# source_validations

ioc_type: ipv4
ioc_value: 188.166.247.34
source: otx
validated_at: 2026-04-02T18:44:54.735942
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Singapore", "country_code": "SG", "city": "Singapore", "asn": "AS14061 digitalocean  llc", "indicator": "188.166.247.34", "tags": ["backdoors", "vbscript", "malicious", "gamaredon", "options", "word template", "stealers", "apt", "sample hashes", "pterosteal", "pteropshell", "pterolnk", "first", "office macro", "welivesecurity"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["ebeb8d4838994bb36d059b2d7e0a09521842999bf0d0be3770692d8436b964d6"]}


ioc_type: ipv4
ioc_value: 188.166.43.183
source: otx
validated_at: 2026-04-02T18:45:08.055665
raw_response:
  {"pulse_count": 8, "reputation": 0, "country": "Netherlands", "country_code": "NL", "city": "Amsterdam", "asn": "AS14061 digitalocean  llc", "indicator": "188.166.43.183", "tags": ["url https", "2026-02", "gamaredon", "threatactor/tridentursa", "Automated", "trident ursa", "OpenCTI", "ukraine", "Gamaredon", "dns flux", "apt", "sample", "russia", "threatactor/gamaredon", "Gamaredon Group", "Trident Ursa", "domain", "threatactor/actinium", "phishing", "maldocs", "threatactor.primitivebear", "ip address"], "pulses": ["Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "OpenCTI_Export_2026-02", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa ( Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa ( Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 188.225.25.132
source: otx
validated_at: 2026-04-02T18:45:22.198702
raw_response:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "188.225.25.132", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "2022", "ukraine", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147", "wildfire", "Gamardeon", "quietsieve"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Gamaredon OSINT Dump"], "malware_count": 9, "passive_dns_count": 10, "malware_samples": ["e0f7314714e17de21ff9027d07c1e01f5376dab8ce1b22cf710b51c6d52cc55c", "5e436f728bc24b0bc38321c818d846bf020f3c4c797a1e6abed043d2e05960a1", "d384598b3268f845ad05ed5ac76215f25f1f687a2d475a727d423912bf99ed85", "f6df89b825fb9d17c6e59bd8342e2ea925ff52d8b3396f28e0fb834aa15504a8", "56abe082504a1e6fc0b9c249e44f1392e642cb6c148a968648a4c00999624b6b", "a87e9d5e03db793a0c7b8e8e197d14745265422f05e6e50867cdf


ioc_type: ipv4
ioc_value: 188.225.42.206
source: otx
validated_at: 2026-04-02T18:45:41.074209
raw_response:
  {"pulse_count": 26, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "188.225.42.206", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047", "slapstick", "geopolitical conflict"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "jintingtingtesttest", "jintingtingtesttest", "jintingtingtesttest", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 188.225.44.138
source: otx
validated_at: 2026-04-02T18:45:58.084831
raw_response:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "188.225.44.138", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "2022", "ukraine", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147", "wildfire", "Gamardeon", "quietsieve"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Gamaredon OSINT Dump"], "malware_count": 0, "passive_dns_count": 12, "malware_samples": [], "passive_dns": ["firasto.ru", "circulas.ru", "coleopteras.ru", "phymateus.ru", "bacilluse.ru", "danainae.ru", "ophisaurusis.xyz", "blockpost.space", "apusa.xyz", "myrrhan.xyz", "teroba.ru", "myces.ru"]}


ioc_type: ipv4
ioc_value: 188.225.43.174
source: otx
validated_at: 2026-04-02T18:46:01.371906
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "188.225.43.174", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 188.225.44.181
source: otx
validated_at: 2026-04-02T18:46:07.126068
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "188.225.44.181", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 188.225.44.76
source: otx
validated_at: 2026-04-02T18:46:27.541497
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "188.225.44.76", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 188.225.58.233
source: otx
validated_at: 2026-04-02T18:46:33.197264
raw_response:
  {"pulse_count": 26, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "188.225.58.233", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047", "slapstick", "geopolitical conflict"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "jintingtingtesttest", "jintingtingtesttest", "jintingtingtesttest", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs"], "malware_count": 0, "passive_dns_count": 25, "malware_samples": [], "passive_dns": ["emd.d.grb.agency", "fourth.d.grb.agency", "api.emd.d.grb.agency", "la.d.grb.agency", "s.d.grb.agency", "test.d.grb.agency", "first.d.grb.agency", "etc.d.grb.agency", "traefik.d.grb.agency", "crmfastrans.ru", "538645-cd89829.tmweb.ru", "static.mgimo.wwdev.ru", "oceanarium.wwdev.ru", "billing.webway.ru", "avangardus.ru", "crocushall.wwdev.ru", "dashboard.taras.io", "docs.avangardus.ru", "confluence.avangardus.ru", "jira.avangardus.ru"]}


ioc_type: ipv4
ioc_value: 188.225.87.166
source: otx
validated_at: 2026-04-02T18:46:49.627136
raw_response:
  {"pulse_count": 26, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "188.225.87.166", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047", "slapstick", "geopolitical conflict"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "jintingtingtesttest", "jintingtingtesttest", "jintingtingtesttest", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs"], "malware_count": 0, "passive_dns_count": 14, "malware_samples": [], "passive_dns": ["www.erp.bbrc.ru", "erp.bbrc.ru", "www.market.exam-z.ru", "market.exam-z.ru", "exam-z.ru", "www.exam-z.ru", "krashand.ru", "teroba.ru", "myces.ru", "apusa.xyz", "myrrhan.xyz", "ophisaurusis.xyz", "29kolperty.ga", "427727-ck80981.tmweb.ru"]}


ioc_type: ipv4
ioc_value: 188.93.210.54
source: otx
validated_at: 2026-04-02T18:46:57.729802
raw_response:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "188.93.210.54", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "2022", "ukraine", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147", "wildfire", "Gamardeon", "quietsieve"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Gamaredon OSINT Dump"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["50d665506d3dfd92ead9e39a003ac0fe02e5aa51e58296a3973fda4edf6a14b7"]}


ioc_type: ipv4
ioc_value: 193.124.206.128
source: otx
validated_at: 2026-04-02T18:47:00.689867
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Czechia", "country_code": "CZ", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "193.124.206.128", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon", "script", "primitivebear", "sha256", "ghostwriter", "github", "code", "path", "quietsieve", "runprogram", "span", "gamaredon group", "unit", "star", "russia", "button", "whispergate", "pterodo", "install", "armageddon", "enterprise", "iocs cluster", "primitive bear", "Gamardeon", "alliance"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 45, "malware_samples": [], "passive_dns": ["l9dff363.justinstalledpanel.com", "geografteach.ru", "api.geografteach.ru", "mantidae.online", "limenitidinae.online", "gonepteryx.online", "cyrestinae.online", "nematoceras.online", "hamadryas.online", "morphinaes.online", "nymphalidaes.online", "danainae.online", "cholerd.ru", "blattodea.ru", "metcalfas.online", "eurypterida.online", "acetobacter.online", "ariuma.ru", "chelicerata.online", "haromo.ru"]}


ioc_type: ipv4
ioc_value: 193.164.150.111
source: otx
validated_at: 2026-04-02T18:47:15.747004
raw_response:
  {"pulse_count": 26, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "193.164.150.111", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047", "slapstick", "geopolitical conflict"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "jintingtingtesttest", "jintingtingtesttest", "jintingtingtesttest", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs"], "malware_count": 0, "passive_dns_count": 9, "malware_samples": [], "passive_dns": ["epatagik.com", "www.epatagik.com", "royls.ru", "www.royls.ru", "myces.ru", "teroba.ru", "ophisaurusis.xyz", "apusa.xyz", "myrrhan.xyz"]}


ioc_type: ipv4
ioc_value: 193.164.150.121
source: otx
validated_at: 2026-04-02T18:47:27.547623
raw_response:
  {"pulse_count": 29, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "193.164.150.121", "tags": ["powersploit", "qakbot", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "gamaredon", "razy", "wiper", "armageddon", "APT", "lazagne", "crackmapexec", "gamaredon group", "powerstats", "pupyrat", "tsunami", "g0047", "asyncrat", "poshc2", "muddywater", "russia", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147", "wildfire", "raccoon", "whispergate", "pupy", "mimikatz", "mirai"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "data of hhh", "vvvvv", "vvvvv", "jintingtingtesttest", "jintingtingtesttest", "jintingtingtesttest", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 194.180.174.46
source: otx
validated_at: 2026-04-02T18:47:35.816684
raw_response:
  {"pulse_count": 25, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS39798 mivocloud srl", "indicator": "194.180.174.46", "tags": ["vnc client", "august", "gafgyt", "HermeticWiper", "wiper", "appdata", "runprogram", "russia", "poshc2", "alliance", "Gamardeon", "symantec", "asyncrat", "raccoon", "geopolitical conflict", "2022", "defender", "s0147", "palo alto", "alertinfo", "ukraine", "powgoop", "APT", "lazagne", "pupyrat", "primitivebear", "sha256", "ghostwriter", "deviceid", "powerstats", "dword", "mori backdoor", "unit", "trickbot", "pterodo", "WhisperGate", "g0047", "cluster", "shuckworm", "pupy", "vbscript b", "remcom", "ddos", "domain", "vbscript", "formbook", "redrum", "filehashmd5", "team", "unc1151"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "IOCs for the recent Cyber Activities of Russian Hackers Targeting Ukraine "], "malware_count": 0, "passive_dns_count": 8, "malware_samples": [], "passive_dns": ["www.naughty-payne.194-180-174-46.plesk.page", "naughty-payne.194-180-174-46.plesk.page", "lucid-lumiere.194-180-174-46.plesk.page", "ecstatic-babbage.194-180-174-46.plesk.page", "tender-dhawan.194-180-174-46.plesk.page", "civitacastellana.live", "n-etflix.com", "roundcherry.com"]}


ioc_type: ipv4
ioc_value: 194.180.191.105
source: otx
validated_at: 2026-04-02T18:47:52.592595
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS39798 mivocloud srl", "indicator": "194.180.191.105", "tags": ["domain", "microsoft word", "ukraine", "threatactor/tridentursa", "Gamaredon Group", "word", "powershell", "gamaredon", "url https", "threatactor.primitivebear", "Gamaredon", "Military", "Trident Ursa", "armageddon", "garmaredon", "Government", "cybersecurity", "threatactor/actinium", "sample", "base64encoded", "cyber", "are gamaredon", "yara rule", "mitigation tips", "never", "service", "GammaSteel", "ip address", "threatactor/gamaredon"], "pulses": ["Gamaredon Leverages Microsoft Office Docs to Target Ukraine Government and Military", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Gamaredon Leverages Microsoft Office Docs to Target Ukraine Government and Military", "Twitter Feed - malwrhunterteam - 22-08-2022"], "malware_count": 2, "passive_dns_count": 0, "malware_samples": ["1ec69271abd8ebd1a42ac1c2fa5cdd9373ff936dc73f246e7f77435c8fa0f84c", "1655ad0445d319771f6a59ab39483a3cbebd1360b626b6495638f9746cccca8a"]}


