Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
93 IOCs
Unholy trinity: werewolves target law enforcers
Malware Families
Excerpt
Overview In February 2026, we uncovered an espionage campaign that distributed malware under the guise of Starlink device registration services and drone pilot training applications. The investigation revealed three distinct threat actors: Paper Werewolf (GOFFEE), Versatile Werewolf (HeartlessSoul), and previously undocumented Eagle Werewolf. Despite sharing a common goal and employing similar techniques, the clusters operated autonomously, showing no evidence of direct…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →93 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | e321a2348bfba68e642f8b13bbdbebc394a4364bddbdadf8b37e4bff80200de1 | High | Score 86/100 | First seen |
| URL | https://synchro-service.com/array8/array8.json | High | Score 58/100 | First seen |
| SHA256 | bbbb345cf004992fd8a0ca8c900458f15d6ae939f7f41a60c28a67475af59289 | Medium | Score 53/100 | First seen |
| URL | http://203.161.56.226/public/starlink | High | Score 58/100 | First seen |
| URL | https://battleflight.org/download/installer | High | Score 58/100 | First seen |
| URL | https://newfolder.click/?cid=9ebeb834a451460e&mod=main</pre><h4>Domains</h4><pre>stardebug.app<br | High | Score 58/100 | First seen |
| Domain | curtainbeatdisturbance.com | High | Score 64/100 | First seen |
| SHA256 | d55a9680b9df14da5e434d5839734c1ed7d9a44348bfd4868e36682203282cc4 | Medium | Score 53/100 | First seen |
| URL | https://updateserv.net:443/backup/update-subtask-status | High | Score 58/100 | First seen |
| URL | https://servupdate.net/array/array9.json | High | Score 58/100 | First seen |
| SHA256 | a20870bee771efe1ea01761d7978cc7b68b0a3c32c617675464f9c4dbe0a5d66 | Medium | Score 53/100 | First seen |
| URL | http://203.161.56.226/public/catalog/machine/register | High | Score 58/100 | First seen |
| SHA256 | c9c9cf72eaf105be6345aef989c88c27d75bbad935efbc349232b84939d59499 | Medium | Score 53/100 | First seen |
| URL | https://battleflight.pro/static/media/BattleFlight_Installer.exe; | High | Score 58/100 | First seen |
| SHA256 | 5c23d87edca803f7579129a0f6cc18796f67bf55b0c9d053e47edd5f9b501b62 | Medium | Score 53/100 | First seen |
| SHA256 | edb4e02547daba247fea1f95d5a45f4cf0cc2a35259cd2e07ae5f99c76910751 | Medium | Score 53/100 | First seen |
| URL | https://web-tellegram.org/socket.io/?EIO=4&transport=polling&t=ikzknftw&sid=0TY7i-pDpxsIn8b4ABJ6. | High | Score 58/100 | First seen |
| SHA256 | dc6243760263153e4245d8ca37821d2ff2889c78bcd9e9849050e10e26ac3fb3 | Medium | Score 53/100 | First seen |
| Domain | re-link.space | High | Score 58/100 | First seen |
| SHA256 | 4263c458ef216f8e2524462ea3efe79be44492d51143a519081c429c3c24c166 | Medium | Score 53/100 | First seen |
| URL | https://updateserv.net:443/file/uploadChunk | High | Score 58/100 | First seen |
| URL | http://203.161.56.226/public/starlink/starlink-v2 | High | Score 58/100 | First seen |
| URL | https://www.alphafly-drones.com/downloads/AlphaFlyInstallV1-2.msi. | High | Score 58/100 | First seen |
| IP | 104.194.158.63 | High | Score 58/100 | First seen |
| SHA256 | aa52dd66071b673416947a798d1f5118405eb94476db08a2ada2eaa5bdeeb276 | Medium | Score 53/100 | First seen |
| URL | https://prodacserv.net/array/array10.json | High | Score 58/100 | First seen |
