Indicators of compromise worth hunting for. Every entry is tied to a public advisory or verified reporting, with the detection angle that matters: not just the indicator, but where to look for it. New entries land here as campaigns develop.
Follow this feed
Current indicators
| Indicator | Type | Related threat | Added |
|---|---|---|---|
| k0t campaign infrastructure and exploitation artifacts (Group-IB/NyxLab) | Network and endpoint | MeshCentral server mesh[.]buttruyen[.]com with agents hosted at agent[.]afahimsa[.]top; AdaptixC2 team server 64[.]94[.]85[.]14:4321/endpoint with listeners /update, /api/v1/check, and /uri.php; staging at 162[.]33[.]178[.]213:8888, sthyjk[.]com:8443, and alknene[.]shop; fake installer clear-thinking_61.92.4_INSTALL.exe; second beacon 168[.]100[.]11[.]99. Exploitation markers: FortiWeb requests to /api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi with a forged CGIINFO header impersonating prof_admin; new local admins with random eight-character usernames and passwords and trusted-host 0.0.0.0/0; GlobalProtect forged auth-override cookies submitted to /ssl-vpn/login.esp; scripts fortnew.py and exploit_2026_0257.py; persistence via MeshCentral, Atera, Teramind, AnyDesk, and AdaptixC2; exfiltration via Rclone to Wasabi S3 and MEGA. Sources: Group-IB/NyxLab investigation (October 23, 2026); The Hacker News (October 23, 2026). | Oct 25, 2026 |
| Collabora CODE Server exploitation artifacts (CVE-2026-110447) | Network and endpoint | Requests to /apps/richdocumentscode/proxy.php, especially status checks and a remote_font_config.url value carrying encoded path traversal, shell substitution, or base64 payloads; unexpected PHP web shells on Nextcloud hosts; post-exploitation hunting for credential stores, password manager artifacts, and crypto wallets. Fix: richdocumentscode 26.4.303 or later, or remove the app (disabling it alone is insufficient; Nextcloud 29 and older cannot install the patched version). Sources: CISA KEV addition (October 23, 2026); The Hacker News (October 24, 2026); CollaboraOnline advisory GHSA-g3vx-3m76-fghh. | Oct 24, 2026 |
| BRONZE SANDCASTLE C2 domains and sideloading indicators (Sophos) | Network and endpoint | Version 1.1.5 backdoors reported to C2 domains dc[.]cathaypacifice[.]com and net[.]dpworldto[.]com; version 1.1.7 pulled encrypted configuration files from a GitHub repository that is no longer accessible. The loader chain places a malicious DLL (for example sbiedll.dll) next to a legitimate signed executable (for example SandboxieWUAU.exe) plus an encrypted config.ini that is decrypted in memory at runtime. Hunt for DLLs reading local files followed by immediate in-memory execution, renamed signed executables, anomalous vssadmin.exe use, and access to ntds.dit. Source: Sophos research (October 20, 2026). | Oct 23, 2026 |
| Attacker IPs in VeloCloud Orchestrator CVE-2026-114625 exploitation | Network | 74[.]82[.]197[.]86 and 38[.]54[.]50[.]151: source IPs Arista observed in attacks exploiting the CVE-2026-114625 SQL injection zero-day in VeloCloud Orchestrator On-Prem. Block both at the perimeter, hunt VCO web access logs for unusual URL-like path components, encoded characters, and requests referencing local or internal services, and preserve web, application, database, and system logs before remediation. Sources: Arista Security Advisory 0199 (October 22, 2026); SecurityWeek (October 23, 2026). | Oct 23, 2026 |