ioc_type: ipv4
ioc_value: 194.180.191.30
source: otx
validated_at: 2026-04-02T18:48:08.853078
raw_response:
  {"pulse_count": 8, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS39798 mivocloud srl", "indicator": "194.180.191.30", "tags": ["as14061", "gamaredon", "welivesecurity", "backdoors", "pterolnk", "options", "as207713", "malicious", "apt", "as212189", "pteropshell", "as39798", "word template", "stealers", "as207651", "sample hashes", "as211211", "vbscript", "pterosteal", "office macro", "first"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "ETIC Cybersecurity  2024-07-11  Port Scan", "Gamaredon's Rapid Data Exfiltration Tactics Following Initial Compromise", "Summary information on the activities of the UAC-0010 group as of July 23", "Summary information on the activities of the UAC-0010 group as of July 23", "Summary information on the activities of the UAC-0010 group as of July 23"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 194.58.103.22
source: otx
validated_at: 2026-04-02T18:48:29.459708
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.103.22", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 194.58.108.140
source: otx
validated_at: 2026-04-02T18:48:39.347244
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.108.140", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon", "script", "primitivebear", "sha256", "ghostwriter", "github", "code", "path", "quietsieve", "runprogram", "span", "gamaredon group", "unit", "star", "russia", "button", "whispergate", "pterodo", "install", "armageddon", "enterprise", "iocs cluster", "primitive bear", "Gamardeon", "alliance"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 71, "malware_samples": [], "passive_dns": ["disco.r2-x2.ru", "meandrusas.online", "papiliot.online", "acrididae.online", "acetobacter.online", "apidaet.online", "mesant.online", "fusari.ru", "mantodeas.online", "nematoceras.online", "megatos.online", "hierodula.online", "apoxipodes.online", "ariuma.ru", "cyrestinae.online", "lepidopteras.online", "tomond.ru", "mamberis.ru", "maniola.online", "sporog.ru"]}


ioc_type: ipv4
ioc_value: 194.58.108.14
source: otx
validated_at: 2026-04-02T18:48:47.324654
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.108.14", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group", "unc1151", "ip addresses", "service", "pterodo", "contact", "footer", "vnc domains", "ghostwriter", "PartyTicket", "reload", "open", "iocs cluster", "install", "ukraine", "Primitive Bear", "russia", "sha256", "form", "main", "ransomware", "HermeticWiper", "filehashmd5", "virustotal", "pteranodon", "june"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 194.58.111.215
source: otx
validated_at: 2026-04-02T18:48:59.536962
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.111.215", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 194.58.111.54
source: otx
validated_at: 2026-04-02T18:49:19.393944
raw_response:
  {"pulse_count": 50, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.111.54", "tags": [], "pulses": ["BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "InQuest - 28-08-2023", "InQuest - 27-08-2023", "InQuest - 26-08-2023", "InQuest - 25-08-2023", "InQuest - 24-08-2023", "InQuest - 23-08-2023", "InQuest - 22-08-2023", "InQuest - 21-08-2023", "InQuest - 20-08-2023", "InQuest - 19-08-2023"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 194.58.118.14
source: otx
validated_at: 2026-04-02T18:49:25.390476
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.118.14", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group", "unc1151", "ip addresses", "service", "pterodo", "contact", "footer", "vnc domains", "ghostwriter", "PartyTicket", "reload", "open", "iocs cluster", "install", "ukraine", "Primitive Bear", "russia", "sha256", "form", "main", "ransomware", "HermeticWiper", "filehashmd5", "virustotal", "pteranodon", "june"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 32, "malware_samples": [], "passive_dns": ["www.osher.tech", "osher.tech", "dipteran.online", "dahmke.ru", "nymphalidaes.online", "coleopteras.online", "erati.ru", "arachnidas.online", "mamberis.ru", "metcalfas.online", "graphiuma.online", "sporog.ru", "papiliot.online", "hamadryas.online", "asilidae.online", "false.grafitto.ru", "apidaet.online", "fanniidae.online", "tomond.ru", "fusari.ru"]}


ioc_type: ipv4
ioc_value: 194.58.119.114
source: otx
validated_at: 2026-04-02T18:49:42.020635
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.119.114", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon", "script", "primitivebear", "sha256", "ghostwriter", "github", "code", "path", "quietsieve", "runprogram", "span", "gamaredon group", "unit", "star", "russia", "button", "whispergate", "pterodo", "install", "armageddon", "enterprise", "iocs cluster", "primitive bear", "Gamardeon", "alliance"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 194.58.119.99
source: otx
validated_at: 2026-04-02T18:49:48.847957
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.119.99", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 120, "malware_samples": [], "passive_dns": ["oldys3.xyz", "oderas.ru", "brachycera.online", "cholerd.ru", "cyrestinae.online", "fanniidae.online", "debarys.ru", "limenitidinae.online", "megatos.online", "hierodula.online", "hesperiidae.online", "acrididae.online", "false.grafitto.ru", "kilogar.ru", "aer


ioc_type: ipv4
ioc_value: 194.58.120.207
source: otx
validated_at: 2026-04-02T18:50:06.350564
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.120.207", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 194.58.121.225
source: otx
validated_at: 2026-04-02T18:50:16.503090
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.121.225", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 3, "malware_samples": [], "passive_dns": ["furyboost.net", "www.furyboost.net", "test.thair.ru"]}


ioc_type: ipv4
ioc_value: 194.58.122.110
source: otx
validated_at: 2026-04-02T18:50:32.958243
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.122.110", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon", "script", "primitivebear", "sha256", "ghostwriter", "github", "code", "path", "quietsieve", "runprogram", "span", "gamaredon group", "unit", "star", "russia", "button", "whispergate", "pterodo", "install", "armageddon", "enterprise", "iocs cluster", "primitive bear", "Gamardeon", "alliance"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 89, "malware_samples": [], "passive_dns": ["erp.norbekov.online", "crm.norbekov.online", "api.norbekov.online", "norbekov.ru", "nrb.ayurvedarussia.online", "criocash.fun", "api.norbekov.ru", "libellulat.online", "biblidinae.online", "coliadinae.online", "hesperiidae.online", "cerambycidae.online", "mamberis.ru", "blaberidae.online", "megatos.online", "empusidae.online", "maniola.online", "false.grafitto.ru", "lepidopteras.online", "cyrestinae.online"]}


ioc_type: ipv4
ioc_value: 194.58.121.94
source: otx
validated_at: 2026-04-02T18:50:33.515011
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.121.94", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 54, "passive_dns": ["dev.dokfilm24.ru", "www.dev.dokfilm24.ru", "kukuha.ru", "www.kukuha.ru", "www.dokfilm24.ru", "dokfilm24.ru", "publicsoft.ru", "www.publicsoft.ru", "ivilica.pro", "www.ivilica.pro", "www.public-soft.ru", "public-soft.ru", "www.look-lit.ru", "look-lit.ru", "www.111.federaltorg.ru", "111.f


ioc_type: ipv4
ioc_value: 194.58.122.212
source: otx
validated_at: 2026-04-02T18:50:40.200296
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.122.212", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 63, "malware_samples": [], "passive_dns": ["prinfix.ru", "www.mparadiso.ru", "mparadiso.ru", "www.korpusnyak.ru", "korpusnyak.ru", "worx.am", "api.davmar.am", "davmar.am", "www.davmar.am", "hierodula.online", "aerogenosa.ru", "tomond.ru", "mantidae.online", "papiliot.online", "cyrestinae.online", "spor


ioc_type: ipv4
ioc_value: 194.58.123.47
source: otx
validated_at: 2026-04-02T18:50:47.408570
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.123.47", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 57, "malware_samples": [], "passive_dns": ["www.ssl.autoserviscrm.ru", "ssl.autoserviscrm.ru", "autoserviscrm.ru", "www.autoserviscrm.ru", "194-58-123-47.cloudvps.regruhosting.ru", "telegrme.ru", "hurama.ru", "nematoceras.ru", "gromphadorhina.ru", "heteroptera.ru", "megascolias.online", "morphon.online"


ioc_type: ipv4
ioc_value: 194.58.90.120
source: otx
validated_at: 2026-04-02T18:51:02.864773
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.90.120", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 78, "malware_samples": [], "passive_dns": ["test2.tpopractice.online", "194-58-90-120.cloudvps.regruhosting.ru", "btrx.tpopractice.online", "miragenails.ru", "apaturinae.online", "megatos.online", "hamadryas.online", "blattodea.ru", "blattodea.online", "kallima.online", "sporog.ru", "biblidinae.online",


ioc_type: ipv4
ioc_value: 194.58.92.102
source: otx
validated_at: 2026-04-02T18:51:10.088332
raw_response:
  {"pulse_count": 26, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.92.102", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047", "slapstick"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Gamaredon OSINT Dump"], "malware_count": 22, "passive_dns_count": 83, "malware_samples": ["e57e3a2862e12f319719ae644ba98e301a45226b1bd58f28474f51bc4c46d0df", "118eb9ff0e6fc19532969eb363b3da8d02d25cbdf058475a7b0bb17d2967328f", "0ccaae420e06e9673d5e59378a0856379fc917cd490da9c94de50cf6006151fb", "22a6225425fd6738488422fbcdf03f587083659026f956a3d316e8893eaa4d1e", "6dcd716e8c0d4775ff1442d75aeb1110b5a4e419e6e0fe64b684cec68e4a0042", "d733d244665efb0f1f4b38


ioc_type: ipv4
ioc_value: 194.58.97.115
source: otx
validated_at: 2026-04-02T18:51:16.699455
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.97.115", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon", "script", "primitivebear", "sha256", "ghostwriter", "github", "code", "path", "quietsieve", "runprogram", "span", "gamaredon group", "unit", "star", "russia", "button", "whispergate", "pterodo", "install", "armageddon", "enterprise", "iocs cluster", "primitive bear", "Gamardeon", "alliance"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 131, "malware_samples": [], "passive_dns": ["www.cadence.fishing", "cadence.fishing", "www.watchsports.ru", "watchsports.ru", "www.xn--e1ajpfcja6ek.xn--p1ai", "owa.xn--e1ajpfcja6ek.xn--p1ai", "bestcourse.pro", "xn--e1ajpfcja6ek.xn--p1ai", "promo.bestcourse.pro", "www.nviot.space", "nviot.space", "api.effort.advase.digital", "dionysi.online", "coliadinae.online", "false.grafitto.ru", "lycaenidae.online", "limenitis.online", "cerambycidae.online", "libellulat.online", "hymenoptera.online"]}


