Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
50 IOCs
Stray Cat, Open Doors: How K0t Wanders Through the Network Edge
Threat Actors
Malware Families
Excerpt
By Tsai Shun Ling, Nikolay Kichatov Published: 2026-10-21 · Archived: 2026-10-26 02:00:46 UTC Introduction https://www.group-ib.com/blog/stray-cat-network-edge/ Stray Cat, Open Doors: How k0t Wanders Through the Network Edge Group-IB Threat Intelligence, together with NyxLab, collaborated on a joint investigation on a campaign involving widespread exploitation of network edge devices. This joint-investigation effort has managed to uncover indications that this may be…
Read the original report →Diamond Model
Adversary(3)
Infrastructure(6)
Capability(3)
Victim
Indicators of Compromise
Open the mindmap →50 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | alknene.shop | High | Score 69/100 | First seen |
| threatintel@nyxlab.com | High | Score 67/100 | First seen | |
| SHA256 | f9e95af4cda14dd5596c452a1a698f60412a7b2a9540321ee2a10b3bcbbd2a0e | High | Score 65/100 | First seen |
| Domain | exploit_2026_0257.py | High | Score 70/100 | First seen |
| URL | http://162.33.178.213:8888/clear-thinking_61.92.4_INSTALL.exe | High | Score 70/100 | First seen |
| CVE | CVE-2021-42287 | High | Score 64/100 | First seen |
| Domain | radesashar.com | High | Score 69/100 | First seen |
| URL | http://162.33.178.213:8888/ | High | Score 69/100 | First seen |
| URL | http://193.149.187.81:1287/1.exe | High | Score 70/100 | First seen |
| Domain | fort.py | High | Score 69/100 | First seen |
| SHA1 | b686a811ad89671fbdb448d65f79488d2e562265 | High | Score 65/100 | First seen |
| URL | https://sthyjk.com:8443/ | High | Score 69/100 | First seen |
| MD5 | 197f2621c80da7974c56d2ff1921e994 | High | Score 65/100 | First seen |
| SHA1 | b39cf70a0194d32e00d7812c29ae1d6add77b823 | High | Score 65/100 | First seen |
| Domain | fortnew.py | High | Score 72/100 | First seen |
| URL | https://agent.afahimsa.top/meshagents | High | Score 68/100 | First seen |
| SHA1 | e2c96e603323d8fc7c08678b793d56554faa6914 | High | Score 65/100 | First seen |
| SHA256 | 552d0096f60c36a35c6096b3e4b38d743c29f8c56f3862fa3b7ef06c932e2a21 | High | Score 65/100 | First seen |
| URL | https://sthyjk.com:8443/clear-thinking_61.92.4_INSTALL.exe | High | Score 70/100 | First seen |
| SHA256 | 808145ec3351569083fda27a910ebdf9e054e8ca42e40c021af5d6712c2ab87c | High | Score 65/100 | First seen |
| URL | https://64.94.85.14:4321/endpoint | High | Score 69/100 | First seen |
| IP | 193.24.123.162 | High | Score 69/100 | First seen |
| Domain | mesh.buttruyen.com | High | Score 69/100 | First seen |
| IP | 162.33.179.249 | High | Score 69/100 | First seen |
| Domain | cookie_file.name | High | Score 67/100 | First seen |
| SHA256 | 39c4decc4881ec02a47cd01c0fd8c3030527b466124ad03c6f99cfaa0ba0b72e | High | Score 65/100 | First seen |
| CVE | CVE-2026-0257 | High | Score 81/100 | First seen |
| CVE | CVE-2019-6693 | High | Score 60/100 | First seen |
| IP | 168.100.11.99 | High | Score 69/100 | First seen |
| MD5 | 6f5d18157425aa9697913ae1310f588f | High | Score 65/100 | First seen |
| MD5 | 13367fbba4344de87de418ab17de76f0 | High | Score 65/100 | First seen |
| MD5 | 0dc1af7cfd336a7f075228defc730082 | High | Score 65/100 | First seen |
| SHA256 | 158215c7371e868f3d0c7fd2e92f05026a8678a3635629d89bd6042ee543278a | High | Score 65/100 | First seen |
| IP | 62.60.131.43 | High | Score 70/100 | First seen |
| Domain | meshcentral.girydsfsggvb.com | High | Score 70/100 | First seen |
| IP | 193.169.194.21 | High | Score 69/100 | First seen |
| SHA1 | 6546801898d0b32f5050f49c5302f0366d630cc9 | High | Score 65/100 | First seen |
| IP | 193.149.176.50 | High | Score 69/100 | First seen |
| IP | 64.94.85.14 | High | Score 86/100 | First seen |
| SHA256 | 1d1b76d30a69aa39b224053481483156f82dde026edd6f5d964f6e03f5f04a6d | High | Score 65/100 | First seen |
| SHA1 | f05daaf66b200672d679a5ced8b67d4b48a4906e | High | Score 65/100 | First seen |
| IP | 62.60.135.64 | High | Score 70/100 | First seen |
| MD5 | 5318f29ef434341d989d543b14fd2a48 | High | Score 65/100 | First seen |
| MD5 | 032473db4d66748eab524effe57a661d | High | Score 65/100 | First seen |
| SHA1 | bfd864ec0e6bd912f932e4f3ed80687736ee16e8 | High | Score 65/100 | First seen |
| SHA256 | 4db6bea4c1e4bce5020039def4087a073f4753a6b297b2832c19c10423ac842d | High | Score 65/100 | First seen |
| SHA1 | e47a2b7ca6a8c009962871dbb667d128ad6b6162 | High | Score 65/100 | First seen |
| MD5 | 20dc8f1b8a313336c14e03bcb71ff6c8 | High | Score 65/100 | First seen |
| CVE | CVE-2021-42278 | High | Score 62/100 | First seen |
| CVE | CVE-2025-64446 | High | Score 68/100 | First seen |
IOC Relationship Graph
Building graph…