Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
PHP2Shell Exploit Tooling Found on Exposed Attacker Server
Excerpt
SOCRadar Threat Intelligence Unit (STRU) researchers found PHP2Shell exploit tooling on an attacker-controlled server whose working directory was exposed through an open, unauthenticated directory listing. The files show an operator turning the PHP2Shell vulnerabilities into practical attack tooling: a full remote code execution (RCE) chain built and tested in a lab, plus scripts that screen live websites for the conditions that chain depends on. The screening reached public…
Read the original report →Diamond Model
Adversary
Infrastructure(1)
Capability
Victim
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-109618 | High | Score 83/100 | First seen |
| CVE | CVE-2026-109619 | High | Score 83/100 | First seen |
| IP | 206.188.197.105 | High | Score 63/100 | First seen |
IOC Relationship Graph
Building graph…