Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
13 IOCs
Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer
Threat Actors
Malware Families
Excerpt
Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer | Huntress Deception is moving at machine speed. Learn to keep pace. Portal Login Support Blog Contact Search Search Products Products Platform Overview Huntress Platform One managed platform across endpoint integrity, identity resilience, and operational readiness. Huntress Platform One managed platform across endpoint integrity, identity resilience, and operational readiness. Athena Engine…
Read the original report →Diamond Model
Adversary(4)
Infrastructure(6)
Capability(6)
Victim
Indicators of Compromise
Open the mindmap →13 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 05f69ae6b2b89c1c4dcf836bff032232f11bf0109f2b498e2345045d06139034 | Medium | Score 53/100 | First seen |
| CVE | CVE-2026-105133 | Medium | Score 51/100 | First seen |
| SHA256 | 4dcb0202fe8b2d4d7b183764e38184cd6ed50132786cc7e7d1f7f4bce1dd6f3d | Medium | Score 53/100 | First seen |
| Domain | xmr.kryptex.network | High | Score 58/100 | First seen |
| IP | 185.220.236.49 | High | Score 58/100 | First seen |
| IP | 104.234.26.10 | High | Score 58/100 | First seen |
| CVE | CVE-2026-105134 | Medium | Score 51/100 | First seen |
| IP | 38.60.252.110 | High | Score 58/100 | First seen |
| IP | 51.195.127.124 | High | Score 58/100 | First seen |
| SHA256 | 481728a7c9c4c02be07051d9c1958d902ea6397ebb8952ab83944818e3d25d21 | Medium | Score 53/100 | First seen |
| IP | 107.191.47.199 | High | Score 58/100 | First seen |
| IP | 177.4.12.11 | High | Score 58/100 | First seen |
| IP | 123.202.208.37 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…