IOC Feed
Enough to Be Dangerous: The Mechanics of an LLM-Assisted Intrusion Campaign
25 indicators extracted from this
investigation's feed. Filter by type, then copy or download exactly what is on screen.
25 shown
| Type | Indicator | Confidence | Action |
|---|---|---|---|
| ipv4 | 192.3.1.116 | DEFINITE | BLOCK |
| ipv4 | 199.45.155.76 | ||
| ipv4 | 205.210.31.232 | ||
| ipv4 | 21.0.8.191 | ||
| ipv4 | 34.210.36.7 | ||
| ipv4 | 34.59.254.11 | ||
| ipv4 | 44.245.20.76 | ||
| domain | ch.qos.logback.core.fileappender | DEFINITE | |
| domain | poc.yml | DEFINITE | |
| domain | vpn932081317.softether.net | HIGH | BLOCK |
| url | http://192.3.1.116:7777/cmd.jsp | DEFINITE | BLOCK |
| url | http://192.3.1.116:7777/xstream_rce_success | DEFINITE | HUNT |
| url | http://192.3.1.116:9876/rce_confirmed | DEFINITE | HUNT |
| url | http://192.3.1.116:9876/yaml_rce_proof | DEFINITE | HUNT |
| sha256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 | ||
| path | /bin/bash | DEFINITE (EXISTS IN OPERATOR DIRECTORY) / UNCONFIRMED (DEPLOYED TO ANY VICTIM) | |
| path | /root/.hermes | HIGH | |
| path | /root/.ssh/authorized_keys | HIGH (ATTEMPTED) | |
| path | /tmp/cjs_token.txt | DEFINITE | |
| path | /tmp/riverbay_heap.bin | DEFINITE | |
| path | /tmp/tomcat-docbase.7684244892297451797.9001/rce.jsp | DEFINITE (PAYLOAD REFERENCES IT) / UNCONFIRMED (WRITE OCCURRED) | |
| filename | cmd.jsp | DEFINITE (EXISTS IN OPERATOR DIRECTORY) / UNCONFIRMED (DEPLOYED TO ANY VICTIM) | |
| filename | logback-evil.xml | DEFINITE | |
| filename | logback-rce.xml | DEFINITE | |
| filename | phish.svg | MODERATE |
45 further values in this feed are not shown above, because they are not an indicator type that can be recognised reliably by shape: command names, fingerprints and behavioural patterns among them. They are all in the raw JSON, which remains the complete record.
Do not block
These values came out of this investigation, but blocking them would break something legitimate, whether a shared service, a bystander's infrastructure, or the victim's own equipment. They are listed here because they still matter for hunting, and they are deliberately excluded from the copy and download buttons above.
| Type | Indicator | Why it stays off a blocklist |
|---|---|---|
| ipv4 | 127.0.0.1 |
The cloud-metadata entity is the standout - it targets cloud IAM credential theft rather than internal service discovery. |
| ipv4 | 31.22.111.190 |
Operator control-source address |
| domain | cs-pgcwufmiws.cn-hangzhou.fcapp.run |
Attack-traffic relay |
| domain | open.oppomobile.com |
A major smartphone OEM's legitimate developer platform, targeted by the toolkit's own oppo_om_fuzz.py script (31x31 service/method API fuzzing plus JavaScript secret-hunting against its downloaded bundles). The malicious activity is the outbound fuzzing traffic, not the destination; blocking this domain would cut off legitimate OPPO developers and devices worldwide rather than the operator. |
| filename | internal_scan.svg |
The cloud-metadata entity is the standout - it targets cloud IAM credential theft rather than internal service discovery. |
Licensed CC BY 4.0, free to use commercially with attribution to The Hunters Ledger.