Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
7 IOCs
Threat Intelligence | PolinRider Poisons Nova, Using On-Chain Transactions as a C2 Manager
Threat Actors
Excerpt
Background The sample comes from a development branch of the Laravel Nova extension package visanduma/nova-two-factor, associated with the PolinRider campaign. This is a PHP package published on Packagist, with more than 700,000 cumulative downloads as of the time of this analysis. The delivery chain does not embed the C2 address in the sample. The implanted code first queries Ethereum, extracts the IP addresses of two servers from the recipient address of a transaction, and…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(5)
Capability
Victim
Indicators of Compromise
Open the mindmap →7 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 166.88.73.46 | High | Score 58/100 | First seen |
| SHA1 | a322e5f3d311d3080e6f0121063e9adc2490ef1a | Medium | Score 53/100 | First seen |
| IP | 193.247.144.38 | High | Score 58/100 | First seen |
| IP | 166.88.134.75 | High | Score 58/100 | First seen |
| IP | 23.27.13.135 | High | Score 58/100 | First seen |
| IP | 166.88.134.62 | Medium | Score 50/100 | First seen |
| SHA256 | 515a53291d25d229e1f9fa72e66407e1cfd7e77c91478400b24d5185af68531a | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…