Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
9 IOCs
Operation Dragon Whistle: UNG0002 Targets Chinese Academia via Weaponized Institutional Lure
Malware Families
Excerpt
Table of Contents: Introduction: Key Targets: Infection Chain: Initial Findings about Campaign: Analysis of Decoys & Spear phishing Email: Technical Analysis: Stage1: Analysis of LNK File. Stage2: Analysis of VBS. Stage3: DLL Side Loading. Infrastructural Artefacts & Threat actor Attributions. Conclusion: Operation DRAGON WHISTLE? Seqrite Coverage: IOCs: MITRE ATT&CK: Introduction: Seqrite Labs has been actively monitoring a targeted spear-phishing campaign across…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →9 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 35a478f53f64bd412f374c65360fdba0518749537193669a8fe08d14bed65a2a | Medium | Score 53/100 | First seen |
| SHA256 | e7aff6a55a7866776272d9913dfbf9d7db33fc9de6aced22f2a195feebb0e85f | Medium | Score 53/100 | First seen |
| Domain | lysander.asia | High | Score 58/100 | First seen |
| SHA256 | eb14d9e35a3bf0a933297f861bee0be9e6b9061fe4573a81ac92b71d55b6474f | Medium | Score 53/100 | First seen |
| IP | 60.205.186.162 | High | Score 58/100 | First seen |
| SHA256 | fe11b199ada23d5ac25efc4215e67f4ff617ccb4d429eb64412072687367ca1c | Medium | Score 53/100 | First seen |
| SHA256 | ed7087e3afba4b320bdf04f32d3a6c567effd3d18a97682968e567000e70b335 | Medium | Score 53/100 | First seen |
| SHA256 | c937eca7c4c9b98df9257d986e666d25411aac5fa39d21f7018dd2e1663f0c76 | Medium | Score 53/100 | First seen |
| SHA256 | cd99e83d241cfbb41bfcd0bc622a87d16268e710ca7d736d0c5f44774e0056e2 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…