INDICATOR1 SOURCE
URL https://attack.mitre.org/techniques/T1587/004
Indicator published by the cited source.
Collected 2026-10-08 08:04 UTCOpen evidence recordÆ / PUBLIC MALWARE INTELLIGENCE
Follow the evidence.
Published file metadata, source observations and research history in one connected catalog.
131,398Catalog records
62,804File records
147,419Source observations
123Family labels
131,398 MATCHING RECORDS
INDICATOR1 SOURCE
URL https://web.archive.org/web/20220527112908/https://www.riskiq.com/blog/labs/ukraine-malware-infrastructure/
Indicator published by the cited source.
Collected 2026-10-08 08:04 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://us-cert.cisa.gov/ncas/tips/ST05-016
Indicator published by the cited source.
Collected 2026-10-08 08:04 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem
Indicator published by the cited source.
Collected 2026-10-08 07:34 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://us-cert.cisa.gov/ncas/alerts/aa20-258a
Indicator published by the cited source.
Collected 2026-10-08 08:04 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf
Indicator published by the cited source.
Collected 2026-10-08 08:04 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://threatconnect.com/blog/infrastructure-research-hunting/
Indicator published by the cited source.
Collected 2026-10-08 08:04 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://attack.mitre.org/techniques/T1499/004
Indicator published by the cited source.
Collected 2026-10-08 08:04 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://recsecas.com/controlserver/checkupdate.js
Indicator published by the cited source.
Collected 2026-10-08 08:04 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://unit42.paloaltonetworks.com/examining-vba-initiated-infostealer-campaign/
Indicator published by the cited source.
Collected 2026-10-08 08:04 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://recsecas.com/controlserver/saveMessage
Indicator published by the cited source.
Collected 2026-10-08 08:04 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://attack.mitre.org/techniques/T1564/008)).(Citation:
Indicator published by the cited source.
Collected 2026-10-08 08:04 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://attack.mitre.org/techniques/T1212
Indicator published by the cited source.
Collected 2026-10-08 08:04 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://www.mdsec.co.uk/2017/07/categorisation-is-not-a-security-boundary/
Indicator published by the cited source.
Collected 2026-10-08 08:04 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954
Indicator published by the cited source.
Collected 2026-10-08 07:34 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://attack.mitre.org/techniques/T1204)).(Citation:
Indicator published by the cited source.
Collected 2026-10-08 08:04 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://attack.mitre.org/techniques/T1611
Indicator published by the cited source.
Collected 2026-10-08 07:34 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://attack.mitre.org/techniques/T1588/006
Indicator published by the cited source.
Collected 2026-10-08 08:04 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://attack.mitre.org/techniques/T1210
Indicator published by the cited source.
Collected 2026-10-08 06:21 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://attack.mitre.org/techniques/T1584/004
Indicator published by the cited source.
Collected 2026-10-08 08:04 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://docs.microsoft.com/en-us/powershell/module/exchange/email-addresses-and-address-books/get-globaladdresslist
Indicator published by the cited source.
Collected 2026-10-08 06:21 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://blog.sygnia.co/luna-moth-false-subscription-scams
Indicator published by the cited source.
Collected 2026-10-08 08:04 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://blog.talosintelligence.com/2022/03/transparent-tribe-new-campaign.html
Indicator published by the cited source.
Collected 2026-10-08 08:04 UTCOpen evidence recordINDICATOR1 SOURCE
URL https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf
Indicator published by the cited source.
Collected 2026-10-08 06:21 UTCOpen evidence recordSource labels and confidence are preserved. A filename or report mention alone does not establish that a file is malicious. Indicator observation dates describe the cited source; collection dates describe this catalog.