Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
29 IOCs
Warlock Ransomware Attackers Hit Water and Telecom Operators
Threat Actors
Malware Families
Excerpt
Warlock Ransomware Attackers Hit Water and Telecom Operators | SECURITY.COM Skip to main content Threat Intelligence Feature Stories Expert Perspectives Tech Insights Threat Updates Podcasts Events Broadcom Home Warlock Ransomware Attackers Hit Water and Telecom Operators China-nexus group behind Warlock is still exploiting SharePoint vulnerabilities, attacking organizations in Portuguese and Spanish-speaking countries, hitting critical infrastructure, government, and…
Read the original report →Diamond Model
Adversary(4)
Infrastructure(5)
Capability(9)
Victim
Indicators of Compromise
Open the mindmap →29 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | https://litter.catbox.moe/6f5tdt.msi | High | Score 58/100 | First seen |
| CVE | CVE-2025-49704 | High | Score 82/100 | First seen |
| CVE | CVE-2025-1055 | Medium | Score 56/100 | First seen |
| SHA256 | 73c5268256c9da5488cd9e2b79013060ac321c7e54129344dc7b51e268af36ea | Medium | Score 53/100 | First seen |
| SHA256 | 206f27ae820783b7755bca89f83a0fe096dbb510018dd65b63fc80bd20c03261 | High | Score 82/100 | First seen |
| SHA256 | ae9f7fce57c7b928e659dccf0e00fa79cd9cd61a106f18d4e03f92dc3a03c295 | High | Score 68/100 | First seen |
| SHA256 | aaff04d84ef85353966aa4af186ff1254b72c068f33f802417b29dc23fb9f192 | Medium | Score 53/100 | First seen |
| SHA256 | c46825fcc0d1bf7a8b192facb176d6bf916c9dccfd6fa994be691e3b0e585f4e | Medium | Score 53/100 | First seen |
| SHA256 | 8ce8d8270ee9de02644530b8dd7fa78973b4a3b80f121e2c5f45ae68cce196f9 | Medium | Score 53/100 | First seen |
| SHA256 | 8b58f7811a2a2f2a5024220490473774f02759dd2dd904b5b9fabfbaae37125f | Medium | Score 53/100 | First seen |
| URL | https://xn8xyt-drop.s3.wasabisys.com/xn8xyt.msi | High | Score 58/100 | First seen |
| SHA256 | f7269f80f81e99d06a590d7ab374e12fdf7e5f55a02c2a46c342d670f8519fdf | Medium | Score 53/100 | First seen |
| SHA256 | 37f94fe1b4a106f02b6f74a69cbc05e69c17406f688beef4c9a045ffcbd2e65e | Medium | Score 53/100 | First seen |
| SHA256 | e14240bac8277b0f6dd4d29ab5da20d246bcccae647e5fe8d19cdae7fe471b20 | Medium | Score 53/100 | First seen |
| SHA256 | e3204b05e2f3a29bb6e6fcc21dda77d7cd31dfa755c21da0aa8661b5619ee0a1 | Medium | Score 53/100 | First seen |
| CVE | CVE-2025-53770 | High | Score 79/100 | First seen |
| Domain | oastify.com | Low | Score 35/100 | First seen |
| SHA256 | 155fb1cbdaea12c83ba92d18c88cf38bbc42bb684f913ca0bc26fcf115426a55 | Low | Score 38/100 | First seen |
| SHA256 | fb3846c9ac53d1b841ada3a6b1091153fea41a169cb44fe0084097d1f4d45984 | Low | Score 38/100 | First seen |
| CVE | CVE-2025-49706 | High | Score 82/100 | First seen |
| SHA256 | 9ceb01f8bf7d6dba2ae07f5bd6070de3ec67b5eb01f969b0ba85e74564fb83a7 | Low | Score 38/100 | First seen |
| SHA256 | 6d07f1232dc59b84038fd0b2e75fdd3d5b825882bb0dba9e6724b7b0823fa3ad | Medium | Score 53/100 | First seen |
| SHA256 | 27b7591cf9e1283010ca98fa5dbe970a73fee0d8cde277639924c144718db7c0 | Medium | Score 53/100 | First seen |
| SHA256 | eea631b5f7125239db0811e4682c2316ead69f9822e02d94fb5d8bf0d2faebed | Medium | Score 53/100 | First seen |
| Domain | wasabisys.com | Low | Score 27/100 | First seen |
| Domain | catbox.moe | High | Score 63/100 | First seen |
| SHA256 | 1edb2c0b537cd95bbd5fc16321b4c38a6adf325ccc7b588ad6acc980b0463b60 | Medium | Score 53/100 | First seen |
| SHA256 | 116ca4e88a1bcebb6c0da7fb431c8eca7b8ef3f9767194820c56091972ccac2c | Low | Score 36/100 | First seen |
| CVE | CVE-2025-53771 | High | Score 82/100 | First seen |
IOC Relationship Graph
Building graph…