| SHA256 | d8ad86cf071b914cc0e828c5b3ff68a72fb5ce776f49dd2aa3f56e7d8af142f8 | Medium | Score 53/100 | First seen |
| SHA256 | 10b6d2cb69d9902afc2157c81b31b066ffd53e9deb156787b68e4fdea2c081b4 | Medium | Score 53/100 | First seen |
| SHA256 | f8c10fd2b3d254cff0c7927c188a7751568fe7ff3eace1de83bb3148bc14a339 | Medium | Score 53/100 | First seen |
| SHA256 | df1d20e392f7b7c5c408bdda317e0733e5ec27a973e3bf75034c6566343aa67f | Medium | Score 53/100 | First seen |
| SHA256 | ef72cd3ed4b2d86466ad674b09f077f68909038fba8015f95cfddbf4f53900d4 | Medium | Score 53/100 | First seen |
| SHA256 | aa5f6d919f0f7055e7a22c566463615f208f0b70e5cc56a927baa95796432dcb | Medium | Score 53/100 | First seen |
| Domain | serverscreen.net | High | Score 58/100 | First seen |
| URL | https://updateserv.net:443/check | High | Score 58/100 | First seen |
| URL | https://newfolder.click/?cid=9ebeb834a451460e&mod=main. | High | Score 58/100 | First seen |
| Domain | mystarlink.org | High | Score 58/100 | First seen |
| SHA256 | 677c5ad47c8feaf6a5c0b084060347bcf48f0ccadcdf951b3d48553f4520feaa | Medium | Score 53/100 | First seen |
| SHA256 | 3fe1405a47d1f58c1f7b54d12de574542b32e6d67586d43f119575b906da0a38 | Medium | Score 53/100 | First seen |
| Domain | updateserv.net | High | Score 58/100 | First seen |
| SHA256 | 6498d18edb1d440783ae1e7921ebd491872b81b91968bcb246086bf1e08b68f6 | Medium | Score 53/100 | First seen |
| URL | https://updateserv.net:443/cmd/upload-result | High | Score 58/100 | First seen |
| Domain | toolsserv.com | High | Score 58/100 | First seen |
| SHA256 | ea312fc2bc4dffcaa69d4308ed9d58ae26051285777bbf05665eb625d94dab27 | Medium | Score 53/100 | First seen |
| URL | https://certcheck.online/certificate/check/Wi5kyh3yFeUF2VhIiFX572eR3870GxYrk7f1Q7MLV5vJ3xGnf4 | High | Score 58/100 | First seen |
| SHA256 | e8de53d4c7558b836f701af0f2e6db5807b10cf9a0d10543bb53357c17b936b3 | Medium | Score 53/100 | First seen |
| SHA256 | bcc9f8baa79c96e6adfbef6dc35d841b63b5c09029f9845fe52bcd76b53a51b9 | Medium | Score 53/100 | First seen |
| SHA256 | dbf9a2d1936df83e9764c0233623b581c8e0bf9e331ff0a636721438ce7a1dd5 | Medium | Score 53/100 | First seen |
| URL | https://updateserv.net:443/backup/get-time | High | Score 58/100 | First seen |
| SHA256 | 54318d50f463de10661d13701c2acd183a3bd00ea0d01fd74ccdb778f073ea7a | Medium | Score 53/100 | First seen |
| SHA256 | 09c83fc5f1656cc4be749c64bfc53d2ef612c9b79dc3937b8bb137754c82216a | Medium | Score 53/100 | First seen |
| URL | https://battleflight.pro/static/media/BattleFlight_Installer.exe | High | Score 58/100 | First seen |
| URL | https://stardebug.app/static/files/StarDebug_1.0.1.msi | High | Score 58/100 | First seen |
| SHA256 | 34db59b663c15cd03cdd92bf24bdff25b756dd51f0540fecaac2a0cab47480ae | High | Score 61/100 | First seen |
| URL | https://updateserv.net:443/clients/files | High | Score 58/100 | First seen |
| URL | http://configurationserv.com/tunnel/register | High | Score 58/100 | First seen |
| Domain | servicefor8.com | High | Score 58/100 | First seen |
| SHA256 | 5047eae07f5d4dca559c5e04d60ecd775fce4e448d00f7b61c38b737ecbd5586 | Medium | Score 53/100 | First seen |
| Domain | updatewin.net | High | Score 58/100 | First seen |
| SHA256 | 5d759393935faa272f3a7b2dd827d010abd40ead178aba45b360c83ebbcd5e84 | Medium | Score 53/100 | First seen |
| SHA256 | 80419e4fbe836b59f96697a8b35acb9903d34796e12ea0cd2349b3c01fe3f9e8 | Medium | Score 53/100 | First seen |
