IOC du rapport source : https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit
Affichage neutralisé. Un observable associé n'est pas une preuve de compromission ni une consigne de blocage.
domain	airindia[.]fit	active
domain	airliquide[.]lol	active
domain	airproducts[.]ink	active
domain	apollohospitals[.]fit	active
domain	attcdn[.]com	active
domain	aurexdefense[.]online	active
domain	bosch-sensortec[.]site	active
domain	brianwilli[.]com	active
domain	checrity[.]com	active
domain	cyclokinetics[.]online	active
domain	elixnovorem[.]com	active
domain	emcore[.]ink	active
domain	epsilonsystems[.]net	active
domain	fracons[.]com	active
domain	getaiexo[.]com	active
domain	haloengines[.]net	active
domain	jetoptera[.]co	active
domain	joinmacket[.]com	active
domain	lindes[.]ink	active
domain	msbenefit[.]com	active
domain	openlumakora[.]com	active
domain	precipart[.]ink	active
domain	rocketlabusa[.]ink	active
domain	secboxes[.]com	active
domain	silvustechnologies[.]online	active
domain	smxtech[.]xyz	active
domain	sncorp[.]fit	active
domain	spectrolab[.]fit	active
domain	tcomlp[.]online	active
domain	v8-ctf-chrome-stage4-handover[.]md	active
domain	velodynaity[.]com	active
domain	worldview[.]fit	active
md5	1a062f4982564d6d19a76884ce8bcbb6	active
sha256	295fc584f75e94108c9be945977db33ed80421f5d374eab188587c911dffd915	active
sha256	353b5bd2780c1b0c07c1283d83cf16cf1e9ec226c17b2d09d56848893f9d98ee	active
sha256	3594ad58fb6217fafe9839e53999a90608c2e9f335fa20aece3d53f8c0802726	active
sha256	3ec3151d8d1278ed966941ac89ea495ef6a80c70613dd9138cc85fc28c9df432	active
sha256	6e6378d8d404166da89d982e80bc52e19a3f677201258dec1775f100a027a92d	active
sha256	779b3e1a470e589d492b99154ba11622fbaebb19b3de694f660c725411b7096d	active
sha256	7d6f6dcb17a423bdd7715f8a4e34f2939501a761bc9bf7aa005f805ef1f82288	active
sha256	8453c42904b7b2fea5671b7bff06b2d937632ae29545fd11bc13095627a2805f	active
sha256	87b6b24c06f99900a8aa579caedee1e402015884c925a98dcfb0fb38dfa2de22	active
sha256	a4a6a04d85eca8d584d939d2437c85a4f291207d8042f2ec002838e336b72ef5	active
sha256	ac6806c89e294f390838cb07c015dabec1c8ada06ce5161a0ad50b8a72828141	active
sha256	ac6bbc4b1f1c62e308781329183a46e18f454c27e66bffa09f343b53ac622b69	active
sha256	b34802a646fc4a8f07ffa09a5fda8bf7327446b22e3d7bb5163dafa1e2a8bb2b	active
sha256	bc7d24f5cf8937b334966201bdcce8ca9bab6ec5889d40a399d4094dcad73360	active
sha256	e950d03c58d49e28e31df8afeefca1f3b3d2cd6b697c40adfee1a4f6fe18f004	active
sha256	f3c64014221a58f3fde88e562662dbd5a1b3dd2b59c86e9e2bc5cb8f671664e7	active
sha256	ff1b49aaec994f4c11f2c9331e739abb4bc3d6abf66ec50ce99709fba35d782b	active
url	hxxps[:]//1a062f4982564d6d19a76884ce8bcbb6[.]r2[.]cloudflarestorage[.]com/datago/SysPr[.]prx	revoked
url	hxxps[:]//1a062f4982564d6d19a76884ce8bcbb6[.]r2[.]cloudflarestorage[.]com/datago/krita[.]dll	revoked
url	hxxps[:]//1a062f4982564d6d19a76884ce8bcbb6[.]r2[.]cloudflarestorage[.]com/datago/krita[.]exe	revoked
url	hxxps[:]//api-prod[.]secboxes[.]com[:]443/download	revoked
url	hxxps[:]//download[.]secboxes[.]com[:]443/dist[.]zip	revoked
url	hxxps[:]//evidence[.]msbenefit[.]com/msgbox[.]exe	revoked
url	hxxps[:]//homepage[.]brianwilli[.]com/d/	revoked
url	hxxps[:]//homepage[.]brianwilli[.]com/d/85rY[.]dat	revoked
url	hxxps[:]//homepage[.]brianwilli[.]com/d/SysPr[.]prx	revoked
url	hxxps[:]//homepage[.]brianwilli[.]com/d/calibre-launcher[.]dll	revoked
url	hxxps[:]//homepage[.]brianwilli[.]com/d/wint[.]exe	revoked
url	hxxps[:]//project[.]secboxes[.]com/ChromeUpdate[.]exe	revoked
url	hxxps[:]//recommendation-letter[.]secboxes[.]com/ChromeUpdate[.]exe	revoked
url	hxxps[:]//zki0y83[.]msbenefit[.]com[:]443/feed	revoked