Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
4 IOCs
ShieldCrash: Testing the Claimed Microsoft Defender Zero-Day
Threat Actors
Malware Families
Excerpt
Key Findings ShieldCrash is the third patch bypass in a row against the same Defender component. RoguePlanet (CVE-2026-50656) was patched in July 2026 through engine version 1.1.26060.3008. ShieldBreak (CVE-2026-69414) bypassed that patch in August and was itself patched in September 2026 through engine version 1.1.26080.3. ShieldCrash claims to bypass that fix and was published on September 8, 2026, the same day as September Patch Tuesday. All three target the Microsoft…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(2)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →4 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | git.projectnightcrawler.dev | High | Score 68/100 | First seen |
| CVE | CVE-2026-50656 | High | Score 66/100 | First seen |
| CVE | CVE-2026-69414 | Medium | Score 57/100 | First seen |
| Domain | git.churchofmalware.org | High | Score 68/100 | First seen |
IOC Relationship Graph
Building graph…