| SHA256 | c2a86a9fe38f46eea465290e68c8ee90e474acd3c3fa5f0b6704168965e98f8b | Medium | Score 53/100 | First seen |
| MD5 | 64d12e5568160c5c32de3373c88db378 | Medium | Score 53/100 | First seen |
| URL | http://127.0.0.1:5000/373fef3041ec51dd | High | Score 58/100 | First seen |
| SHA256 | 71155a0940a2c19789d8a8efb285ac3dff5d680a93902901afe6cc893f278ce9 | Medium | Score 53/100 | First seen |
| SHA256 | 487154b1e2a96627d1eeb5d679e3e37269a27701f32b8769b6aa9f9ea640a53c | Medium | Score 53/100 | First seen |
| SHA256 | 688a1dc207ead232cb8ae6f67fcca1cf7892d83a01af024c404e636cb6ba4cb2 | Medium | Score 53/100 | First seen |
| URL | https://newfolder.click/9ebeb834a451460e | High | Score 58/100 | First seen |
| SHA256 | c1fbd66467449d3c8d9d07a939843a49fad9de9ac484241d52f0d5a94299ca62 | Medium | Score 53/100 | First seen |
| SHA256 | b97fba0accfaf94ae416c2cf1a17a01c281c5565c80fb525ee00f1191a62eff9 | Medium | Score 53/100 | First seen |
| IP | 145.223.70.69 | High | Score 58/100 | First seen |
| SHA256 | e1f359773da3b014389018ef8a22a15acb2157b43cff5f507237ca7093174b11 | Medium | Score 53/100 | First seen |
| Domain | obriy.airforce | High | Score 58/100 | First seen |
| URL | https://web-tellegram.org/ru | High | Score 58/100 | First seen |
| SHA256 | 82254b86590762b2946c6584db35d3872a5d6b85d30e8c07adb95de2126a4f97 | Medium | Score 53/100 | First seen |
| Domain | alphafly-drones.com | High | Score 58/100 | First seen |
| SHA256 | 5869fb9280846dd77c3fb38b976cf760f889481947cda76a779cf69f48d57daa | Medium | Score 53/100 | First seen |
| SHA256 | 3d280f5bb4e1eba8c1a65c7d17411286f7b3dbe7db48130f7d5a3be421ffc2ae | Medium | Score 53/100 | First seen |
| SHA256 | 1951325e1bf6f927ae4bd57fec4d2b5b893cdac2d98c010ef716db254e8d4e7f | Medium | Score 53/100 | First seen |
| URL | https://web-tellegram.org/socket.io/?EIO=4&transport=polling&t=ikzknftw&sid=0TY7i-pDpxsIn8b4ABJ6</pre><h4>Domains</h4><pre>syncheaven.online<br | High | Score 58/100 | First seen |
| Domain | for8service.net | High | Score 58/100 | First seen |
| SHA256 | 376276fb34d3ce82f2e15b3b27978ffce1896320f4ba226c1eeda778e1fe5714 | Medium | Score 53/100 | First seen |
| SHA256 | b965badd209359e7b19c423e321193b308101b844bdf14704228e27f46c7ffe0 | Medium | Score 53/100 | First seen |
| SHA256 | cde5ea7788856304e869254fdc90e76adf6990651b72c7351609e707fbf36c0e | Medium | Score 53/100 | First seen |
| URL | http://cloudanalitics.net/tunnel/register | High | Score 58/100 | First seen |
| SHA256 | c43fea1537004b69e1d7b7897af22e7813f4a86f4a53fa44263d3998bfef3a25 | Medium | Score 53/100 | First seen |
| SHA256 | 471e5e26a0e0796e79e0ef09a0565b7e50c3ff39da0ba42a45c35dcc3922dc2c | Medium | Score 53/100 | First seen |
| SHA256 | 8ac118cc76584487b7f71d91fee2c344a7e33ee8043043920895e9851fa257e2 | Medium | Score 53/100 | First seen |
| SHA256 | 996df9ce30ace63c0c516cbacfa4e308b555a2d2c44c9d6550b543b9fccc845d | Medium | Score 53/100 | First seen |
| URL | https://www.alphafly-drones.com/downloads/AlphaFlyInstallV1-2.msi | High | Score 58/100 | First seen |
| SHA256 | 88ebed34ab9ff0e16dc32b789fc25295ea570f86244e89cb68803c517597cfdd | Medium | Score 53/100 | First seen |
| URL | https://syncheaven.online/sync/now/ru/moscow/fetch | High | Score 58/100 | First seen |
| SHA256 | 5058b50371a666a585e2438b113825ea07a525b1fe3529a6988e2416d5b4e89d | Medium | Score 53/100 | First seen |
| SHA256 | 9292fae9b63203cdc0cb204b53314d056e01fc760707dcaa89e66e43d688b25e | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…