ioc_type: ipv4
ioc_value: 194.58.97.245
source: otx
validated_at: 2026-04-02T18:51:37.150928
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.97.245", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 194.58.98.215
source: otx
validated_at: 2026-04-02T18:51:42.607051
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.58.98.215", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 7, "malware_samples": [], "passive_dns": ["vrn.vasha-voda.ru", "vasha-voda.ru", "www.vasha-voda.ru", "s5.cdntv.online", "teroba.ru", "myces.ru", "dfpfnen.su"]}


ioc_type: ipv4
ioc_value: 194.67.108.168
source: otx
validated_at: 2026-04-02T18:51:57.037254
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.108.168", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 11, "malware_samples": [], "passive_dns": ["apidaet.online", "apaturinae.online", "blattodea.online", "arachnidas.online", "oldys4.xyz", "zxzbabe.ru", "zxzdroch.ru", "linkmedia.digital", "www.linkmedia.digital", "bonusfix.ru", "id.bonusfix.ru"]}


ioc_type: ipv4
ioc_value: 194.67.104.232
source: otx
validated_at: 2026-04-02T18:52:00.537287
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.104.232", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon", "script", "primitivebear", "sha256", "ghostwriter", "github", "code", "path", "quietsieve", "runprogram", "span", "gamaredon group", "unit", "star", "russia", "button", "whispergate", "pterodo", "install", "armageddon", "enterprise", "iocs cluster", "primitive bear", "Gamardeon", "alliance"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 194.67.109.14
source: otx
validated_at: 2026-04-02T18:52:04.723184
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.109.14", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 72, "malware_samples": [], "passive_dns": ["www.babushkinskaya.olimpic-fit.ru", "babushkinskaya.olimpic-fit.ru", "www.medvedkovo.olimpic-fit.ru", "medvedkovo.olimpic-fit.ru", "informpanton.space", "informpanton.site", "informpanton.online", "forvpsult.online", "megatos.online", "haromo.ru", "anisoptera.onli


ioc_type: ipv4
ioc_value: 194.67.109.164
source: otx
validated_at: 2026-04-02T18:52:29.827958
raw_response:
  {"pulse_count": 26, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.109.164", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047", "slapstick"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Gamaredon OSINT Dump"], "malware_count": 18, "passive_dns_count": 45, "malware_samples": ["6a64a8e2202db7f3a77d32b4852b71acf620f96580ca015e8bff8f5a09622032", "2c3c78d5e8f4b07e7d52d28cb3d4e43f51ac605279b3048217870305b1a1b496", "05ac54b8bf1cbeedec6e4892303b4a76d8725d7551a88cdf38a872596c23bfb9", "bd64d14b13e29805d091f45fdfc5dce2591cd5123c25ce6afd3b0a856c842566", "5c548ab1dc33b2af4e179ef88a4019b6fcfe78a0688ea2a87d85dc2a7a20ee60", "29a60de230d00fe4fd502


ioc_type: ipv4
ioc_value: 194.67.109.76
source: otx
validated_at: 2026-04-02T18:52:42.130221
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.109.76", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 31, "malware_samples": [], "passive_dns": ["startap.space", "oderas.ru", "haromo.ru", "lophacris.online", "acetobacter.online", "mamberis.ru", "tomond.ru", "alloy.vadilops.ru", "lepidopteras.online", "cholerd.ru", "mucora.ru", "fortias.ru", "baryo.ru", "aerogenosa.ru", "limenitis.ru", "mantodeas.online"


ioc_type: ipv4
ioc_value: 194.67.109.191
source: otx
validated_at: 2026-04-02T18:52:43.557208
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.109.191", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group", "unc1151", "ip addresses", "service", "pterodo", "contact", "footer", "vnc domains", "ghostwriter", "PartyTicket", "reload", "open", "iocs cluster", "install", "ukraine", "Primitive Bear", "russia", "sha256", "form", "main", "ransomware", "HermeticWiper", "filehashmd5", "virustotal", "pteranodon", "june"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 194.67.109.90
source: otx
validated_at: 2026-04-02T18:53:00.571143
raw_response:
  {"pulse_count": 10, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.109.90", "tags": ["url https", "WhisperGate", "explore", "fedotov", "samples", "ripe database", "registrant", "armageddon", "copy", "filtered", "ghostwriter", "conditions", "reload", "role", "Primitive Bear", "sha256", "enterprise", "Gamardeon", "wildfire", "star", "khersonskaya", "meta", "domain", "path", "dbf3ripe", "Cyclops", "is13", "ip address", "palo alto", "ddos", "stealer", "span", "vkcompanymnt", "ip addresses", "control center", "internet number", "contact", "vnc domains", "PartyTicket", "iocs cluster", "registry", "russia", "ransomware", "filehashmd5", "virustotal", "maintainer", "geopolitical conflict", "button", "url http", "whispergate"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "RIPE Database Terms and Conditions &mdash; RIPE Network Coordination Centre", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 1, "passive_dns_count": 78, "malware_samples": ["51aa860348fc9cfc6d245a1041ae756240296099f1e5511f61d72e91f006811b"], "passive_dns": ["bishbody.com", "sozodanie.ru", "www.sozodanie.ru", "didux.ru", "l9a956e5.justinstalledpanel.com", "coliadinae.online", "empusidae.online", "putrif.ru", "meandrusas.online", "tomond.ru", "apidaet.online", "anisoptera.online", "false.grafitto.ru", "dahmke.ru", "aerogenosa.ru", "eurypterida.online", "papiliot.online", "mantidae.online", "mantodeas.online", "morphinaes.online"]}


ioc_type: ipv4
ioc_value: 194.67.110.89
source: otx
validated_at: 2026-04-02T18:53:22.992127
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.110.89", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 194.67.111.121
source: otx
validated_at: 2026-04-02T18:53:28.498659
raw_response:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.111.121", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047", "slapstick"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "Test Pulse", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake"], "malware_count": 0, "passive_dns_count": 126, "malware_samples": [], "passive_dns": ["blag.vitahit.ru", "alex.vitahit.ru", "franchise.vitahit.ru", "uss.vitahit.ru", "vitahit.ru", "khv.vitahit.ru", "irk.vitahit.ru", "www.vitahit.ru", "nn.vitahit.ru", "opt.vitahit.ru", "libellulidae.online", "empusidae.online", "kilogar.ru", "tubercur.ru", "lovers.semara.ru", "aerogenosa.ru", "alloy.vadilops.ru", "hurama.ru", "fortias.ru", "blaberidae.r


ioc_type: ipv4
ioc_value: 194.67.113.120
source: otx
validated_at: 2026-04-02T18:53:35.998652
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.113.120", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon", "script", "primitivebear", "sha256", "ghostwriter", "github", "code", "path", "quietsieve", "runprogram", "span", "gamaredon group", "unit", "star", "russia", "button", "whispergate", "pterodo", "install", "armageddon", "enterprise", "iocs cluster", "primitive bear", "Gamardeon", "alliance"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 33, "malware_samples": [], "passive_dns": ["mx.ipmbisultanova.ru", "dahmke.ru", "lophacris.online", "apaturinae.online", "limenitidinae.online", "haromo.ru", "dipteran.online", "limulusa.online", "apidaet.online", "graphiuma.online", "biblidinae.online", "arachnidas.online", "libellulidae.online", "cholerd.ru", "oderas.ru", "nematoceras.online", "megatos.online", "metcalfas.online", "acetobacter.online", "fanniidae.online"]}


ioc_type: ipv4
ioc_value: 194.67.113.186
source: otx
validated_at: 2026-04-02T18:53:41.210120
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.113.186", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 130, "malware_samples": [], "passive_dns": ["zarkino.online", "www.primextula.ru", "primextula.ru", "dionysi.online", "blaberidae.online", "morphinaes.online", "graphiuma.online", "tomond.ru", "dahmke.ru", "asilidae.online", "limenitis.online", "gonepteryx.online", "megatos.online", "nematoceras.online


ioc_type: ipv4
ioc_value: 194.67.113.99
source: otx
validated_at: 2026-04-02T18:53:54.188559
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.113.99", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 76, "malware_samples": [], "passive_dns": ["nymphalidaes.online", "brachycera.online", "debarys.ru", "lepidopteras.online", "putrif.ru", "sporog.ru", "apoxipodes.online", "acetobacter.online", "shermano.ru", "cholerd.ru", "coleopteras.online", "lycaenidae.online", "libellulat.online", "limenitis.online"


ioc_type: ipv4
ioc_value: 194.67.113.50
source: otx
validated_at: 2026-04-02T18:53:59.058726
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.113.50", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group", "unc1151", "ip addresses", "service", "pterodo", "contact", "footer", "vnc domains", "ghostwriter", "PartyTicket", "reload", "open", "iocs cluster", "install", "ukraine", "Primitive Bear", "russia", "sha256", "form", "main", "ransomware", "HermeticWiper", "filehashmd5", "virustotal", "pteranodon", "june"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 194.67.116.180
source: otx
validated_at: 2026-04-02T18:54:14.765287
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.116.180", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 194.67.116.250
source: otx
validated_at: 2026-04-02T18:54:28.069837
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.116.250", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 194.67.116.51
source: otx
validated_at: 2026-04-02T18:54:30.723254
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.116.51", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group", "unc1151", "ip addresses", "service", "pterodo", "contact", "footer", "vnc domains", "ghostwriter", "PartyTicket", "reload", "open", "iocs cluster", "install", "ukraine", "Primitive Bear", "russia", "sha256", "form", "main", "ransomware", "HermeticWiper", "filehashmd5", "virustotal", "pteranodon", "june"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 50, "malware_samples": [], "passive_dns": ["sporog.ru", "oderas.ru", "acetobacter.online", "coliadinae.online", "dipteran.online", "gorimana.site", "cerambycidae.online", "false.grafitto.ru", "debarys.ru", "apoxipodes.online", "metcalfas.online", "empusidae.online", "proteug.ru", "nematoceras.online", "hamadryas.online", "lophacris.online", "ariuma.ru", "blattodea.ru", "noctuidaes.online", "gonepteryx.online"]}


