Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
10 IOCs
Threat Intelligence | Analysis of the Supply Chain Poisoning Attack on the Official Mistral AI SDK
Excerpt
Background Recently, during continuous threat hunting across the PyPI ecosystem, the MistEye security monitoring system captured a malicious version of the official Mistral AI Python SDK: mistralai-2.4.6. After in-depth analysis, the sample was confirmed not to be a fake package published by attackers impersonating the project — users installing it from PyPI were indeed receiving a version published under the official mistralai project, except that the source code had already…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Attack Flow7 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →10 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 6dbaa43bf2f3c0d3cddbca74967e952da563fb974c1ef9d4ecbb2e58e41fe81b | Medium | Score 53/100 | First seen |
| URL | https://83.142.209.194/v1/models | High | Score 58/100 | First seen |
| URL | https://83.142.209.194/transformers.pyz | High | Score 58/100 | First seen |
| MD5 | 94dbce1e6dd19886a253a1c5fc0abbb0 | Medium | Score 53/100 | First seen |
| SHA1 | d4583b83b8213add7558ba568b287e65d5a06d47 | Medium | Score 53/100 | First seen |
| URL | https://83.142.209.194/v1/models. | High | Score 58/100 | First seen |
| URL | https://83.142.209.194/v1/weights. | High | Score 58/100 | First seen |
| SHA256 | 5245eb032e336b85cff0dbb3450d591826bf2ef214fd30d7eba1a763664e151b | Medium | Score 53/100 | First seen |
| URL | https://83.142.209.194/v1/weights | High | Score 58/100 | First seen |
| URL | https://83.142.209.194/audio.mp3 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…