Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Threat Actors
Malware Families
Excerpt
This is part 2 of a 2-part blog series Proofpoint is publishing about Russian espionage actors using half-click exploits to target government webmail servers. Read part 1 about TA488 here, and the accompanying advisory from NSA here. Threat Research would like to thank the Proofpoint Cloudmark Authority team. Key Findings The Russia-aligned threat actor TA458, the group behind Operation RoundPress, continues to focus on webmail targeting using half-click exploits as a way to…
Read the original report →Diamond Model
Adversary(2)
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →20 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | hgmydr.wiki | High | Score 71/100 | First seen |
| CVE | CVE-2024-42900 | Medium | Score 51/100 | First seen |
| SHA256 | a0c80cab70d6672b01710a70f93311fc1c1db2fbbf9cd6daa543c34b87e3444a | Medium | Score 53/100 | First seen |
| Domain | xwe.us | High | Score 71/100 | First seen |
| CVE | CVE-2025-27915 | Medium | Score 54/100 | First seen |
| CVE | CVE-2023-43770 | Medium | Score 51/100 | First seen |
| CVE | CVE-2024-42009 | Medium | Score 53/100 | First seen |
| Domain | share-ya.space | High | Score 71/100 | First seen |
| CVE | CVE-2025-49113 | Medium | Score 56/100 | First seen |
| Domain | zxzaq.com | High | Score 71/100 | First seen |
| SHA256 | 8b5a4dc237a4c89042176bc89864a4c357dcdd14fa544fe6496ccb6c31cd5b7f | Medium | Score 53/100 | First seen |
| SHA256 | 6b2c02bf82087a3ca5fb7ef8046554ff29ce85d52202bdcfae2b2653aede139a | Medium | Score 53/100 | First seen |
| CVE | CVE-2026-8496 | Medium | Score 51/100 | First seen |
| CVE | CVE-2025-3929 | Medium | Score 51/100 | First seen |
| Domain | upgybj.store | High | Score 71/100 | First seen |
| SHA256 | e27d1bf82249002a66395c89dbda6ec5d8df012a84b79d36fffbbf7808d28878 | Medium | Score 53/100 | First seen |
| SHA256 | 625e4c166c7a1d5a1becf56b27d4f76a2f95935cbd8d556c30a493263d10dbf8 | Medium | Score 53/100 | First seen |
| SHA256 | fb8ec4dbed14c0a91361abd82ebe9fb083615c3dbb15348f57317af7cc41dd34 | High | Score 69/100 | First seen |
| SHA256 | 3a449148a0e3cac604fb93210dd7d91ccf48e06ed9aae064bc53a419a84ce9ba | Medium | Score 53/100 | First seen |
| Domain | xsza.net | High | Score 71/100 | First seen |
IOC Relationship Graph
Building graph…