ioc_type: ipv4
ioc_value: 194.67.116.67
source: otx
validated_at: 2026-04-02T18:54:36.336013
raw_response:
  {"pulse_count": 25, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.116.67", "tags": ["qakbot", "WhisperGate", "slapstick", "remcom", "powgoop", "armageddon", "lazagne", "crackmapexec", "shuckworm", "vbscript b", "tsunami", "ghostwriter", "malware", "sha256", "symantec", "wildfire", "Gamardeon", "defender", "alertinfo", "domain", "deviceid", "Cyclops", "ip address", "palo alto", "ddos", "stealer", "wiper", "kernel32", "c server", "g0047", "PartyTicket", "august", "muddywater", "dword", "russia", "explorer", "actinium", "ransomware", "filehashmd5", "virustotal", "redrum", "trickbot", "geopolitical conflict", "raccoon", "whispergate", "mimikatz", "mirai", "cyclopsblink c", "powersploit", "gafgyt"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "IOCs for the recent Cyber Activities of Russian Hackers Targeting Ukraine "], "malware_count": 0, "passive_dns_count": 4, "malware_samples": [], "passive_dns": ["www.glebm.xyz", "glebm.xyz", "hellyheyner.space", "www.hellyheyner.space"]}


ioc_type: ipv4
ioc_value: 194.67.116.81
source: otx
validated_at: 2026-04-02T18:54:56.837304
raw_response:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.116.81", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "DDoS", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "2022", "ukraine", "RTBH", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147", "wildfire"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "Uzaktan Tetiklenen Kara Delik", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 194.67.71.4
source: otx
validated_at: 2026-04-02T18:55:13.782836
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.71.4", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon", "script", "primitivebear", "sha256", "ghostwriter", "github", "code", "path", "quietsieve", "runprogram", "span", "gamaredon group", "unit", "star", "russia", "button", "whispergate", "pterodo", "install", "armageddon", "enterprise", "iocs cluster", "primitive bear", "Gamardeon", "alliance"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["ea99496be51e5e4ddd0402e1e25fae3d07bb3bf7e0035408fb0b78bcbca0b91c"]}


ioc_type: ipv4
ioc_value: 194.67.71.55
source: otx
validated_at: 2026-04-02T18:55:28.445083
raw_response:
  {"pulse_count": 12, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.71.55", "tags": ["WhisperGate", "explore", "samples", "redline stealer", "armageddon", "copy", "blog", "ghostwriter", "reload", "Primitive Bear", "sha256", "enterprise", "Gamardeon", "wildfire", "star", "meta", "domain", "path", "Cyclops", "ip address", "palo alto", "ddos", "stealer", "span", "knowledge", "ip addresses", "contact", "vnc domains", "PartyTicket", "iocs cluster", "sample", "russia", "ransomware", "whoisxml api", "filehashmd5", "virustotal", "geopolitical conflict", "button", "whispergate", "open", "cyclopsblink c", "network", "primitive bear", "powershell", "script", "APT", "userprofile", "dancho danchev", "link", "unc1151"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Exposing the C&amp;C and IoC Infrastructure of the Redline Stealer Malicious Software - An Analysis - Security Boulevard", "Exposing the C&amp;C and IoC Infrastructure of the Redline Stealer Malicious Software - An Analysis - Security Boulevard", "Exposing the C&amp;C and IoC Infrastructure of the Redline Stealer Malicious Software - An Analysis - Security Boulevard", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 194.67.86.167
source: otx
validated_at: 2026-04-02T18:55:35.983216
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.86.167", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 84, "malware_samples": [], "passive_dns": ["tomond.ru", "kilogar.ru", "proteug.ru", "blattodea.ru", "aerogenosa.ru", "lovers.semara.ru", "mycodar.ru", "tubercur.ru", "mesant.online", "erati.ru", "alloy.vadilops.ru", "putrif.ru", "hurama.ru", "baryo.ru", "mucora.ru", "polyphemus.ru", "nematoceras.ru", "limen


ioc_type: ipv4
ioc_value: 194.67.86.169
source: otx
validated_at: 2026-04-02T18:56:06.016596
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.86.169", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 194.67.86.240
source: otx
validated_at: 2026-04-02T18:56:19.593153
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.86.240", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 194.67.87.29
source: otx
validated_at: 2026-04-02T18:56:42.070692
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.87.29", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 194.67.90.15
source: otx
validated_at: 2026-04-02T18:56:56.948668
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.90.15", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 194.67.90.215
source: otx
validated_at: 2026-04-02T18:57:05.617308
raw_response:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.90.215", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047", "slapstick"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "Test Pulse", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake"], "malware_count": 0, "passive_dns_count": 10, "malware_samples": [], "passive_dns": ["lb96aeac.justinstalledpanel.com", "www.testzakaz.ru", "testzakaz.ru", "ur-time.ru", "www.ur-time.ru", "gakhramanov.site", "deshar.ishkola.com", "bbb.ishkola.com", "www.nikecontractor.xyz", "nikecontractor.xyz"]}


ioc_type: ipv4
ioc_value: 194.67.90.78
source: otx
validated_at: 2026-04-02T18:57:24.027395
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.90.78", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 194.67.93.85
source: otx
validated_at: 2026-04-02T18:57:41.525403
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "194.67.93.85", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group", "unc1151", "ip addresses", "service", "pterodo", "contact", "footer", "vnc domains", "ghostwriter", "PartyTicket", "reload", "open", "iocs cluster", "install", "ukraine", "Primitive Bear", "russia", "sha256", "form", "main", "ransomware", "HermeticWiper", "filehashmd5", "virustotal", "pteranodon", "june"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 195.133.88.128
source: otx
validated_at: 2026-04-02T18:57:50.254664
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Poland", "country_code": "PL", "city": null, "asn": "ASNone ", "indicator": "195.133.88.128", "tags": ["backdoors", "vbscript", "malicious", "gamaredon", "options", "word template", "stealers", "apt", "sample hashes", "pterosteal", "pteropshell", "pterolnk", "first", "office macro", "welivesecurity"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 195.140.146.128
source: otx
validated_at: 2026-04-02T18:58:10.277192
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS29182 jsc iot", "indicator": "195.140.146.128", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 195.62.53.63
source: otx
validated_at: 2026-04-02T18:58:20.588226
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS44812 ip server llc", "indicator": "195.62.53.63", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 10, "passive_dns_count": 14, "malware_samples": ["eba3b80cbba5b7176b652913c39f9ea924320d9a528bb592f124b0f3f428be8f", "e881ce0a01924cd9d92492f4a0acb550e8e4769d1f08f05ef7770f0ac50940d5", "7568d2f74da2006dc2fc61ede2352907ba45ba552696c21ad4ad4b2cb3e19afc", "86c86285c6e374b4697ecf3e1a47b20c29693112196a2441bed6f472886c452e", "46594d14f3968bd424566ef256201db36


ioc_type: ipv4
ioc_value: 199.247.14.64
source: otx
validated_at: 2026-04-02T18:58:37.349921
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "France", "country_code": "FR", "city": "Aubervilliers", "asn": "AS20473 the constant company  llc", "indicator": "199.247.14.64", "tags": ["url https", "Gamaredon", "Gamaredon Group", "sample", "threatactor.primitivebear", "Trident Ursa", "domain", "threatactor/actinium", "threatactor/gamaredon", "threatactor/tridentursa", "ip address"], "pulses": ["Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 206.81.0.182
source: otx
validated_at: 2026-04-02T18:58:54.102418
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "North Bergen", "asn": "AS14061 digitalocean  llc", "indicator": "206.81.0.182", "tags": ["Gamaredon", "domain", "Trident Ursa", "url https", "threatactor.primitivebear", "threatactor/tridentursa", "Gamaredon Group", "threatactor/actinium", "sample", "ip address", "threatactor/gamaredon"], "pulses": ["Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine"], "malware_count": 0, "passive_dns_count": 8, "malware_samples": [], "passive_dns": ["ee.atoztheatrical.com", "obatnabikintunduh.jadiwehsyaree.tunduhteukuat.com", "gesbeakdeui.kuduradadiseutokeun.gelasbelahtilu.com", "tapunyacintauntuk.nyamamatgoberkeun.podlalengitan.com", "www.xn--bbanetcashs-uhb.com", "www.blbvanetcahs.com", "turbov.internetdigital.xyz", "meq12.brtwer.xyz"]}


ioc_type: ipv4
ioc_value: 209.38.97.36
source: otx
validated_at: 2026-04-02T18:59:12.398178
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "209.38.97.36", "tags": ["spearphishing", "cloudflare tunnels", "powershell", "scanners", "ssh", "apt", "honeypot", "RimbaSiber"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "Malware Filter - Botnet List - 11-10-2025", "Rimba Siber (Malaysia) SSH Attacker Hosts for 2025-10-10", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 209.97.165.187
source: otx
validated_at: 2026-04-02T18:59:15.297718
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Singapore", "country_code": "SG", "city": "Singapore", "asn": "AS14061 digitalocean  llc", "indicator": "209.97.165.187", "tags": ["backdoors", "vbscript", "malicious", "gamaredon", "options", "word template", "stealers", "apt", "sample hashes", "pterosteal", "pteropshell", "pterolnk", "first", "office macro", "welivesecurity"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 212.18.104.56
source: otx
validated_at: 2026-04-02T18:59:18.292884
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "", "country_code": "", "city": "", "asn": "AS211119 anas firas flayyih al-qaysi", "indicator": "212.18.104.56", "tags": ["backdoors", "vbscript", "malicious", "gamaredon", "options", "word template", "stealers", "apt", "sample hashes", "pterosteal", "pteropshell", "pterolnk", "first", "office macro", "welivesecurity"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["5632e4098908e5a59f242493b8a066a5a8ad83f6a3267a620afe95461383bcba"], "passive_dns": []}


ioc_type: ipv4
ioc_value: 216.238.69.137
source: otx
validated_at: 2026-04-02T18:59:41.956583
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Philadelphia", "asn": "AS20473 the constant company  llc", "indicator": "216.238.69.137", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 217.25.89.191
source: otx
validated_at: 2026-04-02T19:00:02.398151
raw_response:
  {"pulse_count": 26, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "217.25.89.191", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147", "wildfire", "Gamardeon", "quietsieve", "raccoon", "domain"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "jintingtingtesttest", "jintingtingtesttest", "jintingtingtesttest", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["c68eb2fa929373cac727764d2cc5ca94f19a0ec7fd8c0876b98f946e72d9fa03"]}


ioc_type: ipv4
ioc_value: 217.69.0.35
source: otx
validated_at: 2026-04-02T19:00:02.807519
raw_response:
  {"pulse_count": 15, "reputation": 0, "country": "France", "country_code": "FR", "city": "Aubervilliers", "asn": "AS20473 the constant company  llc", "indicator": "217.69.0.35", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "powgoop", "PartyTicket", "IsaacWiper", "gafgyt", "HermeticWiper", "lazagne", "redrum", "filehashmd5", "pupyrat", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "august stealer", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047", "slapstick", "pupy", "razy", "s0147", "remcom", "Cyclops", "ddos"], "pulses": ["BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "2024-DIC-10-Clon", "CLON IPIF", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs"], "malware_count": 1, "passive_dns_count": 7, "malware_samples": ["37c7bf70159d38b0a5565a7d1e09f22bee87cba8b69de016f49f289defed465a"], "passive_dns": ["babacoach.fr", "www.babacoach.fr", "backoffice.babacoach.com", "www.babacoach.com", "visio.babacoach.com", "babacoach.com", "api.babacoach.com"]}


