Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
WAF Defense in Crisis? NSFOCUS Locks Down “Ghost Bits” Attacks in Advance
Malware Families
Excerpt
Incident Review In April 2026, Black Hat Asia 2026 disclosed a systematic security threat named Ghost Bits , targeting underlying encoding flaws in the Java ecosystem that can render mainstream WAF/IDS defenses completely ineffective. The core of this risk lies in inconsistent encoding interpretations of the same input between the security detection chain and the application execution chain, which may result in the frontline protection judging the input as harmless while the…
Read the original report →Diamond Model
Adversary
Infrastructure
Capability(1)
Victim
Attack Flow4 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2024-36401 | Medium | Score 54/100 | First seen |
| CVE | CVE-2022-22965 | Medium | Score 51/100 | First seen |
IOC Relationship Graph
Building graph…