Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
88 IOCs
Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days
Threat Actors
Malware Families
Excerpt
Analyst note: Proofpoint uses the UNK_ designator to define clusters of activity that are still developing and have not been observed for long enough to receive a numerical TA designation. Proofpoint Threat Research would like to thank Google Threat Intelligence Group (GTIG), Microsoft Threat Intelligence Center (MSTIC), and Volexity for their collaboration. Volexity's report on additional activity using BlueMoon can be found here. Proofpoint followed responsible disclosure…
Read the original report →Diamond Model
Adversary(3)
Infrastructure(6)
Capability(3)
Victim
Indicators of Compromise
Open the mindmap →88 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | ff1b49aaec994f4c11f2c9331e739abb4bc3d6abf66ec50ce99709fba35d782b | Medium | Score 43/100 | First seen |
| URL | https://download.secboxes.com:443/dist.zip | High | Score 58/100 | First seen |
| SHA256 | 8453c42904b7b2fea5671b7bff06b2d937632ae29545fd11bc13095627a2805f | Medium | Score 46/100 | First seen |
| Domain | asianstudies.secboxes.com | High | Score 58/100 | First seen |
| Domain | rocketlabusa.ink | High | Score 58/100 | First seen |
| Domain | emcore.ink | High | Score 58/100 | First seen |
| Domain | dns.elixnovorem.com | Medium | Score 63/100 | First seen |
| URL | https://app.eduac.workers.dev/Service | Low | Score 32/100 | First seen |
| Domain | brianwilli.com | High | Score 58/100 | First seen |
| CVE | CVE-2026-85046 | High | Score 79/100 | First seen |
| Domain | fracons.com | High | Score 58/100 | First seen |
| SHA256 | bc7d24f5cf8937b334966201bdcce8ca9bab6ec5889d40a399d4094dcad73360 | High | Score 85/100 | First seen |
| URL | https://homepage.brianwilli.com/d/calibre-launcher.dll | High | Score 63/100 | First seen |
| Domain | getaiexo.com | High | Score 58/100 | First seen |
| URL | https://zki0y83.msbenefit.com:443/feed | High | Score 58/100 | First seen |
| URL | https://homepage.brianwilli.com/d/wint.exe | High | Score 58/100 | First seen |
| Domain | elixnovorem.com | High | Score 58/100 | First seen |
| Domain | cyclokinetics.online | High | Score 58/100 | First seen |
| URL | https://api-prod.secboxes.com:443/download | High | Score 58/100 | First seen |
| Domain | bosch-sensortec.site | High | Score 58/100 | First seen |
| IP | 79.133.56.90 | High | Score 58/100 | First seen |
| URL | https://evidence.msbenefit.com/msgbox.exe | High | Score 58/100 | First seen |
| URL | https://homepage.brianwilli.com/d/SysPr.prx | High | Score 58/100 | First seen |
| Domain | vncdc.mailtbox.workers.dev | Low | Score 32/100 | First seen |
| SHA256 | ac6806c89e294f390838cb07c015dabec1c8ada06ce5161a0ad50b8a72828141 | High | Score 85/100 | First seen |
| Domain | epsilonsystems.net | High | Score 58/100 | First seen |
| Domain | dns.velodynaity.com | High | Score 58/100 | First seen |
| Domain | lindes.ink | High | Score 58/100 | First seen |
| SHA256 | ac6bbc4b1f1c62e308781329183a46e18f454c27e66bffa09f343b53ac622b69 | Medium | Score 43/100 | First seen |
| URL | https://small-union-7018.daoahueb.workers.dev/ | High | Score 86/100 | First seen |
| SHA256 | 353b5bd2780c1b0c07c1283d83cf16cf1e9ec226c17b2d09d56848893f9d98ee | High | Score 85/100 | First seen |
| Domain | secboxes.com | High | Score 58/100 | First seen |
| Domain | publish.openlumakora.com | Medium | Score 63/100 | First seen |
| SHA256 | a4a6a04d85eca8d584d939d2437c85a4f291207d8042f2ec002838e336b72ef5 | Medium | Score 43/100 | First seen |
| Domain | airliquide.lol | High | Score 58/100 | First seen |
| SHA256 | 6e6378d8d404166da89d982e80bc52e19a3f677201258dec1775f100a027a92d | Medium | Score 55/100 | First seen |
| Domain | mailtbox.workers.dev | Low | Score 32/100 | First seen |
| Domain | openlumakora.com | High | Score 58/100 | First seen |
| SHA256 | f3c64014221a58f3fde88e562662dbd5a1b3dd2b59c86e9e2bc5cb8f671664e7 | High | Score 85/100 | First seen |