ioc_type: ipv4
ioc_value: 217.69.4.51
source: otx
validated_at: 2026-04-02T19:00:23.334631
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "France", "country_code": "FR", "city": "Aubervilliers", "asn": "AS20473 the constant company  llc", "indicator": "217.69.4.51", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 31.31.203.17
source: otx
validated_at: 2026-04-02T19:00:33.193803
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "31.31.203.17", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 55, "malware_samples": [], "passive_dns": ["allqlt.online", "allqrt.space", "rosgradusnik.ru", "allqrt.site", "klarasita.ru", "31-31-203-17.cloudvps.regruhosting.ru", "ariuma.ru", "maniola.online", "debarys.ru", "papiliot.online", "false.grafitto.ru", "oderas.ru", "kallima.online", "proteug.ru", "fusari.ru",


ioc_type: ipv4
ioc_value: 31.31.203.219
source: otx
validated_at: 2026-04-02T19:00:43.751079
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "31.31.203.219", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 124, "malware_samples": [], "passive_dns": ["xn----etb1b.xn--p1ai", "www.xn----etb1b.xn--p1ai", "lb130473.justinstalledpanel.com", "31-31-203-219.cloudvps.regruhosting.ru", "proguru.space", "shelbycompany.space", "keitaro.shelbycompany.space", "acrididae.online", "kilogar.ru", "lovers.semara.ru", "tubercur.


ioc_type: ipv4
ioc_value: 31.31.203.71
source: otx
validated_at: 2026-04-02T19:00:49.847059
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "31.31.203.71", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon", "script", "primitivebear", "sha256", "ghostwriter", "github", "code", "path", "quietsieve", "runprogram", "span", "gamaredon group", "unit", "star", "russia", "button", "whispergate", "pterodo", "install", "armageddon", "enterprise", "iocs cluster", "primitive bear", "Gamardeon", "alliance"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 31.40.251.145
source: otx
validated_at: 2026-04-02T19:00:55.410119
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS43830 digital energy llc", "indicator": "31.40.251.145", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["royalapproach.ru"]}


ioc_type: ipv4
ioc_value: 31.40.251.171
source: otx
validated_at: 2026-04-02T19:01:04.841912
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS43830 digital energy llc", "indicator": "31.40.251.171", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 13, "malware_samples": [], "passive_dns": ["wtv23.6822931.xyz", "device-client-actions.com", "device-confirm-client.com", "device-client-history.com", "device-history-client.com", "device-approve-client.com", "device-client-approve.com", "device-client-action.com", "device-client-warn.com", "device-client-verify.com


ioc_type: ipv4
ioc_value: 37.140.195.137
source: otx
validated_at: 2026-04-02T19:01:18.365804
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "37.140.195.137", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 147, "malware_samples": [], "passive_dns": ["skud.skladovka.ru", "37-140-195-137.xs.vps.regruhosting.ru", "37-140-195-137.xen.vps.regruhosting.ru", "37-140-195-137.ovz.vps.regruhosting.ru", "lepist.ru", "lepist.space", "37-140-195-137.cloudvps.regruhosting.ru", "counter.podloka.ru", "kilogar.ru", "love


ioc_type: ipv4
ioc_value: 37.140.197.55
source: otx
validated_at: 2026-04-02T19:01:33.741066
raw_response:
  {"pulse_count": 10, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "37.140.197.55", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group", "unc1151", "ip addresses", "service", "pterodo", "contact", "footer", "vnc domains", "ghostwriter", "PartyTicket", "reload", "open", "iocs cluster", "install", "ukraine", "Primitive Bear", "russia", "sha256", "form", "main", "ransomware", "HermeticWiper", "filehashmd5", "virustotal", "pteranodon", "june"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Gamaredon OSINT Dump", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 121, "malware_samples": [], "passive_dns": ["37-140-197-55.cloudvps.regruhosting.ru", "mx.ipakachaeva.ru", "wnw02.sectorfinancierociti.com", "lovers.semara.ru", "tubercur.ru", "kilogar.ru", "alloy.vadilops.ru", "hurama.ru", "libellulat.ru", "libellulidae.ru", "lepidopteras.ru", "graphosoma.ru", "gonepteryx.ru", "dipteran.ru", "apaturinae.ru", "fanniidae.ru", "cyrestinae.ru", "empusidae.ru", "coliadinae.ru", "scorpiones.online"]}


ioc_type: ipv4
ioc_value: 37.140.197.206
source: otx
validated_at: 2026-04-02T19:01:37.445811
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "37.140.197.206", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 67, "malware_samples": [], "passive_dns": ["neural.photophone.site", "37-140-197-206.cloudvps.regruhosting.ru", "apaturinae.online", "cyrestinae.online", "cholerd.ru", "libellulidae.online", "tubercur.ru", "brachycera.online", "apidaet.online", "gonepteryx.online", "blaberidae.online", "limenitidinae.o


ioc_type: ipv4
ioc_value: 37.140.199.20
source: otx
validated_at: 2026-04-02T19:01:52.577512
raw_response:
  {"pulse_count": 26, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "37.140.199.20", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047", "slapstick"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "Test Pulse", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake"], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "passive_dns": ["37-140-199-20.cloudvps.regruhosting.ru", "pvh-lodki.ru"]}


ioc_type: ipv4
ioc_value: 37.140.199.224
source: otx
validated_at: 2026-04-02T19:02:14.720946
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "37.140.199.224", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 45.134.255.131
source: otx
validated_at: 2026-04-02T19:02:30.168217
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS43830 digital energy llc", "indicator": "45.134.255.131", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon", "script", "primitivebear", "sha256", "ghostwriter", "github", "code", "path", "quietsieve", "runprogram", "span", "gamaredon group", "unit", "star", "russia", "button", "whispergate", "pterodo", "install", "armageddon", "enterprise", "iocs cluster", "primitive bear", "Gamardeon", "alliance"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 1, "passive_dns_count": 75, "malware_samples": ["bb34a3c2f723340a1a4d35e41acf1f72a7e6a1e1a136d305e1ad0c88265d8b5a"], "passive_dns": ["www.gholam.ru", "gholam.ru", "zeinare.ru", "principles.vositra.ru", "sand.striman.ru", "gloomy.striman.ru", "clap.vositra.ru", "claimed.striman.ru", "nearly.striman.ru", "bicyclelist.baldasha.ru", "percy.striman.ru", "intercourse.vositra.ru", "allied.striman.ru", "slovorti.ru", "necessity.striman.ru", "perfection.baldasha.ru", "bluera.ru", "sally.striman.ru", "false.striman.ru", "biblidinae.online"]}


ioc_type: ipv4
ioc_value: 45.32.149.8
source: otx
validated_at: 2026-04-02T19:02:32.610294
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "France", "country_code": "FR", "city": "Aubervilliers", "asn": "AS20473 the constant company  llc", "indicator": "45.32.149.8", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "powgoop", "PartyTicket", "IsaacWiper", "gafgyt", "HermeticWiper", "lazagne", "redrum", "filehashmd5", "pupyrat", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "august stealer", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047", "slapstick", "pupy", "razy", "s0147", "remcom", "Cyclops", "ddos"], "pulses": ["Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 45.77.11.107
source: otx
validated_at: 2026-04-02T19:02:49.514534
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "Japan", "country_code": "JP", "city": "Heiwajima", "asn": "AS20473 the constant company  llc", "indicator": "45.77.11.107", "tags": ["url https", "Gamaredon", "Gamaredon Group", "sample", "threatactor.primitivebear", "Trident Ursa", "domain", "threatactor/actinium", "threatactor/gamaredon", "threatactor/tridentursa", "ip address"], "pulses": ["Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 45.77.229.187
source: otx
validated_at: 2026-04-02T19:02:54.526950
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS20473 the constant company  llc", "indicator": "45.77.229.187", "tags": ["domain", "ukraine", "threatactor/tridentursa", "apt", "Gamaredon Group", "dns flux", "gamaredon", "url https", "threatactor.primitivebear", "phishing", "maldocs", "Gamaredon", "russia", "Trident Ursa", "threatactor/actinium", "sample", "trident ursa", "ip address", "threatactor/gamaredon"], "pulses": ["Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa ( Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa ( Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 46.29.234.46
source: otx
validated_at: 2026-04-02T19:02:57.757749
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Volzhskiy", "asn": "AS34804 jsc eurotelecom", "indicator": "46.29.234.46", "tags": ["backdoors", "vbscript", "malicious", "gamaredon", "options", "word template", "stealers", "apt", "sample hashes", "pterosteal", "pteropshell", "pterolnk", "first", "office macro", "welivesecurity"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["alphanetsphere.com"]}


ioc_type: ipv4
ioc_value: 5.181.156.109
source: otx
validated_at: 2026-04-02T19:03:01.306589
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Moldova, Republic of", "country_code": "MD", "city": "Chisinau", "asn": "AS39798 mivocloud srl", "indicator": "5.181.156.109", "tags": ["welivesecurity", "sample hashes", "backdoors", "apt", "malicious", "pterolnk", "pteropshell", "word template", "stealers", "office macro", "vbscript", "gamaredon", "pterosteal", "first", "options"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023"], "malware_count": 0, "passive_dns_count": 2, "malware_samples": [], "passive_dns": ["cm-loginprivate.com", "www.cm-loginprivate.com"]}


ioc_type: ipv4
ioc_value: 5.252.178.140
source: otx
validated_at: 2026-04-02T19:03:09.218139
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Romania", "country_code": "RO", "city": "Iasi", "asn": "AS39798 mivocloud srl", "indicator": "5.252.178.140", "tags": ["backdoors", "vbscript", "malicious", "gamaredon", "options", "word template", "stealers", "apt", "sample hashes", "pterosteal", "pteropshell", "pterolnk", "first", "office macro", "welivesecurity"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["nr.globalirishdating.com"]}