| LiteLLM 1.107.0 malicious release (PyPI and Docker) | Software supply chain | litellm==1.107.0 on PyPI (installs between roughly 11:39 and 13:23 UTC on October 21, 2026) and Docker tags live until about 14:20 UTC carried a credential stealer and a remote code loader activated through Python startup hooks, firing even when the app never imports LiteLLM. The payload exfiltrates cloud credentials, developer secrets, and AI auth files, and on Proxy installs it queried the upstream provider-key table and pulled up to 500 keys. Any pull inside the window is a compromise indicator: treat the host or CI runner as burned and rotate every secret it could see. Last safe version: 1.106.2. Sources: BerriAI incident report; Socket (October 21, 2026). | Oct 22, 2026 |
| Compromised eMudhra/emSign intermediate CA certificates | Certificate | Eight eMudhra intermediates carried trivially recoverable P-384 private keys from an April 30, 2025 key ceremony: one key was literally the number 4. The TLS-issuing six are EM DV TLS CA - G3B, EM DV TLS CA - G3C, EM OV TLS CA - G3B, EM OV TLS CA - G3C, EM EV TLS CA - G3B, and EM EV TLS CA - G3C; the code-signing two are EM OV CS CA - G3B and EM OV CS CA - G3C, all chaining to emSign ECC Root CA - G3 (also cross-signed by Sectigo). Chrome and Firefox blocked them within hours of the October 17, 2026 report, Apple on October 19, and Microsoft on October 20; Mozilla removed the root on October 20. Hunt the names in non-browser trust stores: containers, runtimes, appliances, Go binaries, and CI tooling. Sources: Cloudflare incident write-up; Mozilla dev-security-policy thread (October 17, 2026). | Oct 22, 2026 |
| Attacker IPs tied to PAN-OS CVE-2026-0322 exploitation | Network | 149[.]248[.]47[.]234, 208[.]83[.]239[.]114, and 66[.]42[.]72[.]14: malicious activity tied to active exploitation of the PAN-OS management-interface RCE (CVE-2026-0322) on PA-Series, VM-Series, and Panorama appliances. F5 Labs recommends blocking all three at the network edge and scanning firewall and network logs for historical connections to or from them. Source: F5 Labs Weekly Threat Bulletin (October 21, 2026). | Oct 22, 2026 |
| SafePay ransomware IP infrastructure (joint advisory AA26-293A) | Network | 104.26.2[.]223, 140.82.114[.]4, 185.199.108[.]133, and 77.37.49[.]40 seen in victim intrusions; 173.194.194[.]94 hosted victim data; 167.235.225[.]149 hosted client login panels; 5.255.11[.]134 and 37.10.71[.]188 used in exfiltration; 88.119.167[.]239 used as soc.dll command and control. Observed November 2024 to August 2026; investigate before blocking. Source: CISA #StopRansomware advisory AA26-293A (October 20, 2026). | Oct 21, 2026 |
| SafePay ransomware SHA-1 and SHA-256 file hashes (joint advisory AA26-293A) | Hash | SHA-1 07353237350c35d6dc2c8f143b649cd07c71f62b (1.exe ransomware binary); SHA-256 921df888aaabcd828a3723f4c9f5fe8b8379c6b7067d16b2ea10152300417eae (soc.dll); SHA-256 BBDD3620A67AEDEC4B9A68B2C9CC880B6631215E129816AEA19902A6F4BC6F41 (SharpShares.exe). Feed these to your EDR blocklists and hunt historical detections. Source: CISA #StopRansomware advisory AA26-293A (October 20, 2026). | Oct 21, 2026 |
| PAN-OS CVE-2026-0257 exploitation IPs and host IDs (Qilin / INC / Settra) | Network | Unit 42 published attacker IPs 23.128.228[.]6, 104.207.144[.]154, 146.19.216[.]119, 146.19.216[.]120, 146.19.216[.]125, 179.43.172[.]213, 185.195.232[.]139, 198.12.106[.]60, and 202.144.192[.]47 used against GlobalProtect, plus suspicious host IDs aa:bb:cc:dd:ee:ff, 00:11:22:33:44:55, WINDOWS-LAPTOP-001, and DESKTOP-GP01 in successful gateway-connected events. Search GlobalProtect logs for both. Source: Palo Alto Networks Unit 42 threat brief (updated October 19, 2026). | Oct 21, 2026 |
| ARMORY CASTLE file and URI artifacts on BeyondTrust Remote Support appliances (CVE-2026-102764) | File / URI | mangoapi.php in the appliance web root (SAWFLY web shell marker); /usr/bin/dbus-authd, a SUID copy of /bin/sh for root; the zz-root-persist boot script in /home/bomgar/sbin/post_boot.d/; the /uidchanarge URI path added to the HAProxy configuration (BARECLAW tunnel marker); modifications to /ns/config/sudoers.template granting passwordless sudo. ARMORY CASTLE deletes appliance logs after use, so hunt with these on-disk artifacts rather than trusting a clean log history. Source: Google Threat Intelligence Group indicators, reported October 19, 2026. | Oct 20, 2026 |
