q-95). This group has been active since at least 2023 and originally focused on organizations in Asia. We have now identified attacks by the group targeting businesses in Russia. This post examines both known and new tools NightEagle used in its latest campaign. Initial access In most incidents, the attackers used compromised valid credentials…
Read the original report →Diamond Model
Adversary(2)
Infrastructure
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →7 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| MD5 | 3ecd1cd627d0340c92901a478a7caad8 | Medium | Score 53/100 | First seen |
| MD5 | 1dcafb7f8448683281106b06dd22409a | High | Score 86/100 | First seen |
| CVE | CVE-2020-0688 | Medium | Score 57/100 | First seen |
| MD5 | 4aa9fb1bf9223dfcdac920759bc7a3c7 | Medium | Score 53/100 | First seen |
| MD5 | 631fb131a56caf4ca0f287ed73e876ab | Medium | Score 53/100 | First seen |
| CVE | CVE-2019-0708 | High | Score 68/100 | First seen |
| MD5 | 1f3034b706c78b35d8e34044e68c693a | Medium | Score 47/100 | First seen |
IOC Relationship Graph
Building graph…