Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Threat Actors
Excerpt
TL;DR This documents a YouTube-themed Career Phishing campaign that I assess is likely related to PoisonSeed. Table of Contents TL;DR Tactical Pause Summary Up Front Leads Lead Analysis Actioning the Intel to Find Sources General Flow Validators Tactical Intel for My Fellow Thruntellisearchers Internal External Attribution Summary References Indicators Tactical Pause THE CONTENT, VIEWS, AND OPINIONS EXPRESSED ON THIS DOCUMENT ARE MY OWN AND DO NOT REFLECT THOSE OF MY EMPLOYER…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(2)
Capability
Victim
Indicators of Compromise
Open the mindmap →4 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | https://hire.ytcareerslink.com | High | Score 58/100 | First seen |
| MD5 | daf14c2066cfd530114d9227cf85c328 | Medium | Score 53/100 | First seen |
| SHA1 | 6e7684ff7508beb029c763b4d7ea791146b620bc | Medium | Score 53/100 | First seen |
| Domain | cl.s12.exct.net | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…