Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Threat Actors
Malware Families
Excerpt
The Return of Old Forces: Revealing New Campaigns Connected to A Missing Cyber Mercenary Firm Joseph Chen 2026-01 @ JSAC2026 1 | ©2025 Trend Micro Inc. Whoami Joseph Chen Staff Threat Researcher Threat Hunting / Threat Intelligence 2 | ©2025 Trend Micro Inc. Agenda • Introduction • Campaign − PONDSNAKE − WILYCODE • Attribution • Conclusion 3 | ©2025 Trend Micro Inc. Introduction 4 | ©2025 Trend Micro Inc. Cyber Espionage 5 | ©2025 Trend Micro Inc. The “I-S00N” Leak • A…
Read the original report →Diamond Model
Adversary(10)
Infrastructure(6)
Capability(5)
Victim
Indicators of Compromise
Open the mindmap →106 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA1 | 1c2689b3a459260a62fdd83a07d9cbb9c82ad40b | High | Score 67/100 | First seen |
| IP | 45.115.124.42 | High | Score 68/100 | First seen |
| IP | 38.60.199.222 | High | Score 68/100 | First seen |
| SHA1 | 699817c45546776736f835ce60a9e780b3d409c1 | High | Score 67/100 | First seen |
| IP | 38.54.89.38 | High | Score 68/100 | First seen |
| Domain | su2769.com | High | Score 68/100 | First seen |
| IP | 118.107.221.14 | High | Score 68/100 | First seen |
| SHA1 | 4299b95d3879aebbac4e99c948ebbf1c16f79694 | High | Score 67/100 | First seen |
| URL | https://viettelsecurity.com/apt-ta-sc-31-exploiting-reputable-websites-as-a-launchpad-for-targeted-attack-campaigns/ | High | Score 67/100 | First seen |
| IP | 45.76.213.172 | High | Score 68/100 | First seen |
| IP | 1.13.82.101 | High | Score 68/100 | First seen |
| SHA1 | 5a16e5b91f92bf19bea89cd03bdfb152e68593b3 | High | Score 67/100 | First seen |
| IP | 106.54.165.184 | High | Score 68/100 | First seen |
| IP | 27.124.19.90 | High | Score 68/100 | First seen |
| IP | 140.246.157.86 | High | Score 68/100 | First seen |
| IP | 121.40.23.183 | High | Score 68/100 | First seen |
| URL | http://118.107.221.43/msvcr100.dll | High | Score 68/100 | First seen |
| URL | https://su2769.com:443/G.txt | High | Score 68/100 | First seen |
| Domain | fu5599.com | High | Score 68/100 | First seen |
| IP | 178.16.52.194 | High | Score 86/100 | First seen |
| SHA1 | 086c11f4c9640ff01f4634a8c7f83dc130682174 | High | Score 67/100 | First seen |
| SHA1 | aa40e0ff81ce7f18c3bcf92847450d8f671aa7f5 | High | Score 67/100 | First seen |
| IP | 103.42.176.156 | High | Score 68/100 | First seen |
| URL | http://38.54.16.227/tasklist.aaa | High | Score 68/100 | First seen |
| SHA1 | ac786011d46026144b4feb99f940915bb202df03 | High | Score 67/100 | First seen |
| SHA1 | 1d53549bd01561e740df1434bebafe0843deed55 | High | Score 67/100 | First seen |
| URL | http://38.54.31.65/UevAppMonitor.exe.config | High | Score 68/100 | First seen |
| SHA1 | ddb3e607f3f39f18b5ebb8417af1b0ba664be91c | High | Score 67/100 | First seen |
| IP | 144.172.92.144 | High | Score 68/100 | First seen |
| Domain | ns1.cooke-int.com | High | Score 68/100 | First seen |
| IP | 38.54.17.22 | High | Score 68/100 | First seen |
| SHA1 | f668c34c522fa163a6319dadf7641ed22b86b7de | High | Score 67/100 | First seen |
| MD5 | 99f985d1d225b3a0388a22cd9e4ea193 | High | Score 67/100 | First seen |
| Domain | investment1.top | High | Score 68/100 | First seen |
| SHA1 | 9f6a7ee952ea5a94a9d954af361e54184695f591 | High | Score 67/100 | First seen |
| IP | 47.123.4.117 | High | Score 68/100 | First seen |
| URL | http://118.107.221.43/setting.dat | High | Score 68/100 | First seen |
| IP | 38.54.31.213 | High | Score 68/100 | First seen |
| SHA1 | 3cb8156020eaa1b3c4609ed3cc86a7f0b945eba0 | High | Score 67/100 | First seen |
| SHA1 | be3d9ee51892116992d098b23958fe6167b06282 | High | Score 67/100 | First seen |
| IP | 122.51.194.153 | High | Score 68/100 | First seen |
| URL | http://154.196.187.90/vpn_server.config | High | Score 68/100 | First seen |
| CVE | CVE-2025-55182 | High | Score 82/100 | First seen |
| SHA1 | c46b5d7eb02c40db35a4c5322a3a39f220244e45 | High | Score 67/100 | First seen |
| IP | 183.255.43.126 | High | Score 68/100 | First seen |
| SHA1 | ad5b53ef14c53dd5a7c0b92def23358c04187e3d | High | Score 67/100 | First seen |
| Domain | cookietest.ml | High | Score 68/100 | First seen |
| SHA1 | c7b169a31972ca2ded7e75474d3ba14008f971fa | High | Score 67/100 | First seen |
| SHA1 | 84985adf6fcde0921aa6a955076ba67dd510102e | High | Score 67/100 | First seen |
