================================================================================ INDICATORS OF COMPROMISE — OPERATION SHADOW HARVEST Incident ID : IR-2026-0409-007 Classification: TLP:AMBER — Limited Distribution Last Updated : 2026-04-09T06:00:00Z ================================================================================ STATUS KEY: [CONFIRMED] — Validated through forensic analysis or threat intel match [SUSPECTED] — Correlated but not yet independently verified [UNDER REVIEW] — Requires further analysis ================================================================================ SECTION 1: IP ADDRESSES ================================================================================ 1. 185.220.101.34 Status : [CONFIRMED] Context : Initial attack source. SSH brute-force origin. Geo: Moscow, RU. Listed in AbuseIPDB (confidence 98%). Associated with Tor exit node activity and prior APT campaigns. First Seen : 2026-04-09T01:03:22Z Protocol : SSH (22), HTTPS (4443) 2. 91.215.85.142 Status : [CONFIRMED] Context : Primary C2 server for Cobalt Strike beacon. Received exfiltrated PII data from DC-01. Geo: Kyiv, UA (likely bulletproof hosting). Reverse DNS: none. First Seen : 2026-04-09T01:44:55Z Protocol : HTTPS (443) 3. 198.51.100.77 Status : [CONFIRMED] Context : Secondary exfiltration endpoint. Received SQL database dump from DB-PRIMARY. Geo: Amsterdam, NL. Hosting provider: FlokiNet. No prior threat intel hits — possibly new infrastructure. First Seen : 2026-04-09T02:55:40Z Protocol : HTTPS (8443) 4. 104.244.76.13 Status : [SUSPECTED] Context : Known Tor exit node. Outbound connection from WKSTN-FIN-03. May indicate additional compromised host or unrelated user behavior. Requires investigation. First Seen : 2026-04-09T03:28:55Z Protocol : TCP (9001) 5. 45.155.205.99 Status : [UNDER REVIEW] Context : Found in DNS cache of WEB-SVR-01 during forensic imaging. No matching firewall logs. Domain resolution for stage2-payload.darkcloud-services.net. Geo: Bucharest, RO. First Seen : 2026-04-09T01:16:00Z (DNS cache timestamp) Protocol : Unknown ================================================================================ SECTION 2: DOMAIN NAMES ================================================================================ 1. c2-relay.darkcloud-services.net Status : [CONFIRMED] Context : DNS tunneling C2 channel. DC-01 sent 340+ TXT queries in 5 minutes to this domain. Registrar: Njalla (privacy). Registered: 2026-03-28. Nameservers: ns1.darkcloud-services.net, ns2.darkcloud-services.net. WHOIS : Redacted (privacy service) 2. stage2-payload.darkcloud-services.net Status : [SUSPECTED] Context : Subdomain of confirmed C2 domain. Found in DNS cache of WEB-SVR-01. Likely used for second-stage payload delivery. Resolved to 45.155.205.99 at time of cache capture. 3. update-service.legit-cdn.cloud Status : [UNDER REVIEW] Context : Found in browser history of compromised workstation WKSTN-FIN-03. Mimics legitimate CDN naming convention. Registered: 2026-04-01. Registrar: NameCheap. Could be watering hole or unrelated. ================================================================================ SECTION 3: FILE HASHES ================================================================================ 1. svc_update.exe (Cobalt Strike Beacon) MD5 : 7b3a1d4e8f2c6a9b0d5e3f1a4c7b2e8d SHA256 : a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2 Status : [CONFIRMED] Path : C:\Windows\Temp\svc_update.exe Size : 287,744 bytes Signed : No Notes : Cobalt Strike beacon. Malleable C2 profile detected. Watermark matches known cracked Cobalt Strike license (watermark: 305419896). 2. healthchk.exe (Persistence backdoor) MD5 : 2f8a4c6e1d3b5a7f9e0c2d4b6a8f1e3c SHA256 : b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3 Status : [CONFIRMED] Path : C:\ProgramData\healthchk.exe Size : 194,560 bytes Signed : No (invalid Authenticode — claims to be "Microsoft Corporation") Notes : Custom backdoor. Establishes reverse shell to 91.215.85.142:443 on execution. Survives reboot via scheduled task. 3. mimikatz.exe (Credential dumping tool) MD5 : 3e9f5b7d2a4c6e8f1b3d5a7c9e0f2b4d SHA256 : c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4 Status : [CONFIRMED] Path : C:\Users\Public\Documents\mimikatz.exe Size : 1,250,816 bytes Signed : No Notes : Mimikatz v2.2.0 (standard release). Used for credential harvesting on WEB-SVR-01. 