Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Malware Families
Excerpt
You all know that Lumma is going crazy lately. I was tracking another Lumma cluster (I know shocking) when Krebs published a new article about Prospero, a bulletproof service provider. Funny coincidence the starting poing of my ongoing investigation was an IP hosted at that ASN (200593) which send me down a rabbit hole. Started from the IP 91,202.233.151 that is actively hosting Lumma infostealer malware. Starting from urlscan.io we can pivot off one of the hashes that are…
Read the original report →Diamond Model
Adversary
Infrastructure
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →1 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 5021cc94accc930c25a56574dcf3ab56b9717e450d3712a424b27cab1eca1a9d | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…