================================================================================
  INDICATORS OF COMPROMISE — OPERATION SHADOW HARVEST
  Incident ID : IR-2026-0409-007
  Classification: TLP:AMBER — Limited Distribution
  Last Updated : 2026-04-09T06:00:00Z
================================================================================

STATUS KEY:
  [CONFIRMED]  — Validated through forensic analysis or threat intel match
  [SUSPECTED]  — Correlated but not yet independently verified
  [UNDER REVIEW] — Requires further analysis

================================================================================
SECTION 1: IP ADDRESSES
================================================================================

1. 185.220.101.34
   Status      : [CONFIRMED]
   Context     : Initial attack source. SSH brute-force origin. Geo: Moscow, RU.
                  Listed in AbuseIPDB (confidence 98%). Associated with
                  Tor exit node activity and prior APT campaigns.
   First Seen  : 2026-04-09T01:03:22Z
   Protocol    : SSH (22), HTTPS (4443)

2. 91.215.85.142
   Status      : [CONFIRMED]
   Context     : Primary C2 server for Cobalt Strike beacon. Received
                  exfiltrated PII data from DC-01. Geo: Kyiv, UA (likely
                  bulletproof hosting). Reverse DNS: none.
   First Seen  : 2026-04-09T01:44:55Z
   Protocol    : HTTPS (443)

3. 198.51.100.77
   Status      : [CONFIRMED]
   Context     : Secondary exfiltration endpoint. Received SQL database
                  dump from DB-PRIMARY. Geo: Amsterdam, NL. Hosting provider:
                  FlokiNet. No prior threat intel hits — possibly new
                  infrastructure.
   First Seen  : 2026-04-09T02:55:40Z
   Protocol    : HTTPS (8443)

4. 104.244.76.13
   Status      : [SUSPECTED]
   Context     : Known Tor exit node. Outbound connection from WKSTN-FIN-03.
                  May indicate additional compromised host or unrelated user
                  behavior. Requires investigation.
   First Seen  : 2026-04-09T03:28:55Z
   Protocol    : TCP (9001)

5. 45.155.205.99
   Status      : [UNDER REVIEW]
   Context     : Found in DNS cache of WEB-SVR-01 during forensic imaging.
                  No matching firewall logs. Domain resolution for
                  stage2-payload.darkcloud-services.net. Geo: Bucharest, RO.
   First Seen  : 2026-04-09T01:16:00Z (DNS cache timestamp)
   Protocol    : Unknown

================================================================================
SECTION 2: DOMAIN NAMES
================================================================================

1. c2-relay.darkcloud-services.net
   Status      : [CONFIRMED]
   Context     : DNS tunneling C2 channel. DC-01 sent 340+ TXT queries in
                  5 minutes to this domain. Registrar: Njalla (privacy).
                  Registered: 2026-03-28. Nameservers: ns1.darkcloud-services.net,
                  ns2.darkcloud-services.net.
   WHOIS       : Redacted (privacy service)

2. stage2-payload.darkcloud-services.net
   Status      : [SUSPECTED]
   Context     : Subdomain of confirmed C2 domain. Found in DNS cache of
                  WEB-SVR-01. Likely used for second-stage payload delivery.
                  Resolved to 45.155.205.99 at time of cache capture.

3. update-service.legit-cdn.cloud
   Status      : [UNDER REVIEW]
   Context     : Found in browser history of compromised workstation
                  WKSTN-FIN-03. Mimics legitimate CDN naming convention.
                  Registered: 2026-04-01. Registrar: NameCheap.
                  Could be watering hole or unrelated.

================================================================================
SECTION 3: FILE HASHES
================================================================================

1. svc_update.exe (Cobalt Strike Beacon)
   MD5    : 7b3a1d4e8f2c6a9b0d5e3f1a4c7b2e8d
   SHA256 : a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2
   Status : [CONFIRMED]
   Path   : C:\Windows\Temp\svc_update.exe
   Size   : 287,744 bytes
   Signed : No
   Notes  : Cobalt Strike beacon. Malleable C2 profile detected. Watermark
            matches known cracked Cobalt Strike license (watermark: 305419896).

2. healthchk.exe (Persistence backdoor)
   MD5    : 2f8a4c6e1d3b5a7f9e0c2d4b6a8f1e3c
   SHA256 : b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3
   Status : [CONFIRMED]
   Path   : C:\ProgramData\healthchk.exe
   Size   : 194,560 bytes
   Signed : No (invalid Authenticode — claims to be "Microsoft Corporation")
   Notes  : Custom backdoor. Establishes reverse shell to 91.215.85.142:443
            on execution. Survives reboot via scheduled task.