4. payload.dll (Unknown — under analysis) MD5 : 9a1b3c5d7e2f4a6b8c0d2e4f6a8b1c3d SHA256 : d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5 Status : [UNDER REVIEW] Path : C:\Windows\System32\payload.dll (found during sweep of DC-01) Size : 523,264 bytes Signed : No Notes : Discovered during filesystem analysis of DC-01. Not yet detonated in sandbox. Imports suggest network communication and file encryption capabilities. ================================================================================ SECTION 4: EMAIL ADDRESSES ================================================================================ 1. admin@darkcloud-services.net Status : [SUSPECTED] Context : Registrant contact for darkcloud-services.net domain (from historical WHOIS before privacy was enabled). May be throwaway. 2. j.kowalski.corp@proton.me Status : [UNDER REVIEW] Context : Found in phishing email sent to 3 employees in Finance department on 2026-04-07. Subject: "Updated Q1 Budget Report". Attachment: Budget_Q1_2026_FINAL.xlsm (macro-enabled). Possible initial reconnaissance or separate attack vector. ================================================================================ SECTION 5: REGISTRY KEYS (Windows) ================================================================================ 1. HKLM\SYSTEM\CurrentControlSet\Services\WindowsUpdateSvc Status : [CONFIRMED] Context : Malicious service created via PsExec on DB-PRIMARY. ImagePath: C:\Windows\Temp\svc_update.exe Start type: Auto (persists across reboots) 2. HKCU\Software\Microsoft\Windows\CurrentVersion\Run\HealthMonitor Status : [CONFIRMED] Context : Run key persistence on DC-01. Points to C:\ProgramData\healthchk.exe. Created by da-jthompson session. 3. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe Status : [CONFIRMED] Context : Sticky Keys backdoor. Debugger value set to cmd.exe. Allows command prompt at login screen via 5x Shift key. Found on DC-01. ================================================================================ SECTION 6: FILE PATHS (Attacker artifacts) ================================================================================ 1. C:\Windows\Temp\svc_update.exe — Cobalt Strike beacon 2. C:\ProgramData\healthchk.exe — Persistence backdoor 3. C:\Users\Public\Documents\mimikatz.exe — Credential tool 4. C:\Windows\System32\payload.dll — Unknown (under analysis) 5. C:\Windows\Temp\procdump64.exe — LSASS memory dumping 6. C:\Users\da-jthompson\AppData\Local\Temp\out.csv — Exfil staging file 7. /tmp/.hidden/beacon — Linux beacon (jump-box) 8. /var/tmp/.cache/ssh_scan.sh — SSH brute-force script (jump-box) ================================================================================ SECTION 7: MUTEX NAMES ================================================================================ 1. Global\MSCTF.SharedMem.DARKCLOUD Status : [CONFIRMED] Context : Mutex created by svc_update.exe. Used to prevent multiple instances of the beacon from running. Unique to this campaign. 2. Global\HealthChkRunning_v2 Status : [CONFIRMED] Context : Mutex created by healthchk.exe. Found on DC-01. ================================================================================ SECTION 8: USER AGENT STRINGS ================================================================================ 1. Mozilla/5.0 (Windows NT 10.0; Win64; x64) MSCRT/22.0.1 Status : [CONFIRMED] Context : Non-standard user agent used by Cobalt Strike beacon HTTP communication. "MSCRT/22.0.1" is not a legitimate Microsoft component. Observed in proxy logs for connections to 91.215.85.142. 2. Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Updater/1.0) Status : [SUSPECTED] Context : Found in proxy logs from WKSTN-FIN-03. References IE 8 on Windows 7, inconsistent with the host's actual OS (Windows 11). "Updater/1.0" suffix is non-standard. Possibly second-stage malware or related tooling. ================================================================================ END OF IOC LIST Total IOCs: 31 Confirmed: 18 | Suspected: 7 | Under Review: 6 ================================================================================