Indicators of Compromise

Domain

TLP:CLEAR

eclipse4g5kxfwsvpu4qx5sdcnrji6gxl5gt67bucjlgt35g7akvjoid.onion

TweetFeed: eclipse4g5kxfwsvpu4qx5sdcnrji6gxl5gt67bucjlgt35g7akvjoid.onion

55% confidence

Added

2026-08-12

URL

TLP:CLEAR

http://eclipse4g5kxfwsvpu4qx5sdcnrji6gxl5gt67bucjlgt35g7akvjoid.onion

TweetFeed: http://eclipse4g5kxfwsvpu4qx5sdcnrji6gxl5gt67bucjlgt35g7akvjoid.onion

55% confidence

Added

2026-08-12

SHA-256 Hash

TLP:CLEAR

3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac

50% confidence

Added

2026-08-12

URL

TLP:CLEAR

http:///patch|bash

50% confidence

Added

2026-08-12

Domain

TLP:CLEAR

DfndrPEBluHmr.BZ

50% confidence

Added

2026-08-12

URL

TLP:CLEAR

http:///policy

50% confidence

Added

2026-08-12

Filename

TLP:CLEAR

update.py

50% confidence

Added

2026-08-12

Filename

TLP:CLEAR

M365Copilot.exe

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

78.29.48.29

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

212.232.23.69

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

179.43.140.214

50% confidence

Added

2026-08-12

Filename

TLP:CLEAR

FunnyApp.exe

50% confidence

Added

2026-08-12

Filename

TLP:CLEAR

RedSun.exe

50% confidence

Added

2026-08-12

Filename

TLP:CLEAR

z.exe

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

154.223.16.34

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

38.180.41.251

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

203.160.86.91

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

45.121.51.2

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

38.60.218.153

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

185.108.105.110

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

146.70.192.174

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

149.88.27.212

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

38.180.128.159

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

64.176.226.203

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

38.180.106.167

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

173.255.223.159

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

199.119.206.28

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

149.28.194.95

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

78.141.232.174

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

126.227.76.24

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

38.207.148.123

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

147.45.70.100

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

38.181.70.3

50% confidence

Added

2026-08-12

Filename

TLP:CLEAR

agent.exe

50% confidence

Added

2026-08-12

Filename

TLP:CLEAR

undef.exe

50% confidence

Added

2026-08-12

Domain

TLP:CLEAR

staybud.dpdns.org

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

110.47.250.103

50% confidence

Added

2026-08-12

Filename

TLP:CLEAR

TieringEngineService.exe

50% confidence

Added

2026-08-12

IPv4 Address

TLP:CLEAR

213.146.64.10

70% confidence

Added

2026-08-06

Domain

TLP:CLEAR

vbsjxw.eclipsechasers.net

ThreatFox: ClearFake

85% confidence

Added

2026-08-01

Domain

TLP:CLEAR

eclipsechasers.net

ThreatFox: ClearFake

85% confidence

Added

2026-08-01

Domain

TLP:CLEAR

lunareclipse.monster

ThreatFox: Unknown malware

85% confidence

Added

2026-05-28

SHA-256 Hash

TLP:CLEAR

a2b6c7a9c4490df70de3cdbfa5fc801a3e1cf6a872749259487e354de2876b7c

Nightmare-Eclipse Tooling Seen in Real-World Intrusion

75% confidence

Added

2026-05-21

Domain

TLP:CLEAR

eclipsesquad.zapto.org

AppendixD_Extracted DC Configuration.csv

70% confidence

Added

2026-05-06

Domain

TLP:CLEAR

eclipse.a-inet.net

Imported via the freetext import.

50% confidence

Added

2026-05-06