ioc_type: ipv4
ioc_value: 5.63.152.233
source: otx
validated_at: 2026-04-02T19:03:18.403295
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "5.63.152.233", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon", "script", "primitivebear", "sha256", "ghostwriter", "github", "code", "path", "quietsieve", "runprogram", "span", "gamaredon group", "unit", "star", "russia", "button", "whispergate", "pterodo", "install", "armageddon", "enterprise", "iocs cluster", "primitive bear", "Gamardeon", "alliance"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 1, "passive_dns_count": 500, "malware_samples": ["420960a10e3f3730ab124bfefceedc032ef06c7b38fa014b2b59462365a5f08d"], "passive_dns": ["status.wgnet.work", "nmon.wgnet.work", "5-63-152-233.cloudvps.regruhosting.ru", "alloy.vadilops.ru", "vostilo.ru", "warau.ru", "vosita.ru", "vidarri.ru", "vodagi.ru", "wokoras.ru", "wakatteru.ru", "vositra.ru", "voranfi.ru", "volotras.ru", "prisonta.ru", "protimas.ru", "powerton.ru", "raidata.ru", "poznari.ru", "portalahr.ru"]}


ioc_type: ipv4
ioc_value: 5.63.154.128
source: otx
validated_at: 2026-04-02T19:03:38.953063
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "5.63.154.128", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 5.63.158.179
source: otx
validated_at: 2026-04-02T19:03:55.801682
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "5.63.158.179", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 102, "malware_samples": [], "passive_dns": ["autofides.ru", "baikalcdn.ru", "www.baikalcdn.ru", "5-63-158-179.cloudvps.regruhosting.ru", "glorious.nonima.ru", "kilogar.ru", "tubercur.ru", "lovers.semara.ru", "alloy.vadilops.ru", "hurama.ru", "baryo.ru", "mucora.ru", "fanniidae.ru", "graphosoma.ru", "gonepter


ioc_type: ipv4
ioc_value: 5.63.154.19
source: otx
validated_at: 2026-04-02T19:03:58.830279
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "5.63.154.19", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 117, "malware_samples": [], "passive_dns": ["btc-worm.ru", "www.btc-worm.ru", "dotsatoshi.ru", "www.dotsatoshi.ru", "www.smart-obmen.ru", "smart-obmen.ru", "www.exchange-key.com", "exchange-key.com", "www.x-rates.ru", "x-rates.ru", "ars-pt.ru", "www.ars-pt.ru", "5-63-154-19.cloudvps.regruhosting.ru", "tub


ioc_type: ipv4
ioc_value: 5.63.158.233
source: otx
validated_at: 2026-04-02T19:04:03.967808
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "5.63.158.233", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 2, "passive_dns_count": 94, "malware_samples": ["1af147121753462686625c1ade9b5b847d861bffcbc710fbfb8be83a345352c8", "5264a7c10f45740360a1d871f026e1e55f4eb85f21fdc9b08cf8d17458c0ac8a"], "passive_dns": ["api.tringle.work", "www.api.tringle.work", "www.nskiphone-crm.this-is-web.ru", "nskiphone-crm.this-is-web.ru", "api.nskiphone-c


ioc_type: ipv4
ioc_value: 5.63.158.238
source: otx
validated_at: 2026-04-02T19:04:14.215307
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "5.63.158.238", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 2, "passive_dns_count": 79, "malware_samples": ["ac4786ce9a487fe79cb8ed44d19767a6b6604f88393b04897a3b87fbc58dd0cc", "73d0a401ee6ca6ac03cc74e7f00718cb218a49de8c0c3df8fc5d689e5a24474b"], "passive_dns": ["promokotikbot.ru", "www.promokotikbot.ru", "5-63-158-238.cloudvps.regruhosting.ru", "noctuidaes.online", "mantidae.online", "li


ioc_type: ipv4
ioc_value: 62.133.62.73
source: otx
validated_at: 2026-04-02T19:04:21.414159
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS48430 perviy tsod llc", "indicator": "62.133.62.73", "tags": ["backdoors", "vbscript", "malicious", "gamaredon", "options", "word template", "stealers", "apt", "sample hashes", "pterosteal", "pteropshell", "pterolnk", "first", "office macro", "welivesecurity"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["smtp.saberx.tech"]}


ioc_type: ipv4
ioc_value: 64.227.139.249
source: otx
validated_at: 2026-04-02T19:04:24.207469
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Atlanta", "asn": "AS14061 digitalocean  llc", "indicator": "64.227.139.249", "tags": ["spearphishing", "apt", "cloudflare tunnels", "powershell"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 64.227.172.243
source: otx
validated_at: 2026-04-02T19:04:29.840786
raw_response:
  {"pulse_count": 2, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Atlanta", "asn": "AS14061 digitalocean  llc", "indicator": "64.227.172.243", "tags": ["apt", "powershell", "spearphishing", "cloudflare tunnels"], "pulses": ["Gamaredon in 2024: Cranking out spearphishing campaigns against Ukraine with an evolved toolset", "IOC - Gamaredon in 2024: Cranking out spearphishing campaigns"], "malware_count": 0, "passive_dns_count": 7, "malware_samples": [], "passive_dns": ["beauty-domain.autos", "vobuehcip.com", "munshak.ca.3cx.us", "www.makkaldaily.xyz", "makkaldaily.xyz", "api.makkaldaily.xyz", "goldenbricks.3cx.in"]}


ioc_type: ipv4
ioc_value: 67.205.160.237
source: otx
validated_at: 2026-04-02T19:04:33.219743
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "North Bergen", "asn": "AS14061 digitalocean  llc", "indicator": "67.205.160.237", "tags": ["iran", "gamaredon", "canada", "welivesecurity", "mexico", "backdoors", "singapore", "pterolnk", "china", "netherlands", "germany", "options", "malicious", "apt", "brazil", "pteropshell", "word template", "stealers", "india", "united", "sample hashes", "vbscript", "pterosteal", "office macro", "first", "vietnam"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "20221110 Most Active Threat Indicators"], "malware_count": 0, "passive_dns_count": 6, "malware_samples": [], "passive_dns": ["ejgmve.easypanel.host", "upcatalogo-evolution.ejgmve.easypanel.host", "reozf.net", "testftp.statenweb.com", "baq360.com", "cherrygirl.us"]}


ioc_type: ipv4
ioc_value: 68.183.2.92
source: otx
validated_at: 2026-04-02T19:04:51.000303
raw_response:
  {"pulse_count": 5, "reputation": 0, "country": "Netherlands", "country_code": "NL", "city": "Amsterdam", "asn": "AS14061 digitalocean  llc", "indicator": "68.183.2.92", "tags": ["welivesecurity", "sample hashes", "backdoors", "apt", "malicious", "pterolnk", "pteropshell", "word template", "stealers", "office macro", "vbscript", "gamaredon", "pterosteal", "first", "options"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "IOCs - 2022511143", "resteex_blacklist_(ipset|hash:ip)_20220423_LVL0"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 70.34.194.123
source: otx
validated_at: 2026-04-02T19:05:11.775845
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20473 the constant company  llc", "indicator": "70.34.194.123", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 70.34.194.31
source: otx
validated_at: 2026-04-02T19:05:31.753289
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20473 the constant company  llc", "indicator": "70.34.194.31", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 70.34.195.75
source: otx
validated_at: 2026-04-02T19:05:51.785599
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20473 the constant company  llc", "indicator": "70.34.195.75", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 70.34.197.185
source: otx
validated_at: 2026-04-02T19:06:11.919521
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20473 the constant company  llc", "indicator": "70.34.197.185", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 70.34.199.214
source: otx
validated_at: 2026-04-02T19:06:27.799952
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20473 the constant company  llc", "indicator": "70.34.199.214", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 6, "malware_samples": [], "passive_dns": ["856393-icloud.com", "teroba.ru", "myces.ru", "krashand.ru", "www.anyboard.xyz", "anyboard.xyz"]}


ioc_type: ipv4
ioc_value: 70.34.198.226
source: otx
validated_at: 2026-04-02T19:06:32.702871
raw_response:
  {"pulse_count": 25, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20473 the constant company  llc", "indicator": "70.34.198.226", "tags": ["qakbot", "WhisperGate", "slapstick", "remcom", "powgoop", "armageddon", "lazagne", "crackmapexec", "shuckworm", "vbscript b", "tsunami", "ghostwriter", "malware", "sha256", "symantec", "wildfire", "Gamardeon", "defender", "alertinfo", "domain", "deviceid", "Cyclops", "ip address", "palo alto", "ddos", "stealer", "wiper", "kernel32", "c server", "g0047", "PartyTicket", "august", "muddywater", "dword", "russia", "explorer", "actinium", "ransomware", "filehashmd5", "virustotal", "redrum", "trickbot", "geopolitical conflict", "raccoon", "whispergate", "mimikatz", "mirai", "cyclopsblink c", "powersploit", "gafgyt"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "IOCs for the recent Cyber Activities of Russian Hackers Targeting Ukraine "], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 70.34.202.55
source: otx
validated_at: 2026-04-02T19:06:39.269981
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20473 the constant company  llc", "indicator": "70.34.202.55", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 70.34.204.141
source: otx
validated_at: 2026-04-02T19:06:44.951966
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20473 the constant company  llc", "indicator": "70.34.204.141", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 70.34.204.74
source: otx
validated_at: 2026-04-02T19:07:05.718169
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20473 the constant company  llc", "indicator": "70.34.204.74", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 70.34.208.32
source: otx
validated_at: 2026-04-02T19:07:11.757258
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20473 the constant company  llc", "indicator": "70.34.208.32", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["penpen.wavy.ws"]}


ioc_type: ipv4
ioc_value: 80.78.240.210
source: otx
validated_at: 2026-04-02T19:07:32.466683
raw_response:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.240.210", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047", "slapstick"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Gamaredon OSINT Dump"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["827eac0162253038b904ab3d4004d3b7c5ae1fb9ebd7c8c3d0b20064dc2c9dc0"]}


ioc_type: ipv4
ioc_value: 80.78.241.253
source: otx
validated_at: 2026-04-02T19:07:53.891426
raw_response:
  {"pulse_count": 25, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.241.253", "tags": ["qakbot", "WhisperGate", "slapstick", "remcom", "powgoop", "armageddon", "lazagne", "crackmapexec", "shuckworm", "vbscript b", "tsunami", "ghostwriter", "malware", "sha256", "symantec", "wildfire", "Gamardeon", "defender", "alertinfo", "domain", "deviceid", "Cyclops", "ip address", "palo alto", "ddos", "stealer", "wiper", "kernel32", "c server", "g0047", "PartyTicket", "august", "muddywater", "dword", "russia", "explorer", "actinium", "ransomware", "filehashmd5", "virustotal", "redrum", "trickbot", "geopolitical conflict", "raccoon", "whispergate", "mimikatz", "mirai", "cyclopsblink c", "powersploit", "gafgyt"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "IOCs for the recent Cyber Activities of Russian Hackers Targeting Ukraine "], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 80.78.241.88
source: otx
validated_at: 2026-04-02T19:08:00.535519
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.241.88", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 84, "malware_samples": [], "passive_dns": ["tubercur.ru", "kilogar.ru", "lovers.semara.ru", "alloy.vadilops.ru", "fortias.ru", "agaricusa.ru", "arachnidas.ru", "cyrestinae.ru", "coliadinae.ru", "apaturinae.ru", "acrididae.ru", "gromphadorhina.online", "heliconiinae.online", "mucora.ru", "baryo.ru", "gone


