Indicators of Compromise

Domain

TLP:CLEAR

krebsonsecurity.com

50% confidence

Added

2026-08-09

Email Address

TLP:CLEAR

tmarshall@terrellmarshall.com

50% confidence

Added

2026-08-09

Email Address

TLP:CLEAR

bterrell@terrellmarshall.com

50% confidence

Added

2026-08-09

Email Address

TLP:CLEAR

brant@fairworklaw.com

50% confidence

Added

2026-08-09

Email Address

TLP:CLEAR

hillary@fairworklaw.com

50% confidence

Added

2026-08-09

Email Address

TLP:CLEAR

james@ferrarolaw.com

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

Globalnews.ca

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

250203.mbx

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

www.inforisktoday.com

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

haveibeenpwned.com

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

EQUITYEXPERTS.ORG

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

Todayonline.com

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

www.bankinfosecurity.com

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

Verifications.io

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

GROUNDGAME.HEALTH

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

BLOCKCHAIN.COM

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

apps.web.maine.gov

50% confidence

Added

2026-08-09

IPv4 Address

TLP:CLEAR

103.241.66.238

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

www.hackersvella.org

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

REG.RU

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

PacerMonitor.com

50% confidence

Added

2026-08-09

IPv4 Address

TLP:CLEAR

31.31.198.206

50% confidence

Added

2026-08-09

URL

TLP:CLEAR

https://fanonlyatn.xyz/api_address_match.php

TwizAdmin -- Multi-Stage Crypto Clipper, Infostealer & Ransomware Operation

75% confidence

Added

2026-05-26

URL

TLP:CLEAR

https://fanonlyatn.xyz/api.php

TwizAdmin -- Multi-Stage Crypto Clipper, Infostealer & Ransomware Operation

75% confidence

Added

2026-05-26

Domain

TLP:CLEAR

www.fanonlyatn.xyz

TwizAdmin -- Multi-Stage Crypto Clipper, Infostealer & Ransomware Operation

75% confidence

Added

2026-05-26

Domain

TLP:CLEAR

secure-shard-091.of-cdn.com

TwizAdmin -- Multi-Stage Crypto Clipper, Infostealer & Ransomware Operation

75% confidence

Added

2026-05-26

URL

TLP:CLEAR

https://mekhovaya-shuba.ru/crpx0/notify.php

TwizAdmin -- Multi-Stage Crypto Clipper, Infostealer & Ransomware Operation

75% confidence

Added

2026-05-26

URL

TLP:CLEAR

https://fanonlyatn.xyz/builds/

TwizAdmin -- Multi-Stage Crypto Clipper, Infostealer & Ransomware Operation

75% confidence

Added

2026-05-26

URL

TLP:CLEAR

https://fanonlyatn.xyz/api_dropper_log.php

TwizAdmin -- Multi-Stage Crypto Clipper, Infostealer & Ransomware Operation

75% confidence

Added

2026-05-26

SHA-256 Hash

TLP:CLEAR

74ab520e94b2f3b8915ec7b47abab7a2d7e9759add5aa195af7edf0ffa5b4150

TwizAdmin -- Multi-Stage Crypto Clipper, Infostealer & Ransomware Operation

75% confidence

Added

2026-05-26

SHA-256 Hash

TLP:CLEAR

584796212f99efc7ac765d6048913fe34e46a64b13a8a78fb3a465b8c61f3527

TwizAdmin -- Multi-Stage Crypto Clipper, Infostealer & Ransomware Operation

75% confidence

Added

2026-05-26

SHA-256 Hash

TLP:CLEAR

3fcd267e811d9b83cafa3d8d6932fa1c56f4fd8dcf46f9ec346e0689439532d4

TwizAdmin -- Multi-Stage Crypto Clipper, Infostealer & Ransomware Operation

75% confidence

Added

2026-05-26

SHA-256 Hash

TLP:CLEAR

06299676b43749b8477c4bc977c09512957fc9b66fd5030c1874069632ce6092

TwizAdmin -- Multi-Stage Crypto Clipper, Infostealer & Ransomware Operation

75% confidence

Added

2026-05-26

URL

TLP:CLEAR

https://fanonlyatn.xyz

TwizAdmin -- Multi-Stage Crypto Clipper, Infostealer & Ransomware Operation

75% confidence

Added

2026-05-26

URL

TLP:CLEAR

https://fanonlyatn.xyz/files/

TwizAdmin -- Multi-Stage Crypto Clipper, Infostealer & Ransomware Operation

75% confidence

Added

2026-05-26

Domain

TLP:CLEAR

fanonlyatn.xyz

TwizAdmin -- Multi-Stage Crypto Clipper, Infostealer & Ransomware Operation

75% confidence

Added

2026-05-26

URL

TLP:CLEAR

https://caribb.ru/crpx0/notify.php

TwizAdmin -- Multi-Stage Crypto Clipper, Infostealer & Ransomware Operation

75% confidence

Added

2026-05-26

URL

TLP:CLEAR

https://beboss34.ru/crpx0/notify.php

TwizAdmin -- Multi-Stage Crypto Clipper, Infostealer & Ransomware Operation

75% confidence

Added

2026-05-26

URL

TLP:CLEAR

http://fanonlyatn.xyz/files/

TwizAdmin -- Multi-Stage Crypto Clipper, Infostealer & Ransomware Operation

75% confidence

Added

2026-05-26

SHA-256 Hash

TLP:CLEAR

f7ddba605e3d04e06d2f7b0fc4a38027ae58ca65a69d800dd2f43c8e94ca8396

TwizAdmin -- Multi-Stage Crypto Clipper, Infostealer & Ransomware Operation

75% confidence

Added

2026-05-26

SHA-256 Hash

TLP:CLEAR

aa11f154b17a4f81f951dbeaab78b58ea012f5b6ea16e4f894bd90971e01bae4

TwizAdmin -- Multi-Stage Crypto Clipper, Infostealer & Ransomware Operation

75% confidence

Added

2026-05-26

SHA-256 Hash

TLP:CLEAR

9d9783f57fd543043e0792d125831883259c823a5eaa69211e5254db4db4eaec

TwizAdmin -- Multi-Stage Crypto Clipper, Infostealer & Ransomware Operation

75% confidence

Added

2026-05-26