Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Threat Actors
Excerpt
by Robin Dost Sometime around July 2026 a new certificate hierarchy went live on the servers behind Hangro, North Koreas state VPN and mail product. It sits on port 6006 on hosts in Pyongyang and in the Russian Far East. It is built to a completely different standard from the 2024 hierarchy still running beside it and its server certificate enumerates every machine the operators consider part of the system. Including one they probably did not mean to publish 🙂 Pulling that…
Read the original report →Diamond Model
Adversary(2)
Infrastructure
Capability
Victim
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 5a2f81451d6c921a7ab845b1856f67d71c76196cc34ace5ef7c7e8e471c3214b | Medium | Score 53/100 | First seen |
| SHA256 | b8810eae6ead0ec3a606300c5e3fe9c7af23f836719596e9519f73b4e1e7ad01 | Medium | Score 53/100 | First seen |
| MD5 | 7b718d78263d40e080e520f7cba3f035 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…