| SHA1 | d9c765ca3dd9acd038e4728a67339a7f2e11daa4 | High | Score 67/100 | First seen |
| SHA1 | 026d81090c857d894aaa18225ec4a99e419da651 | High | Score 67/100 | First seen |
| SHA1 | 4629373208637d8d1379999a9c16b1a15428d885 | High | Score 67/100 | First seen |
| URL | http://118.107.221.43/vpn_server.config | High | Score 68/100 | First seen |
| URL | http://154.196.187.90/hamcore.se2 | High | Score 68/100 | First seen |
| SHA1 | 14fec3cda4d5f448276c0755c956875326a9e33b | High | Score 67/100 | First seen |
| SHA1 | b5c485a983feb3818549894e22862e3088fb7b13 | High | Score 67/100 | First seen |
| IP | 112.124.24.104 | High | Score 68/100 | First seen |
| SHA1 | 0718a42e4fd95a8fa9cc3894b1d8714270399921 | High | Score 67/100 | First seen |
| URL | http://118.107.221.43/jli.dll | High | Score 68/100 | First seen |
| URL | https://www.security.com/threat-intelligence/budworm-espionage-us-state | High | Score 67/100 | First seen |
| IP | 149.30.232.116 | High | Score 68/100 | First seen |
| URL | https://su2769.com:443/gdf.txt | High | Score 68/100 | First seen |
| SHA1 | d166137291fabe4f55b2c5bc16b8a9267e0c5ec1 | High | Score 67/100 | First seen |
| SHA1 | 226777071b4ecb8cf9bbe909b5a1b5d2317f6290 | High | Score 67/100 | First seen |
| SHA1 | bec1aedbe2a89dd818c23c1b77a8c2f83159d494 | High | Score 67/100 | First seen |
| IP | 45.131.153.211 | High | Score 68/100 | First seen |
| URL | http://118.107.221.43/hamcore.se2 | High | Score 68/100 | First seen |
| IP | 206.119.178.91 | High | Score 68/100 | First seen |
| URL | https://su2769.com:443/config.log | High | Score 68/100 | First seen |
| SHA1 | 57fe1f966f8a0fbdffc0cb06a59c797caeceb2db | High | Score 67/100 | First seen |
| URL | http://118.107.221.43/taskllst.exe | High | Score 68/100 | First seen |
| SHA1 | cd65340360d597a41ac4702f57ae3ec195c1f6fe | High | Score 67/100 | First seen |
| Domain | extract.me | High | Score 67/100 | First seen |
| URL | http://38.54.31.65/behavior.dll | High | Score 68/100 | First seen |
| SHA1 | 95f3afe953282de414099dd1d88339f7d0140045 | High | Score 67/100 | First seen |
| SHA1 | 74ae90411b6500f3af950b832962d2c282ed547a | High | Score 67/100 | First seen |
| IP | 156.231.11.86 | High | Score 68/100 | First seen |
| Domain | ns1.xzbxhy.com | High | Score 68/100 | First seen |
| IP | 139.155.134.117 | High | Score 68/100 | First seen |
| Domain | cooke-int.com | High | Score 68/100 | First seen |
| SHA1 | 83ae1b5ef0f57b4c8d389097450cdadaf625b046 | High | Score 67/100 | First seen |
| SHA1 | da8796d5814752b6a3e955fb870b90464bf4c08d | High | Score 67/100 | First seen |
| URL | http://38.54.31.65/tmp.dat | High | Score 68/100 | First seen |
| URL | https://www.justice.gov/opa/pr/justice-department- | High | Score 67/100 | First seen |
| URL | http://38.54.31.65/UevAppMonitor.exe | High | Score 68/100 | First seen |
| IP | 91.92.241.247 | High | Score 68/100 | First seen |
| URL | http://118.107.221.43/jconsole.exe | High | Score 68/100 | First seen |
| SHA1 | 8609f7ee417c9666a6a10bb92f8dfb8b8998607b | High | Score 67/100 | First seen |
| IP | 38.54.115.169 | High | Score 68/100 | First seen |
| Domain | conhostsadas.website | High | Score 68/100 | First seen |
| IP | 118.24.119.137 | High | Score 68/100 | First seen |
| SHA1 | 1ca6b1284b8bb545b45571f7941a0b00cb337810 | High | Score 67/100 | First seen |
| SHA1 | 18ab2f763a043c1b15751f46308e343450b08e78 | High | Score 67/100 | First seen |
| SHA1 | 3b7c9fc01772254cdd4f3cbc327b2dd11d102c14 | High | Score 67/100 | First seen |
| IP | 139.9.91.122 | High | Score 68/100 | First seen |
| URL | http://38.54.31.65/Payload.bin | High | Score 68/100 | First seen |
| IP | 206.119.167.164 | High | Score 68/100 | First seen |
| SHA1 | 976466e6bf07e2e85a3833ef0e9bcaac769dfd64 | High | Score 67/100 | First seen |
| SHA1 | 0714c10773e94a4b90ed16a8cb7db02875f47ed6 | High | Score 67/100 | First seen |
| Domain | mtlklabs.co | High | Score 68/100 | First seen |
| SHA1 | f02a6c1eba1d25120edf4893ccccbfff7184e6f9 | High | Score 67/100 | First seen |
| IP | 103.75.46.123 | High | Score 68/100 | First seen |
| IP | 8.142.124.166 | High | Score 68/100 | First seen |
| IP | 14.23.132.92 | High | Score 68/100 | First seen |
| SHA1 | fb2ff3a660f22c7bda72911ff1e4216e1ae8925f | High | Score 67/100 | First seen |
| IP | 38.54.31.99 | High | Score 68/100 | First seen |
IOC Relationship Graph
Building graph…