| The Seven Deadly Sins SaaS-vendor pivot via shared integrations (Canny to Salesforce) | Behavioral | TSDS compromises a third-party SaaS vendor, then pivots into customer environments through the vendor's standing integrations. In the Canva case the group hit feedback platform Canny on August 28, 2026, spent two weeks exporting from its Jira, Salesforce, Okta, and HubSpot integrations, then claims 72+ hours inside Canva's Salesforce with full admin access. Hunt for OAuth grants and API tokens held by feedback, support, and survey tools that reach your CRM. Sources: DataBreaches.net (September 23, 2026), Cyber Daily (October 18-19, 2026). | Oct 19, 2026 |
| UTA0576 attacker infrastructure IP (Ivanti Connect Secure exploitation) | Network | 108.165.147[.]64 observed as attacker-controlled infrastructure in the investigated UTA0576 intrusion on a fully patched Connect Secure appliance (Volexity). Source: OP Innovate writeup of Volexity's UTA0576 research (October 14, 2026). | Oct 18, 2026 |
| UTA0576 exploitation endpoint and routing header (Ivanti Connect Secure) | URL | /dana-na/auth/url_default/welcome.cgi repeatedly targeted as the public entry point; the X-DSCGI-PATH header manipulated to route requests to arbitrary CGI files and bypass authentication. Source: OP Innovate writeup of Volexity's UTA0576 research (October 14, 2026). | Oct 18, 2026 |
| UTA0576 post-exploitation artifacts on Connect Secure appliances | File path | /data/.icscap/ directory associated with packet capture and credential harvesting; /tmp/ml.py and /tmp/rq5.py (LDAP tooling); /tmp/mk.py and /tmp/rr.py (Kerberos tooling). Source: OP Innovate writeup of Volexity's UTA0576 research (October 14, 2026). | Oct 18, 2026 |
| UTA0576 in-memory tradecraft and anti-forensics (Ivanti) | Behavioral | No malware or web shells deployed: the actor re-exploits the appliance for every command, manipulates in-memory libraries, reverts configuration changes, and selectively deletes log entries. Evades Ivanti's Integrity Checker Tool. Post-exploitation behavior: password spraying, Active Directory queries, and LAPS password and BitLocker recovery key hunting. Source: Volexity via OP Innovate (October 14, 2026). | Oct 18, 2026 |
| PEERSTITCH network indicators: attacker infrastructure IPs, stager URLs, ACME abuse endpoints, and traffic markers | Network | IPs 23.240.77[.]233 (installer and malware hosting, ACME C2), 47.18.167[.]159 (installer hosting), 45.32.41[.]202 and 198.199.122[.]22 (rogue FortiGate registrations with FortiManager). Stager URLs hxxp[:]//23.240.77[.]233:8085/pM.js and hxxp[:]//47.18.167[.]159:8085/pM.js. ACME abuse on port 8084 (/directory, /acme/new-acct, /acme/order/11111, /acme/authz/1, /acme/finalize/...). Traffic markers: TCP port 8550 embedded in traffic data and IP 169.254.0.1 used for session tagging. Source: Palo Alto Networks Unit 42 report on the PEERSTITCH campaign (October 14, 2026), tied to CVE-2025-61624. | Oct 17, 2026 |
| PEERSTITCH implant file hashes (SHA-256) | File hash | b9fb0b27ddd59b58d3ae53c7227298a3e0de1e6f868b9429ae21533bb9cd1e70 (ARM64 ELF injector), 829b1cd270b30565739a478441833f49f10a49bd06f0d18cc96c8ae4a0431f11 (ARM64 mmap shellcode bootstrap), bd064244dad748cf2a44074bee56f5bfab4a2b18ee944b75d1b3febd4c1fe02a (core hook injection data block), 9c4c4436ff5cdf0d6d68f5108031cbf3708a095cde4ef8c09316af7a7110437e (staging and preparation script), fc1b10c58057ef9f1f9a1e2a3d4a1c89f43b0ead451398c70ed7a6e0312b36ee (Node.js deployment orchestrator), f84eea718526706afdf2d1a2774fab76ecb11c18fb61995a37be8249c5e379ab (Emscripten JavaScript runtime), b7ae166fd49a7ecfe6322a80b8aa56d6aa0825d8f5d106dab2e4fb7d14ce15a8 (Emscripten WebAssembly module), 8d969eef6ecad3c29a3a629280e686cf0c3f5d5a86aff3ca12020c923adc6c92 (runtime shared-secret artifact). Source: Unit 42 (October 14, 2026). | Oct 17, 2026 |
