ioc.txt

Original Threat Actor w/ Implant usage:

5.149.249[.]74
154.56.56[.]231
154.53.63[.]93
192.3.101[.]111
107.175.229[.]142


New actors after PoC release:

Cluster 1:

193.34.73[.]199
191.102.163[.]83
209.127.110[.]222
95.164.159[.]61


Cluster 2 (strong link to Cluster 1):

38.154.198[.]82
193.34.72[.]38
192.241.67[.]45
170.247.222[.]176


Cluster 3:

65.20.82[.]89
116.230.1[.]233


Misc:

31.13.189[.]248

211.22.147[.]226

45.55.134[.]29

185.82.200[.]130

209.127.106[.]157

176.108.2[.]16


Usernames:

[randomized lowercase letters and numbers]
ciscomonitor
csicoadmin
cisco1
cisco_pxe
cisco_support
cisco_tac_admin
cisco_sys_manager