Skip to main content
IOC Radar

Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

Check Exposure
38 IOCs

Phishing Abuses RMM Tools for Persistent Access

Microsoft Threat Intelligence
Microsoft Threat Intelligence
Published September 29, 2026Original Report

Malware Families

Excerpt

In this article Attack chain overview Mitigation and protection guidance Learn More In July 2026, Microsoft Defender Experts observed phishing campaigns targeting organizations across multiple industries that distributed a masqueraded MSP360 Remote Monitoring and Management (RMM) installer through meeting invitations, PDF-themed lures, software update prompts, and other social-engineering content. Once executed, the legitimate MSP360 installer, distributed under a deceptive…

Read the original report →

Diamond Model

SOCIAL AXISTECHNOLOGY AXISADVERSARYunknownINFRASTRUCTUREadsaw.cfdadswre.cfdtrews.cfdCAPABILITYPsExecVICTIMunknown
Adversary
Infrastructure(6)
Capability(1)
Victim

Indicators of Compromise

Open the mindmap →

38 indicators

TypeIndicatorConfidenceScoreFirst Seen
SHA256d3cb7ded277b49be06e6a1860f7c7e913e252802e9d32453a185e24797bf53efMediumScore 53/100First seen
SHA256fc96a04c615847f0fb1391f04d9d1aac7f78ddfb7d459168df0a4172b98354e2MediumScore 53/100First seen
SHA256dd434f3ffcafeda538d43226665115ba136ad0fdb43dad8536e1368ca9a17b64MediumScore 53/100First seen
SHA2564188c6588f3dcda881c3f2d12df580051179a999f040b799af506edeb3211a26MediumScore 53/100First seen
SHA256c2c004a56de2a99f5b06ceb58d8a4b371fb60fd66ff5936786fe8d8037ead208MediumScore 53/100First seen
Domainadsaw.cfdHighScore 58/100First seen
SHA256857c2f283de799faa74b56e862c0a9f96e67aa1b4fa4a9e46395098365b99de3MediumScore 53/100First seen
SHA256374c4934b14a1151ea68847c8627c3f1c0b878f4e673bda3f15e4388dfde0187MediumScore 53/100First seen
SHA256ceb3f7fe9a618ff29a21b126383c23900fad58d6ae2b5552d7e306e4b6acf4b0MediumScore 53/100First seen
SHA25640f8e774e1e7a484b78c7ae4336bc47aa9cab20dc8e1e67d89838e807975f9b1MediumScore 53/100First seen
SHA256a93c946c237b981189d2668d938a9d4d1d9681757e48dae8d9d65ed25b5da657MediumScore 53/100First seen
Domainadswre.cfdHighScore 71/100First seen
SHA25677fb0e75f4396cb57bbbd28f6dc5310369a87abec9e2acc457aa99a0063ed27aMediumScore 53/100First seen
SHA2561a534d04bf30894d20764e91f7e94e0a73f060f0abacc9feeedba427995c83a8MediumScore 53/100First seen
Domaintrews.cfdHighScore 71/100First seen
SHA256bc8b1b0c80512ba0e8ffccfee5b507df16a3355db1143c3ba81ef42dac1baa6cMediumScore 53/100First seen
SHA256108ef7e628d7a20bd6241a5b57149e27a6061f467123eb64061975559f8f73dcHighScore 83/100First seen
SHA25667c979dc13961b09f24f85a801e4c918420adca6117c92efbeeeaa68a6344f55MediumScore 53/100First seen
Domainbunstar.harej.siHighScore 71/100First seen
SHA256ccea4e1acc51ac43ba9da76ada00e7e308cc33d9c5c264dff82d1be83e957b88MediumScore 53/100First seen
SHA256a03c84ae9e569c04fdd271277f508bba5a299d53c3c0efe0819338d178fe1c5bMediumScore 53/100First seen
SHA256529543b4fe6a4c21d28be56dbf92fcac91d8df808d8518b4275c973fa547ad63MediumScore 53/100First seen
SHA256d232d82e410de12702a67c58acf927304ee42f3e6d81a9d71eca99f9052126dbMediumScore 53/100First seen
SHA25606ad69b9bebad3cc75b594cc5bb1ca0035ea22bb8a683002ca051d948566426bMediumScore 53/100First seen
Domainswedcorry.stefneyv.comHighScore 58/100First seen
SHA1f34330d4c6e0aa978dc3af40360c14b31ad51127HighScore 56/100First seen
Domainojsuyw.niyari.orgHighScore 58/100First seen
SHA2563ff5e49fd2f2bd0758467763c44d69e781b7460af84a6e3966e2621bc5bf7096MediumScore 53/100First seen
SHA2566cc665057c4a4fe42a309afd3a7fa96cf1af126e9c6e08e56df5105e05378bccMediumScore 53/100First seen
SHA256499d07894f730fb685ee3cbfc1a933e0da93750c1ed25a49b2eb9c32adef156aMediumScore 53/100First seen
Domainsdfghj.rd-team.ruHighScore 58/100First seen
SHA2565bf8cf29ac6803e7269b045dea48003af7cfe48bedfc081b57ff9e86cb08971bMediumScore 53/100First seen
SHA256d49cc01641c3045bf3119f9d71e7ffd29bfce32ca4b27cc96340716ed4d41cdcMediumScore 53/100First seen
SHA25619035c8e2520fb70b3e2ec5338c14311b88a26cc1fb8304a01494260b6b55af1MediumScore 53/100First seen
SHA25602f2ce03a2650f17bfe6e8744eebbf58522016cbdb92af8f2217b5dd4a1ad550MediumScore 53/100First seen
SHA256e31e5da7c58a7e8f89f9629f095edd7d741a1fb0b85fcb39f3818dbd9497b1e3MediumScore 53/100First seen
SHA256f094b8263471c7b76dbed03d420736449920368fa0eca2ed6b1aea2645138d97MediumScore 53/100First seen
SHA2566a89de024ca62536de6f5fc10e49896bb1ac330ca39dce30203afdcc45ae237eMediumScore 53/100First seen

IOC Relationship Graph

Building graph…