| SHA256 | 3594ad58fb6217fafe9839e53999a90608c2e9f335fa20aece3d53f8c0802726 | Medium | Score 55/100 | First seen |
| URL | https://snowy-block-ae0a.daoahueb.workers.dev/ | High | Score 58/100 | First seen |
| Domain | extension-management-portal.kmjukilo-lkjh.workers.dev | High | Score 58/100 | First seen |
| Domain | apollohospitals.fit | High | Score 58/100 | First seen |
| URL | https://app.eduac.workers.dev/Updateac | High | Score 86/100 | First seen |
| Domain | spectrolab.fit | High | Score 58/100 | First seen |
| Domain | yhv41nji.workers.dev | Low | Score 32/100 | First seen |
| URL | https://1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com/datago/SysPr.prx | Low | Score 32/100 | First seen |
| Domain | smxtech.xyz | High | Score 58/100 | First seen |
| Domain | dns.getaiexo.com | Medium | Score 63/100 | First seen |
| SHA256 | 87b6b24c06f99900a8aa579caedee1e402015884c925a98dcfb0fb38dfa2de22 | High | Score 85/100 | First seen |
| Domain | sncorp.fit | High | Score 58/100 | First seen |
| SHA256 | 295fc584f75e94108c9be945977db33ed80421f5d374eab188587c911dffd915 | High | Score 85/100 | First seen |
| Domain | data.attcdn.com | High | Score 58/100 | First seen |
| URL | https://1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com/datago/krita.dll | Low | Score 32/100 | First seen |
| Domain | ms.checrity.com | High | Score 58/100 | First seen |
| CVE | CVE-2026-85880 | High | Score 78/100 | First seen |
| Domain | velodynaity.com | High | Score 58/100 | First seen |
| URL | https://1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com/datago/krita.exe | Low | Score 32/100 | First seen |
| SHA256 | e950d03c58d49e28e31df8afeefca1f3b3d2cd6b697c40adfee1a4f6fe18f004 | High | Score 85/100 | First seen |
| URL | https://homepage.brianwilli.com/d/85rY.dat | High | Score 58/100 | First seen |
| Domain | royal-surf-a2e2.daoahueb.workers.dev | High | Score 58/100 | First seen |
| Domain | haloengines.net | High | Score 58/100 | First seen |
| Domain | extension-management-portal.centerfjdr658.workers.dev | High | Score 58/100 | First seen |
| SHA256 | 7d6f6dcb17a423bdd7715f8a4e34f2939501a761bc9bf7aa005f805ef1f82288 | High | Score 85/100 | First seen |
| URL | https://recommendation-letter.secboxes.com/ChromeUpdate.exe | High | Score 58/100 | First seen |
| Domain | eduac.workers.dev | High | Score 58/100 | First seen |
| Domain | jetoptera.co | High | Score 58/100 | First seen |
| Domain | black-flower-9250.v93xdd5g.workers.dev | High | Score 58/100 | First seen |
| Domain | joinmacket.com | High | Score 58/100 | First seen |
| SHA256 | b34802a646fc4a8f07ffa09a5fda8bf7327446b22e3d7bb5163dafa1e2a8bb2b | Medium | Score 46/100 | First seen |
| Domain | wcce.joinmacket.com | High | Score 58/100 | First seen |
| SHA256 | 779b3e1a470e589d492b99154ba11622fbaebb19b3de694f660c725411b7096d | Medium | Score 43/100 | First seen |
| Domain | precipart.ink | High | Score 58/100 | First seen |
| Domain | daoahueb.workers.dev | High | Score 58/100 | First seen |
| Domain | airindia.fit | High | Score 58/100 | First seen |
| Domain | attcdn.com | High | Score 58/100 | First seen |
| SHA256 | 3ec3151d8d1278ed966941ac89ea495ef6a80c70613dd9138cc85fc28c9df432 | High | Score 85/100 | First seen |
| Domain | msbenefit.com | High | Score 64/100 | First seen |
| Domain | airproducts.ink | High | Score 58/100 | First seen |
| URL | https://homepage.brianwilli.com/d/ | High | Score 58/100 | First seen |
| Domain | tcomlp.online | High | Score 58/100 | First seen |
| Domain | silvustechnologies.online | High | Score 58/100 | First seen |
| Domain | v93xdd5g.workers.dev | Low | Score 33/100 | First seen |
| Domain | worldview.fit | High | Score 58/100 | First seen |
| CVE | CVE-2026-87491 | High | Score 73/100 | First seen |
| Domain | aurexdefense.online | High | Score 58/100 | First seen |
| Domain | checrity.com | High | Score 58/100 | First seen |
| URL | https://project.secboxes.com/ChromeUpdate.exe | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…