Indicators of Compromise

Domain

TLP:CLEAR

scripts.ini

50% confidence

Added

2026-08-10

Domain

TLP:CLEAR

exfil.tar.zst

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

meshagent64-azure-ops.exe

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

meshagent64-v2.exe

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

agent.ashx

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

meshctrl.js

50% confidence

Added

2026-08-09

Filename

TLP:CLEAR

meshagent32-azure-ops.exe

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

psappsrv.cfg

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT

50% confidence

Added

2026-08-09

Domain

TLP:CLEAR

Dave.com

50% confidence

Added

2026-08-09

IPv4 Address

TLP:CLEAR

179.43.185.226

A New Name in the Data Extortion Ecosystem?

75% confidence

Added

2026-07-23

IPv4 Address

TLP:CLEAR

179.43.171.42

A New Name in the Data Extortion Ecosystem?

75% confidence

Added

2026-07-23

Domain

TLP:CLEAR

oskeysync.com

A New Name in the Data Extortion Ecosystem?

75% confidence

Added

2026-07-23

IPv4 Address

TLP:CLEAR

179.43.185.230

A New Name in the Data Extortion Ecosystem?

75% confidence

Added

2026-07-23

IPv4 Address

TLP:CLEAR

212.86.125.24

Defending SaaS-based applications against ShinyHunters OAuth abuse

75% confidence

Added

2026-07-14

IPv4 Address

TLP:CLEAR

213.111.148.90

Defending SaaS-based applications against ShinyHunters OAuth abuse

75% confidence

Added

2026-07-14

IPv4 Address

TLP:CLEAR

94.154.32.160

Defending SaaS-based applications against ShinyHunters OAuth abuse

75% confidence

Added

2026-07-14

IPv4 Address

TLP:CLEAR

138.226.246.94

Defending SaaS-based applications against ShinyHunters OAuth abuse

75% confidence

Added

2026-07-14

URL

TLP:CLEAR

https://www.linkedin.com/posts/shinyhunters-share-7471278410099679232-AINn/

70% confidence

Added

2026-07-14

SHA-256 Hash

TLP:CLEAR

68257a6f9ff196179ec03624e849927f26599eb180a7c82e14ef5bc4e93bc309

Targets Education Sector with Oracle PeopleSoft Exploit

75% confidence

Added

2026-07-12

SHA-256 Hash

TLP:CLEAR

f02a924c9ff92a8780ce812511341182c6b509d45bc59f3f7b522e37225d24fc

Targets Education Sector with Oracle PeopleSoft Exploit

75% confidence

Added

2026-07-12

SHA-256 Hash

TLP:CLEAR

d83fdb9e53c5ff03c4cb0451ea1bebd79b53f29eadc1e2fa394c7af13a86ce2f

Targets Education Sector with Oracle PeopleSoft Exploit

75% confidence

Added

2026-07-12

MD5 Hash

TLP:CLEAR

ebcf977806f68af3147e0b78b55f6aed

Targets Education Sector with Oracle PeopleSoft Exploit

75% confidence

Added

2026-07-12

SHA-256 Hash

TLP:CLEAR

c7e9332731b06644fc73e0046a2a89eaa59b09f54250e9bd622467187351711f

Targets Education Sector with Oracle PeopleSoft Exploit

75% confidence

Added

2026-07-12

URL

TLP:CLEAR

http://azurenetfiles.net:443/agent.ashx

Targets Education Sector with Oracle PeopleSoft Exploit

75% confidence

Added

2026-07-12

Domain

TLP:CLEAR

azurenetfiles.net

Targets Education Sector with Oracle PeopleSoft Exploit

75% confidence

Added

2026-07-12

SHA-256 Hash

TLP:CLEAR

2ab684d93c1553fad87041b4dea97188a97e78589deee2a7bacff905564f3a35

Targets Education Sector with Oracle PeopleSoft Exploit

75% confidence

Added

2026-07-12

SHA-1 Hash

TLP:CLEAR

cc19e502e4201cc974c753b96429027925224f53

Targets Education Sector with Oracle PeopleSoft Exploit

75% confidence

Added

2026-07-12

Domain

TLP:CLEAR

passkeyadd.com

Latest goon squad to use fake helpdesk calls to steal creds

75% confidence

Added

2026-07-05

Domain

TLP:CLEAR

passkeydeploy.com

Latest goon squad to use fake helpdesk calls to steal creds

75% confidence

Added

2026-07-05

Domain

TLP:CLEAR

deploypasskey.com

Latest goon squad to use fake helpdesk calls to steal creds

75% confidence

Added

2026-07-05

Domain

TLP:CLEAR

mydropboxinternal.com

Inside a phishing panel

75% confidence

Added

2026-05-14

Domain

TLP:CLEAR

myxerointernal.com

Inside a phishing panel

75% confidence

Added

2026-05-14

Domain

TLP:CLEAR

passkeywork.com

Inside a phishing panel

75% confidence

Added

2026-05-14

SHA-256 Hash

TLP:CLEAR

8a01bcb70ec1c101a163c9cb8e074781c1322096f7ae01789f02252854def44c

Inside a phishing panel

75% confidence

Added

2026-05-14

SHA-256 Hash

TLP:CLEAR

9c0939960e49122196e44b6779fe55dd7a13ab437ce251c8cf35f8c6daf8be21

Inside a phishing panel

75% confidence

Added

2026-05-14

SHA-256 Hash

TLP:CLEAR

9d65dd34384b441505e6b67647153c02d5c367bb53da36ce36a392e70b37940a

Inside a phishing panel

75% confidence

Added

2026-05-14

SHA-256 Hash

TLP:CLEAR

c0df36ccf88d5c8434b13b58f7a55a9715643a126148b9d078a93075d09cad26

Inside a phishing panel

75% confidence

Added

2026-05-14

SHA-256 Hash

TLP:CLEAR

cb1d409278b2247af23e7b00ac779b232baaf4ce5f63fdf5ebc3920a38cc6102

Inside a phishing panel

75% confidence

Added

2026-05-14

Domain

TLP:CLEAR

enrollms.com

Inside a phishing panel

75% confidence

Added

2026-05-14

Domain

TLP:CLEAR

keyokta.com

Inside a phishing panel

75% confidence

Added

2026-05-14

Domain

TLP:CLEAR

passkeyportalsetup.com

Inside a phishing panel

75% confidence

Added

2026-05-14

Domain

TLP:CLEAR

addoktapasskey.com

Inside a phishing panel

75% confidence

Added

2026-05-14

Domain

TLP:CLEAR

internal.com

Inside a phishing panel

75% confidence

Added

2026-05-14

Domain

TLP:CLEAR

amazoninternal.com

Inside a phishing panel

75% confidence

Added

2026-05-14

Domain

TLP:CLEAR

passkeysetup.com

Inside a phishing panel

75% confidence

Added

2026-05-14

Domain

TLP:CLEAR

epicgamessso.com

Inside a phishing panel

75% confidence

Added

2026-05-14

Domain

TLP:CLEAR

sonosinternal.com

Inside a phishing panel

75% confidence

Added

2026-05-14

Domain

TLP:CLEAR

myadyeninternal.com

Inside a phishing panel

75% confidence

Added

2026-05-14

Domain

TLP:CLEAR

mysonossso.com

Inside a phishing panel

75% confidence

Added

2026-05-14