Indicators of Compromise

20.18.2.1

1.1.1.10

DE.AE

auth.log

20.12.6.1

20.15.4.2

20.18.3.1

89.125.244.33

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

38.60.214.92

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

f6f8e0d790645395188fc521039385b7c4f42fa8b426fd035f489f6cda9b5da1

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

http://83.229.126.195:8081/config.json

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

71.80.85.135

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

89.125.244.51

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

83.229.126.195

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

https://1a820b09-95ba-44eb-b350-417e8241b725-00-1lgwuuen9b77p.worf.replit.dev/download

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

1a820b09-95ba-44eb-b350-417e8241b725-00-1lgwuuen9b77p.worf.replit.dev

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

a820b09-95ba-44eb-b350-417e8241b725-00-1lgwuuen9b77p.worf.replit.dev

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

23.27.143.170

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

104.233.156.1

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

b0f51b098842cd630097b462aab0ec357e2c7824af37cca6d08165265da2c2d3

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

0ed72d52347bfe4a78afff8a6982a64050c8fc86d8957a20eeb3e0f3f5342ed0

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

17302d903baf182f94dc3be40ab1e0874dd0eb2ec5255bf9131fd53591efe925

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

18d77c9c5bbb5b9d5bdfd366fdfcf26bad9e64c63ca865fad711bcce8e3d5a80

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

5bc5998161056b7c8f70c9724d8a63abc7ff8c3843b91c30cffab0899e39b7f8

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

72f570ce97de3eaaffef33d90b0c337a153fc9690cc34ee207b557d868360060

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

7aa88a64a527ade7d93c20faf23b54f2ee33ad9b1246cdc2f8ded2ab639affb1

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

47.104.248.7

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

18821dbb53892d6faa14b1f063517a0302057290

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

cf127d66124c390ca0f0b42c6385c3c8

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

01e3dce00ea45829bd9f6a583004976ac63973a0

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

96fc528ca5e7d1c2b3add5e31b8797cb126f704976c8fbeaecdbf0aa4309ad46

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

38.181.52.89

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

e22d1b625ee309b60caf0252c5df7656

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

fece5b954e69b2c6a8d0a1029631a0d7

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

d0a851f0b871df60c73d2c7d3f55b031c45e4c2e

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

02654acfb21f83485393ba8b14bd8862b919b9ec966fc6768f6aac1338a45ee8

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

0c87871642f84e09e8d3fb23ec36bf55601323e31151a7017a85dbec929cf15d

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities

d75cb9920d1d3d280518ddccfe4789d2

Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities