Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
Revisiting MoonBounce: Research Notes
Threat Actors
Excerpt
Revisiting MoonBounce: Research Notes Technical Analysis and Design Insights into the DXE Core “To understand the immeasurable, the mind must be extraordinarily quiet, still.” — Jiddu Krishnamurti Seeker( 李标明 ) · @clibm079 China · Independent Malware Analyst & Researcher From 2026.01.17 to 2026.01.28 Prologue: Ever climbing, more deeper Last time, I shared the report “Revisiting LoJax Supplementary Analysis and Research…
Read the original report →Diamond Model
Adversary(1)
Infrastructure
Capability
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA1 | 6bfb3634f6b6c5a114121fe53279331ff821ee1e | Medium | Score 53/100 | First seen |
| MD5 | d94962550b90ddb3f80f62bd96bd9858 | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…