Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
13 IOCs
Zero-Day Exploitation of Vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager
Excerpt
Written by: Chester Sng, Pete Boonyakarn, Logeswaran Nadarajan, Lukasz Lamparski Introduction In early 2026, Mandiant identified a threat actor targeting SD-WAN infrastructure at a service provider. After gaining initial access, the threat actor exploited a zero-day vulnerability ( CVE-2026-20245 ) in Cisco Catalyst SD-WAN to escalate privileges from a compromised administrative account to root-level access. The vulnerability stems from the device’s file upload feature…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →13 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 126.51.108.152 | High | Score 61/100 | First seen |
| IP | 45.32.38.160 | High | Score 61/100 | First seen |
| SHA256 | d966161b93100fb8905b9b81bd03e57bbc93f21534acee88999e77798e913d5b | Medium | Score 53/100 | First seen |
| IP | 209.137.225.101 | High | Score 61/100 | First seen |
| IP | 153.186.231.233 | High | Score 61/100 | First seen |
| IP | 76.92.245.217 | High | Score 61/100 | First seen |
| CVE | CVE-2026-20245 | High | Score 78/100 | First seen |
| IP | 207.190.37.94 | High | Score 61/100 | First seen |
| IP | 23.245.7.178 | High | Score 61/100 | First seen |
| CVE | CVE-2026-20182 | High | Score 77/100 | First seen |
| IP | 167.179.79.189 | High | Score 61/100 | First seen |
| CVE | CVE-2026-20127 | High | Score 72/100 | First seen |
| SHA256 | b82936f37648518425c7d3cf9e09eaffa41d7cdb3840f6a40287e3a108880f7b | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…