ioc_type: ipv4
ioc_value: 80.78.244.124
source: otx
validated_at: 2026-04-02T19:08:42.964962
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.244.124", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 80.78.244.199
source: otx
validated_at: 2026-04-02T19:08:49.905557
raw_response:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.244.199", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "2022", "ukraine", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147", "wildfire", "Gamardeon", "quietsieve"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "Test Pulse", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake"], "malware_count": 0, "passive_dns_count": 16, "malware_samples": [], "passive_dns": ["80-78-244-199.cloudvps.regruhosting.ru", "work-craft.ru", "www.work-craft.ru", "mesant.online", "melitaeas.online", "metcalfas.online", "nymphalidaes.online", "putrif.ru", "anisoptera.online", "lycaenidae.online", "kallima.online", "proteug.ru", "shiba-telegram.site", "www.server-etoro.xyz", "server-etoro.xyz", "thefamilymeal.com"]}


ioc_type: ipv4
ioc_value: 80.78.245.223
source: otx
validated_at: 2026-04-02T19:09:11.996615
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.245.223", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 80.78.245.254
source: otx
validated_at: 2026-04-02T19:09:27.768080
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.245.254", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group", "unc1151", "ip addresses", "service", "pterodo", "contact", "footer", "vnc domains", "ghostwriter", "PartyTicket", "reload", "open", "iocs cluster", "install", "ukraine", "Primitive Bear", "russia", "sha256", "form", "main", "ransomware", "HermeticWiper", "filehashmd5", "virustotal", "pteranodon", "june"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 80.78.245.89
source: otx
validated_at: 2026-04-02T19:09:48.009004
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.245.89", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 80.78.248.167
source: otx
validated_at: 2026-04-02T19:10:05.906002
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.248.167", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group", "unc1151", "ip addresses", "service", "pterodo", "contact", "footer", "vnc domains", "ghostwriter", "PartyTicket", "reload", "open", "iocs cluster", "install", "ukraine", "Primitive Bear", "russia", "sha256", "form", "main", "ransomware", "HermeticWiper", "filehashmd5", "virustotal", "pteranodon", "june"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 80.78.248.22
source: otx
validated_at: 2026-04-02T19:10:31.789036
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.248.22", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0}


ioc_type: ipv4
ioc_value: 80.78.251.191
source: otx
validated_at: 2026-04-02T19:10:50.046361
raw_response:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.251.191", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047", "slapstick"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Gamaredon OSINT Dump"], "malware_count": 1, "passive_dns_count": 119, "malware_samples": ["0c13b3528088c308ac28971fba93939c66da2eabef66a4d3790c0b1817221535"], "passive_dns": ["korovin.site", "www.ddps-csr.ru", "ddps-csr.ru", "80-78-251-191.cloudvps.regruhosting.ru", "shermano.ru", "limulusa.online", "limenitidinae.online", "ariuma.ru", "apaturinae.online", "lycaenidae.online", "empusidae.online", "maniola.online", "acrididae.online", "megatos.online


ioc_type: ipv4
ioc_value: 80.78.248.222
source: otx
validated_at: 2026-04-02T19:10:53.623736
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.248.222", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 80.78.251.231
source: otx
validated_at: 2026-04-02T19:11:28.822301
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.251.231", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0}


ioc_type: ipv4
ioc_value: 80.78.251.4
source: otx
validated_at: 2026-04-02T19:11:45.355467
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.251.4", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 34, "malware_samples": [], "passive_dns": ["alexandr-demchenko.ru", "www.alexandr-demchenko.ru", "80-78-251-4.cloudvps.regruhosting.ru", "npp-trigla.ru", "acetobacter.online", "hamadryas.online", "dipteran.online", "kallima.online", "tomond.ru", "false.grafitto.ru", "polyphemus.online", "mycodar.ru", "meandru


ioc_type: ipv4
ioc_value: 80.78.253.196
source: otx
validated_at: 2026-04-02T19:12:05.376329
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.253.196", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group", "unc1151", "ip addresses", "service", "pterodo", "contact", "footer", "vnc domains", "ghostwriter", "PartyTicket", "reload", "open", "iocs cluster", "install", "ukraine", "Primitive Bear", "russia", "sha256", "form", "main", "ransomware", "HermeticWiper", "filehashmd5", "virustotal", "pteranodon", "june"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 97, "passive_dns": ["www.ust-land.ru", "ust-land.ru", "crm.ust-land.ru", "www.crm.ust-land.ru", "web.ust-land.ru", "www.web.ust-land.ru", "www.ad.ust-land.ru", "ad.ust-land.ru", "widget.xrbh.ru", "www.widget.xrbh.ru", "fastpp1.xrbh.ru", "www.sqlpp1.xrbh.ru", "sqlpp1.xrbh.ru", "pp1.xrbh.ru", "www.pp1.xrbh.ru", "80-78-253-196.cloudvps.regruhosting.ru", "apaturinae.online", "limulusa.online", "sporog.ru", "apidaet.online"]}


ioc_type: ipv4
ioc_value: 80.78.253.26
source: otx
validated_at: 2026-04-02T19:12:23.318164
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.253.26", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group", "unc1151", "ip addresses", "service", "pterodo", "contact", "footer", "vnc domains", "ghostwriter", "PartyTicket", "reload", "open", "iocs cluster", "install", "ukraine", "Primitive Bear", "russia", "sha256", "form", "main", "ransomware", "HermeticWiper", "filehashmd5", "virustotal", "pteranodon", "june"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 80.78.253.86
source: otx
validated_at: 2026-04-02T19:12:31.878138
raw_response:
  {"pulse_count": 25, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.253.86", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "2022", "ukraine", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147", "wildfire", "Gamardeon", "quietsieve"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "agressive extra", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake"], "malware_count": 0, "passive_dns_count": 120, "malware_samples": [], "passive_dns": ["tc.yeel.studio", "01.fastpostsender.ru", "smtp.telegrambotshopsodax64.site", "td-ledavto.ru", "telegrambotshopsodax64.site", "80-78-253-86.cloudvps.regruhosting.ru", "acrididae.online", "coliadinae.online", "shermano.ru", "mamberis.ru", "acetobacter.online", "coleopteras.online", "libellulat.online", "oderas.ru", "lophacris.online", "sporog.ru", "kilogar


ioc_type: ipv4
ioc_value: 80.78.254.238
source: otx
validated_at: 2026-04-02T19:12:42.709216
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "80.78.254.238", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 6, "malware_samples": [], "passive_dns": ["esdgroup.ru", "www.esdgroup.ru", "80-78-254-238.ovz.vps.regruhosting.ru", "alono.ru", "sousourcelink.online", "80-78-254-238.cloudvps.regruhosting.ru"]}


ioc_type: ipv4
ioc_value: 80.90.181.107
source: otx
validated_at: 2026-04-02T19:13:00.515863
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS207967 anton mamaev", "indicator": "80.90.181.107", "tags": ["backdoors", "vbscript", "malicious", "gamaredon", "options", "word template", "stealers", "apt", "sample hashes", "pterosteal", "pteropshell", "pterolnk", "first", "office macro", "welivesecurity"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 82.146.39.104
source: otx
validated_at: 2026-04-02T19:13:12.773119
raw_response:
  {"pulse_count": 7, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS29182 jsc iot", "indicator": "82.146.39.104", "tags": ["domain", "ukraine", "threatactor/tridentursa", "apt", "Gamaredon Group", "dns flux", "gamaredon", "url https", "threatactor.primitivebear", "phishing", "maldocs", "Gamaredon", "russia", "Trident Ursa", "threatactor/actinium", "sample", "trident ursa", "ip address", "threatactor/gamaredon"], "pulses": ["Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa ( Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa ( Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine"], "malware_count": 1, "passive_dns_count": 8, "malware_samples": ["3e84ce7b8a3c8bab4cdc62b4fcc5761d368f4599d2838684f6d33d4a2a9191d4"], "passive_dns": ["psklg-dom.ru", "www.psklg-dom.ru", "ezambiablog.click", "techmaster.makeup", "webengincs.com", "kolizey78.ru", "www.kolizey78.ru", "l11bb0d2.justinstalledpanel.com"]}


ioc_type: ipv4
ioc_value: 83.166.247.110
source: otx
validated_at: 2026-04-02T19:13:24.857846
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS24936 llc management company svyaz", "indicator": "83.166.247.110", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 83.166.242.108
source: otx
validated_at: 2026-04-02T19:13:28.249140
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS24936 llc management company svyaz", "indicator": "83.166.242.108", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "passive_dns": []}


ioc_type: ipv4
ioc_value: 83.166.247.185
source: otx
validated_at: 2026-04-02T19:13:38.564478
raw_response:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS24936 llc management company svyaz", "indicator": "83.166.247.185", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047", "slapstick"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Gamaredon OSINT Dump"], "malware_count": 0, "passive_dns_count": 6, "malware_samples": [], "passive_dns": ["www.xn----8sbfcuhnlliceeigh0be5o7b.xn--p1ai", "xn----8sbfcuhnlliceeigh0be5o7b.xn--p1ai", "ophisaurusis.xyz", "blockpost.space", "apusa.xyz", "myrrhan.xyz"]}


ioc_type: ipv4
ioc_value: 83.166.250.21
source: otx
validated_at: 2026-04-02T19:13:44.130481
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS24936 llc management company svyaz", "indicator": "83.166.250.21", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 87.249.49.103
source: otx
validated_at: 2026-04-02T19:14:06.190329
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "St Petersburg", "asn": "AS9123 timeweb ltd.", "indicator": "87.249.49.103", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 89.108.102.37
source: otx
validated_at: 2026-04-02T19:14:12.055222
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.102.37", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 77, "malware_samples": [], "passive_dns": ["blattodea.online", "limulusa.online", "sporog.ru", "brachycera.online", "false.grafitto.ru", "mamberis.ru", "lovers.semara.ru", "aerogenosa.ru", "fusari.ru", "tubercur.ru", "tomond.ru", "kilogar.ru", "erati.ru", "mycodar.ru", "lepidopteras.online", "proteug.ru


