Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
8 IOCs
Public and Private Medical Community Targeted by China-Nexus Threat Actor Pursuing Artificial Intelligence, Cyber, Medical, and National Defense Research
Threat Actors
Malware Families
Excerpt
Written by: Patrick Whitsell, John McGuiness, Muhammad Umair Google Threat Intelligence Group (GTIG) has identified a sophisticated campaign attributed to UNC6508, a People's Republic of China (PRC)-nexus threat actor, targeting institutions in the North American academic, medical, and military research community. While remaining undetected for over a year, the threat actor compromised externally facing web applications, deployed bespoke malware, pivoted to sensitive internal…
Read the original report →Diamond Model
Adversary(1)
Infrastructure
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →8 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 8f0158855a656b629ca76ebca565f18bc25563ded34b65d6771632c20edb68ec | Medium | Score 40/100 | First seen |
| SHA256 | db65c1b9f9e4cb4d729f45ad4b6fcf3e277caf9eb4c875425dec93fd883f9136 | Medium | Score 40/100 | First seen |
| SHA256 | f3a266bed2b73690459e30a2e52e5afd4bc36ea83197ab8bf3d5cb17095a7eef | Medium | Score 53/100 | First seen |
| SHA256 | 51a57bfc9ed3eb6451c1c289607814d59e1698c666fb97ac5f694c398f23d045 | Medium | Score 40/100 | First seen |
| SHA256 | c1ac43d23f89d41eb4ff131678ab562ab2cfed9aa334b13767ef141d303b0e5b | Medium | Score 40/100 | First seen |
| SHA256 | ba6b73b0ca0dc7f86b3b397893ac32d729fd53f9df20643288f141f29d020af7 | Medium | Score 40/100 | First seen |
| SHA256 | 4efbef69eb3b09bacff892d6a55778d07c418e7f15eba3cf1245e8cdfd8dda0b | Medium | Score 40/100 | First seen |
| SHA256 | 58bb25777e0aa86bcd2125101e0bca4e8732b03d91bd8d2f205b446a2a8d5c86 | Medium | Score 40/100 | First seen |
IOC Relationship Graph
Building graph…