Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Malware Families
Excerpt
XCTDH Adopts Hash Hiding | Ransom-ISAC Blog - Ransom-ISAC Skip to main content Suspected cyber incident? Get support → About Blog Partners Membership L.O.C.K. S.T.A.R. Threat Summit · Recordings Login Back to Blog Threat Intelligence 10 min read September 25, 2026 DPRK HashHiding Blockchain Ethereum XCTDH APT XCTDH Adopts Hash Hiding A blockchain-based C2 technique discovered in the XCTDH campaign's September 2026 evolution, where C2 addresses are steganographically…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →10 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 23.27.20.187 | High | Score 72/100 | First seen |
| Domain | drpc.org | High | Score 58/100 | First seen |
| Domain | publicnode.com | High | Score 58/100 | First seen |
| Domain | blastapi.io | High | Score 58/100 | First seen |
| URL | http://181.214.149.148:443/boot | High | Score 86/100 | First seen |
| URL | http://181.214.149.148 | High | Score 58/100 | First seen |
| MD5 | 33ff3edaf55a8e03dcbc7cb40d498a49 | Medium | Score 53/100 | First seen |
| URL | http://181.214.149.148:443 | High | Score 58/100 | First seen |
| IP | 181.214.149.147 | High | Score 58/100 | First seen |
| IP | 23.27.20.143 | High | Score 72/100 | First seen |
IOC Relationship Graph
Building graph…