| PEERSTITCH anti-forensics and persistence behaviors on FortiGate appliances | Behavioral | Rogue FortiGate registered with FortiManager under the name "localhost"; unexpected auto-script object named ../../..//setup; native Apache mod_md module abused to spawn SSH-based reverse shells; syslog generation terminated, crash logs cleared, logging telemetry disrupted, and rogue administrator accounts plus auto-script objects auto-deleted after execution. Source: Palo Alto Networks Unit 42 (October 14, 2026). | Oct 17, 2026 |
| ARMORY CASTLE tooling on BeyondTrust Remote Support appliances (CVE-2026-102764) | Behavioral | SAWFLY obfuscated PHP web shell with encrypted command traffic; unexpected root SUID shell copies; boot script granting passwordless sudo for persistence across restarts; BARECLAW SOCKS5-over-WebSocket tunneler routed through the appliance HAProxy configuration; Jump Item roles raised to Administrator in the admin portal; appliance log deletions and attempted secrets vault dumps. The actor has historically rotated infrastructure per victim, so behavior is the detection angle, not IPs. Source: Mandiant / Google Threat Intelligence Group (October 16, 2026). | Oct 17, 2026 |
| Rank Math SEO PRO compromise: C2 domain, rogue accounts, and persistence markers | Mixed | C2 domain rank1cdn[.]com; three malicious wp_options database keys; unauthorized administrator accounts; unexpected PHP-executable .cache files; a fake WordPress core file; and a system cron marker. Tied to trojanized Rank Math SEO PRO 3.0.123 packages served October 15, 2026 20:02 UTC through October 16, 2026 07:12 UTC. Source: vendor and Wordfence reporting via securityonline.info (October 17, 2026). | Oct 17, 2026 |
| Device-code phishing sign-ins and app-only authentication consent grants in Entra ID, plus tenants rebuilt on expired organization names | Behavioral | Storm-3119 / Storm-2990 hunt angles from the Microsoft-led takedown (October 14-15, 2026): the YAM Store kits used device-code phishing to steal tokens, fake CAPTCHA gates, and app-only auth with stolen client secrets that persists across user password resets. Hunt sign-in logs for device-code flow abuse and audit app consent grants; investigate tenants that reuse expired organization identities to look legitimate. | Oct 16, 2026 |
| Inbound voice or Teams calls requesting credential or access changes, followed by unusual file access on healthcare systems | Behavioral | COPC vishing angle (breach acknowledged October 15, 2026): the attacker posed as a trusted source to reach files holding protected health information, with no malware involved. The Chaos ransomware group's claimed credit is UNVERIFIED. Hunt for helpdesk requests that moved access or credentials without call-back verification, and correlate Teams voice contact with subsequent data access. | Oct 16, 2026 |
System Security: Suspected compromise indicator was found and System Security: Security scan did not complete alerts on SEG appliances |
Behavioral | Cisco Secure Email Gateway self-check alerts for the CVE-2026-76519 zero-day (Cisco advisory, Oct 14, 2026). The first means Cisco found a compromise indicator: contact TAC and follow the advisory's remediation steps, including credential and crypto material rotation. The second means the check could not finish: do not read it as clean, engage TAC as well. | Oct 15, 2026 |
