Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
15 IOCs
Pirates in the crosshairs: how one cybercrime gang has been infecting book, movie, and TV show fans for years
Malware Families
Excerpt
Introduction In late April 2026, a client reached out to us for incident response support after discovering a miner running on users’ computers. We later discovered that the malware was being distributed via illegal movie and TV show streaming sites. The infection chain leveraged a fake update for a video player plugin. When the user attempted to watch a video, the player displayed a message saying the plugin version was outdated and asking to install an update to…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →15 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | qdmagva5.space | High | Score 58/100 | First seen |
| Domain | urush1bar4.online | High | Score 58/100 | First seen |
| IP | 107.172.212.235 | High | Score 58/100 | First seen |
| Domain | zgj1tam9.space | High | Score 58/100 | First seen |
| MD5 | 02a43b3423367b9dddc24cc7dfc070df | Medium | Score 53/100 | First seen |
| Domain | jeaw520i.space | High | Score 58/100 | First seen |
| Domain | kristina.quest | High | Score 58/100 | First seen |
| MD5 | 0123456789abcdef0123456789abcdef | Medium | Score 53/100 | First seen |
| MD5 | 6a0fe6065d76715feebc1526d456db73 | Medium | Score 53/100 | First seen |
| Domain | r7mvjl67.space | High | Score 58/100 | First seen |
| MD5 | 000102030405060708090a0b0c0d0e0f | Medium | Score 53/100 | First seen |
| MD5 | 7f624407ae489324e96a708a09c17e6f | Medium | Score 53/100 | First seen |
| Domain | m4yuri.online | High | Score 58/100 | First seen |
| Domain | 5d14vnfb.space | High | Score 58/100 | First seen |
| Domain | file.ipfs.us.69.mu | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…