Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
22 IOCs
Phantom in the Vault: Obsidian Abused to Deliver Phantompulse Rat
Malware Families
Excerpt
https://www.elastic.co/security-labs/threat-command/phantom-in-the-vault Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT By Salim Bitam Published: 2026-04-14 · Archived: 2026-10-13 02:02:06 UTC If you're interested in a deeper technical analysis of PHANTOMPULSE itself, covering its injection engines, persistence internals, and C2 protocol in greater detail, check out this follow-on analysis of the PHANTOMPULSE malware. Preamble Elastic Security Labs has…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →22 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | 195.3.222.251/stuk- | High | Score 67/100 | First seen |
| Domain | trycloudflare.com | High | Score 67/100 | First seen |
| MD5 | dcf5a9b27cbeedb769ccc8635d204af9 | High | Score 64/100 | First seen |
| SHA256 | 70bbb38b70fd836d66e8166ec27be9aa8535b3876596fc80c45e3de4ce327980 | High | Score 65/100 | First seen |
| URL | t.me/ax03bot | High | Score 67/100 | First seen |
| Domain | optimism.blockscout.com | High | Score 71/100 | First seen |
| URL | https://panel.fefea22134.net | High | Score 71/100 | First seen |
| SHA256 | 33dacf9f854f636216e5062ca252df8e5bed652efd78b86512f5b868b11ee70f | High | Score 65/100 | First seen |
| Domain | 0x666.info | High | Score 86/100 | First seen |
| MD5 | f77c8e40dfc17be5e74d8679d5b35341 | High | Score 64/100 | First seen |
| SHA256 | 6a85736b64761a8b2aaeadc1c0087e1897d16cc5a9d49c6a6ea1164233bad206 | High | Score 64/100 | First seen |
| IP | 172.67.146.15 | High | Score 69/100 | First seen |
| URL | https://thoroughly-publisher-troy-clara.trycloudflare.com | High | Score 69/100 | First seen |
| SHA1 | 6c0a1da746438d68f6c4ffbf9a10e873f3cf0499 | High | Score 64/100 | First seen |
| IP | 188.114.97.1 | High | Score 71/100 | First seen |
| IP | 104.21.79.142 | High | Score 69/100 | First seen |
| Domain | fefea22134.net | High | Score 69/100 | First seen |
| Domain | base.blockscout.com | High | Score 71/100 | First seen |
| MD5 | a6fa4adfc20e8e6b77e2dd631dc8ff18 | High | Score 64/100 | First seen |
| Domain | eth.blockscout.com | High | Score 71/100 | First seen |
| IP | 120.0.0.0 | Medium | Score 70/100 | First seen |
| IP | 188.114.96.1 | Medium | Score 65/100 | First seen |
IOC Relationship Graph
Building graph…