| Unusual uploads or downloads between SEG appliances and external or suspicious IPs in firewall and network logs | Behavioral | CVE-2026-76519 hunt angle: Cisco warns attackers may remove exploitation evidence after gaining root, so the network trail matters more than the box. Cross-check firewall and network logs for odd traffic around your SEG appliances; Shadowserver counts nearly 300 SEG instances exposed online. | Oct 15, 2026 |
Threat IDs 510046 and 510047 firing (Threat Prevention content 9159-10287+; requires SSL decryption), plus unexplained authenticated sessions on PAN-OS management interfaces |
Behavioral | PAN-OS CVE-2026-0322 detection (Palo Alto Networks advisory, Oct 14, 2026). Very limited exploitation observed so far. Audit management-plane logs for sessions from untrusted IPs and confirm the management interface is restricted to trusted internal addresses. | Oct 15, 2026 |
108.165.147.64 (Evoxt VPS; OpenVPN server observed Sept 30-Oct 7, 2026) |
IP | UTA0576: operator host for the Ivanti Connect Secure zero-day campaign (Volexity, Oct 13, 2026). Hunt for outbound connections to this address, especially from VPN or edge appliances. | Oct 14, 2026 |
/tmp/ml.py, /tmp/rq5.py, /tmp/mk.py, /tmp/rr.py, /tmp/pu.txt, sp_out.txt, spray_hits.json |
File | UTA0576: custom LDAP, Kerberos (Kerberoast-capable), and password-spraying tooling on compromised Ivanti Connect Secure appliances. Sweep /tmp on any internet-facing ICS box; results were written out as zlib-compressed, Base64-encoded JSON. | Oct 14, 2026 |
Hidden directory /data/.icscap/ containing dsstatmond (renamed tcpdump) and capture files cap* (e.g. cap0), plus /data/.icscap/h.py |
Behavioral | UTA0576: packet-capture credential harvesting on Ivanti Connect Secure. dsstatmond sniffs LDAP, HTTP, FTP, and telnet to steal credentials and NTLM material. Hunt for processes running from hidden directories and BPF socket filters on edge appliances. | Oct 14, 2026 |
Requests to /dana-na/auth/url_default/welcome.cgi carrying an X-DSCGI-PATH header that names a different script (e.g. wu.cgi or /home/runtime/tmp/... paths) |
Behavioral | UTA0576: the authentication-bypass exploit pattern behind CVE-2026-104935. Monitor for mismatches between the requested URL path and the X-DSCGI-PATH header; large bursts of welcome.cgi requests are worth a look. | Oct 14, 2026 |
/home/runtime/tmp/ics-root-run-inband-*.pl, /home/runtime/tmp/ics-root-result-inband-*; in-memory patching of /home/lib/libdsplibs.so (no disk change) |
Behavioral | UTA0576: root-stage privilege-escalation payloads on Ivanti Connect Secure. The in-memory-only patching defeats Ivanti's Integrity Checker Tool, so a clean result does not rule out compromise. Suspect devices need memory and network forensics. | Oct 14, 2026 |
Selective deletion of recent entries from /home/runtime/dlogs/debuglog and /var/log/audit/audit.log |
Behavioral | UTA0576: anti-forensic log tampering on Ivanti Connect Secure. Look for gaps or truncated audit windows on ICS appliances; missing history is itself a signal. | Oct 14, 2026 |
c0cc.cc, 98aicai.com, 98aicode.com, outlook3650.com, youtubecard.com, linkedinns.net, 98aiblog.com |
Domain | Flax Typhoon / Integrity Technology Group: seized by FBI Oct 8, 2026 (MicroScan scanner and FishHub phishing infrastructure; several mimic Microsoft, LinkedIn, YouTube branding) | Oct 12, 2026 |
SoftEther VPN installers renamed to conhost.exe or dllhost.exe |
Behavioral | Flax Typhoon / Integrity Technology Group (persistence mechanism) | Oct 12, 2026 |
DiagTrack.exe making outbound HTTP connections |
Behavioral | Flax Typhoon / Integrity Technology Group | Oct 12, 2026 |
DC.exe / office-cli artifacts on endpoints |
Behavioral | Flax Typhoon / Integrity Technology Group | Oct 12, 2026 |