3. mimikatz.exe (Credential dumping tool)
   MD5    : 3e9f5b7d2a4c6e8f1b3d5a7c9e0f2b4d
   SHA256 : c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4
   Status : [CONFIRMED]
   Path   : C:\Users\Public\Documents\mimikatz.exe
   Size   : 1,250,816 bytes
   Signed : No
   Notes  : Mimikatz v2.2.0 (standard release). Used for credential
            harvesting on WEB-SVR-01.

4. payload.dll (Unknown — under analysis)
   MD5    : 9a1b3c5d7e2f4a6b8c0d2e4f6a8b1c3d
   SHA256 : d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5
   Status : [UNDER REVIEW]
   Path   : C:\Windows\System32\payload.dll (found during sweep of DC-01)
   Size   : 523,264 bytes
   Signed : No
   Notes  : Discovered during filesystem analysis of DC-01. Not yet
            detonated in sandbox. Imports suggest network communication
            and file encryption capabilities.

================================================================================
SECTION 4: EMAIL ADDRESSES
================================================================================

1. admin@darkcloud-services.net
   Status  : [SUSPECTED]
   Context : Registrant contact for darkcloud-services.net domain (from
             historical WHOIS before privacy was enabled). May be throwaway.

2. j.kowalski.corp@proton.me
   Status  : [UNDER REVIEW]
   Context : Found in phishing email sent to 3 employees in Finance
             department on 2026-04-07. Subject: "Updated Q1 Budget Report".
             Attachment: Budget_Q1_2026_FINAL.xlsm (macro-enabled).
             Possible initial reconnaissance or separate attack vector.

================================================================================
SECTION 5: REGISTRY KEYS (Windows)
================================================================================

1. HKLM\SYSTEM\CurrentControlSet\Services\WindowsUpdateSvc
   Status  : [CONFIRMED]
   Context : Malicious service created via PsExec on DB-PRIMARY.
             ImagePath: C:\Windows\Temp\svc_update.exe
             Start type: Auto (persists across reboots)

2. HKCU\Software\Microsoft\Windows\CurrentVersion\Run\HealthMonitor
   Status  : [CONFIRMED]
   Context : Run key persistence on DC-01. Points to C:\ProgramData\healthchk.exe.
             Created by da-jthompson session.

3. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe
   Status  : [CONFIRMED]
   Context : Sticky Keys backdoor. Debugger value set to cmd.exe.
             Allows command prompt at login screen via 5x Shift key.
             Found on DC-01.

================================================================================
SECTION 6: FILE PATHS (Attacker artifacts)
================================================================================

1. C:\Windows\Temp\svc_update.exe          — Cobalt Strike beacon
2. C:\ProgramData\healthchk.exe            — Persistence backdoor
3. C:\Users\Public\Documents\mimikatz.exe  — Credential tool
4. C:\Windows\System32\payload.dll         — Unknown (under analysis)
5. C:\Windows\Temp\procdump64.exe          — LSASS memory dumping
6. C:\Users\da-jthompson\AppData\Local\Temp\out.csv — Exfil staging file
7. /tmp/.hidden/beacon                     — Linux beacon (jump-box)
8. /var/tmp/.cache/ssh_scan.sh             — SSH brute-force script (jump-box)

================================================================================
SECTION 7: MUTEX NAMES
================================================================================

1. Global\MSCTF.SharedMem.DARKCLOUD
   Status  : [CONFIRMED]
   Context : Mutex created by svc_update.exe. Used to prevent multiple
             instances of the beacon from running. Unique to this campaign.

2. Global\HealthChkRunning_v2
   Status  : [CONFIRMED]
   Context : Mutex created by healthchk.exe. Found on DC-01.

================================================================================
SECTION 8: USER AGENT STRINGS
================================================================================

1. Mozilla/5.0 (Windows NT 10.0; Win64; x64) MSCRT/22.0.1
   Status  : [CONFIRMED]
   Context : Non-standard user agent used by Cobalt Strike beacon HTTP
             communication. "MSCRT/22.0.1" is not a legitimate Microsoft
             component. Observed in proxy logs for connections to
             91.215.85.142.

2. Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Updater/1.0)
   Status  : [SUSPECTED]
   Context : Found in proxy logs from WKSTN-FIN-03. References IE 8 on
             Windows 7, inconsistent with the host's actual OS (Windows 11).
             "Updater/1.0" suffix is non-standard. Possibly second-stage
             malware or related tooling.

================================================================================
  END OF IOC LIST
  Total IOCs: 31
  Confirmed: 18  |  Suspected: 7  |  Under Review: 6
================================================================================