SITE CPFR / SITE CPTO commands in FTP logs on ProFTPD servers with mod_copy enabled |
Behavioral | Integrity Technology Group / Flax Typhoon (CVE-2015-3306) | Oct 11, 2026 |
| Internet-facing Apache Struts instances with Dynamic Method Invocation enabled | Exposure | Integrity Technology Group / Flax Typhoon (CVE-2016-3081) | Oct 11, 2026 |
| TKEY query spikes against ISC BIND resolvers | Behavioral | Integrity Technology Group / Flax Typhoon (CVE-2015-5477) | Oct 11, 2026 |
| Password spraying patterns against Microsoft Exchange login endpoints | Behavioral | Integrity Technology Group / Flax Typhoon | Oct 11, 2026 |
Sources: Volexity blog "A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days" (October 13, 2026) on the UTA0576 campaign; CISA/FBI/NSA joint cybersecurity advisory AA26-281A (October 8, 2026) on Integrity Technology Group-enabled threat activity; FBI domain seizures reported October 8, 2026. The seized domains now show FBI notices: hunt them in historical mail, proxy, and DNS logs rather than blocking live traffic. Today's additions come from Cisco Security Advisory cisco-sa-esa-afw-zqYJkjxp (October 14, 2026) and the Palo Alto Networks advisory for CVE-2026-0322 (October 14, 2026). The October 16 additions cover the Microsoft-led Storm-3119 / Storm-2990 phishing takedown and the Central Ohio Primary Care vishing breach (reported October 14-15, 2026). Today's additions cover the PEERSTITCH campaign and CVE-2025-61624 (Palo Alto Networks Unit 42, October 14, 2026), the ARMORY CASTLE exploitation of the BeyondTrust zero-day (Mandiant / Google Threat Intelligence, October 16, 2026), and the Rank Math SEO PRO supply-chain compromise (October 17, 2026). The October 18 additions cover the UTA0576 campaign against Ivanti Connect Secure (Volexity research via the OP Innovate writeup, October 14, 2026). The October 19 additions cover the Canva third-party data incident and The Seven Deadly Sins group's SaaS-vendor pivot methodology (Cyber Daily, October 18-19, 2026; DataBreaches.net, September 23, 2026). The October 20 additions cover the ARMORY CASTLE file and URI artifacts for BeyondTrust Remote Support (Google Threat Intelligence Group indicators, reported October 19, 2026). The October 21 additions cover the SafePay ransomware joint advisory AA26-293A IP and hash indicators (CISA/FBI joint advisory, October 20, 2026) and the Unit 42 indicators for ransomware exploitation of PAN-OS CVE-2026-0257 (updated October 19, 2026). The October 22 additions cover the LiteLLM 1.107.0 malicious release window (BerriAI; Socket, October 21, 2026), the compromised eMudhra/emSign intermediate CAs (Cloudflare; Mozilla, reported October 17, 2026), and the attacker IPs tied to PAN-OS CVE-2026-0322 exploitation (F5 Labs, October 21, 2026). The October 23 additions cover the BRONZE SANDCASTLE campaign C2 and sideloading indicators (Sophos, October 20, 2026) and the attacker IPs in VeloCloud Orchestrator CVE-2026-114625 exploitation (Arista Security Advisory 0199, October 22, 2026). The October 24 additions cover the Collabora CODE Server exploitation artifacts (CISA KEV addition, October 23, 2026; The Hacker News, October 24, 2026). The October 25 additions cover the k0t campaign infrastructure and exploitation artifacts (Group-IB/NyxLab investigation, October 23, 2026; The Hacker News, October 23, 2026). Validate every indicator against your own environment before blocking: indicators age fast, and context is everything.
How this library works
Entries come from public government advisories, vendor threat reports, and my own analysis. Each one includes the detection angle, not just the raw indicator, because an IoC without hunt guidance is trivia. The library grows as new campaigns are documented.