ioc_type: ipv4
ioc_value: 89.108.102.57
source: otx
validated_at: 2026-04-02T19:14:25.128311
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.102.57", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 100, "malware_samples": [], "passive_dns": ["stamina-online.com", "gromphadorhina.ru", "limenitis.ru", "fortias.ru", "baryo.ru", "chelicerata.ru", "oderas.ru", "dionysi.online", "acrididae.online", "libellulat.online", "mantidae.online", "false.grafitto.ru", "acetobacter.online", "libellulidae.online", "mam


ioc_type: ipv4
ioc_value: 89.108.115.206
source: otx
validated_at: 2026-04-02T19:14:33.168953
raw_response:
  {"pulse_count": 10, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.115.206", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group", "unc1151", "ip addresses", "service", "pterodo", "contact", "footer", "vnc domains", "ghostwriter", "PartyTicket", "reload", "open", "iocs cluster", "install", "ukraine", "Primitive Bear", "russia", "sha256", "form", "main", "ransomware", "HermeticWiper", "filehashmd5", "virustotal", "pteranodon", "june"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Gamaredon OSINT Dump", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 7, "malware_samples": [], "passive_dns": ["www.diler.online", "diler.online", "www.bash-apteka.ru", "bash-apteka.ru", "www.thewiz.ru", "thewiz.ru", "acrididae.online"]}


ioc_type: ipv4
ioc_value: 89.108.114.11
source: otx
validated_at: 2026-04-02T19:14:34.691097
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.114.11", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon", "script", "primitivebear", "sha256", "ghostwriter", "github", "code", "path", "quietsieve", "runprogram", "span", "gamaredon group", "unit", "star", "russia", "button", "whispergate", "pterodo", "install", "armageddon", "enterprise", "iocs cluster", "primitive bear", "Gamardeon", "alliance"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 44, "malware_samples": [], "passive_dns": ["tubercur.ru", "mucora.ru", "baryo.ru", "apidaet.ru", "blaberidae.ru", "gromphadorhina.online", "lepidopteras.ru", "libellulidae.ru", "libellulat.ru", "xiphosura.online", "coliadinae.ru", "fanniidae.ru", "gonepteryx.ru", "fortias.ru", "limenitis.ru", "agaricusa.ru", "arachnidas.ru", "heliconiinae.online", "nematoceras.online", "graphiuma.online"]}


ioc_type: ipv4
ioc_value: 89.108.115.225
source: otx
validated_at: 2026-04-02T19:14:45.916075
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.115.225", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 134, "malware_samples": [], "passive_dns": ["yourfavorite.property", "travel.endwork.today", "postnet-dev.selftech.ru", "postamates.spatiality.website", "business.spatiality.website", "property.spatiality.website", "dit.spatiality.website", "wiki.clevertec.ru", "www.myfoodforum.ru", "myfoodforum.ru", "rusf


ioc_type: ipv4
ioc_value: 89.108.115.232
source: otx
validated_at: 2026-04-02T19:14:54.103054
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.115.232", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 61, "malware_samples": [], "passive_dns": ["webinar.reutdent.ru", "shermano.ru", "papiliot.online", "amid89.luxury.clank.nomukou.ru", "luxury.clank.nomukou.ru", "stoop13.performed.pride.nomukou.ru", "kallima.online", "hesperiidae.online", "biblidinae.online", "dahmke.ru", "oderas.ru", "haromo.ru", "polyphe


ioc_type: ipv4
ioc_value: 89.108.115.234
source: otx
validated_at: 2026-04-02T19:15:00.298621
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.115.234", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon", "script", "primitivebear", "sha256", "ghostwriter", "github", "code", "path", "quietsieve", "runprogram", "span", "gamaredon group", "unit", "star", "russia", "button", "whispergate", "pterodo", "install", "armageddon", "enterprise", "iocs cluster", "primitive bear", "Gamardeon", "alliance"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 115, "malware_samples": [], "passive_dns": ["www.dipteran.online", "clostri.ru", "kallima.online", "papiliot.online", "maniola.online", "ariuma.ru", "acetobacter.online", "mamberis.ru", "cyrestinae.online", "blattodea.online", "coleopteras.online", "blaberidae.online", "limenitis.online", "empusidae.online", "false.grafitto.ru", "lophacris.online", "debarys.ru", "lycaenidae.online", "hierodula.online", "dionysi.online"]}


ioc_type: ipv4
ioc_value: 89.108.115.235
source: otx
validated_at: 2026-04-02T19:15:08.305157
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.115.235", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 132, "malware_samples": [], "passive_dns": ["www.lk.kfsamara.store", "lk.kfsamara.store", "www.lk.kfsamara.com", "lk.kfsamara.com", "www.povar.kukme.ru", "povar.kukme.ru", "www.nobug.store", "www.kfsamara.com", "kfsamara.com", "kfbiz.online", "www.kfbiz.online", "nobug.store", "112z.ru", "ivaservis.ru", "d


ioc_type: ipv4
ioc_value: 89.108.115.241
source: otx
validated_at: 2026-04-02T19:15:28.704084
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.115.241", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 1, "passive_dns_count": 74, "malware_samples": ["4206257fdc45d452231865d96b3771291910eb199585a64c671f346321edbd99"], "passive_dns": ["analyticselmikeev.ru", "deep-settled.ssinapa.ru", "zamaniwa.ru", "percent.volotras.ru", "deep-rootedness.ssinapa.ru", "ending.amieteku.ru", "naughty.volotras.ru", "deerstalkers.ssinapa.ru", "jean.z


ioc_type: ipv4
ioc_value: 89.108.115.236
source: otx
validated_at: 2026-04-02T19:15:29.562276
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.115.236", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["213f37d015bb0f7bc3462730441ee4e5144563badbce020c9ea1c5f48838e441"]}


ioc_type: ipv4
ioc_value: 89.108.65.157
source: otx
validated_at: 2026-04-02T19:15:41.234635
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.65.157", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 103, "malware_samples": [], "passive_dns": ["schastye.com", "devsite-lst.online", "metoshi.site", "noctuidaes.online", "oderas.ru", "blattodea.online", "coliadinae.online", "putrif.ru", "ariuma.ru", "apoxipodes.online", "graphiuma.online", "mantidae.online", "cholerd.ru", "dahmke.ru", "hymenoptera.online", 


ioc_type: ipv4
ioc_value: 89.108.70.22
source: otx
validated_at: 2026-04-02T19:15:47.412996
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.70.22", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 132, "malware_samples": [], "passive_dns": ["www.resumeone.ru", "api.resumeone.ru", "resumeone.ru", "www.staging.getcode.tech", "staging.getcode.tech", "getcode.tech", "www.getcode.tech", "www.getcodedev.ru", "getcodedev.ru", "lortova.ru", "cliraco.ru", "relax.elitoras.ru", "priest.elitoras.ru", "masshir.ru"


ioc_type: ipv4
ioc_value: 89.108.70.223
source: otx
validated_at: 2026-04-02T19:16:02.058917
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.70.223", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 49, "malware_samples": [], "passive_dns": ["room.megainvest.space", "just-portfolio.com", "www.just-portfolio.com", "89-108-70-223.cloudvps.regruhosting.ru", "megatos.online", "mycodar.ru", "maniola.online", "mamberis.ru", "hierodula.online", "lophacris.online", "proteug.ru", "mantidae.online", "sherman


ioc_type: ipv4
ioc_value: 89.108.71.205
source: otx
validated_at: 2026-04-02T19:16:08.394148
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.71.205", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 90, "malware_samples": [], "passive_dns": ["moneyear.site", "acrididae.online", "shermano.ru", "ariuma.ru", "blattodea.online", "apidaet.online", "megatos.online", "mamberis.ru", "hierodula.online", "limulusa.online", "tubercur.ru", "mycodar.ru", "tomond.ru", "kilogar.ru", "erati.ru", "aerogenosa.ru", "


ioc_type: ipv4
ioc_value: 89.108.76.135
source: otx
validated_at: 2026-04-02T19:16:15.216817
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.76.135", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 23, "malware_samples": [], "passive_dns": ["elastic.panampizza.ru", "mantidae.online", "nymphalidaes.online", "erati.ru", "metcalfas.online", "mesant.online", "maniola.online", "ariuma.ru", "mantodeas.online", "libellulidae.online", "false.grafitto.ru", "megatos.online", "proteug.ru", "fusari.ru", "nema


ioc_type: ipv4
ioc_value: 89.108.76.226
source: otx
validated_at: 2026-04-02T19:16:26.785699
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.76.226", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 1, "passive_dns_count": 51, "malware_samples": ["dbbdb27a6f32472a33c550a30594f9e9c5f414fe28d8596cf802998aba28c172"], "passive_dns": ["oderas.ru", "tubercur.ru", "fusari.ru", "fortias.ru", "baryo.ru", "mucora.ru", "acrididae.ru", "apaturinae.ru", "limenitis.ru", "lepidopteras.ru", "fanniidae.ru", "mantodeas.online", "graphosoma


ioc_type: ipv4
ioc_value: 89.108.76.246
source: otx
validated_at: 2026-04-02T19:16:41.585157
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.76.246", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group", "unc1151", "ip addresses", "service", "pterodo", "contact", "footer", "vnc domains", "ghostwriter", "PartyTicket", "reload", "open", "iocs cluster", "install", "ukraine", "Primitive Bear", "russia", "sha256", "form", "main", "ransomware", "HermeticWiper", "filehashmd5", "virustotal", "pteranodon", "june"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 64, "malware_samples": [], "passive_dns": ["www.zongri.cn", "zongri.cn", "corolain.ru", "goloser.ru", "bhack.simplex-software.ru", "mantodeas.online", "graphiuma.online", "eurypterida.online", "hymenoptera.online", "dahmke.ru", "libellulidae.online", "danainae.online", "nematoceras.online", "aerogenosa.ru", "fusari.ru", "megatos.online", "mesant.online", "melitaeas.online", "dionysi.online", "metcalfas.online"]}


ioc_type: ipv4
ioc_value: 89.108.76.95
source: otx
validated_at: 2026-04-02T19:16:44.327450
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.76.95", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group", "unc1151", "ip addresses", "service", "pterodo", "contact", "footer", "vnc domains", "ghostwriter", "PartyTicket", "reload", "open", "iocs cluster", "install", "ukraine", "Primitive Bear", "russia", "sha256", "form", "main", "ransomware", "HermeticWiper", "filehashmd5", "virustotal", "pteranodon", "june"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 57, "malware_samples": [], "passive_dns": ["1spaceapi.ru", "www.1spaceapi.ru", "hyundai-gkmir.ru", "www.hyundai-gkmir.ru", "fusari.ru", "proteug.ru", "blattodea.ru", "aerogenosa.ru", "lovers.semara.ru", "tomond.ru", "mycodar.ru", "tubercur.ru", "kilogar.ru", "erati.ru", "baryo.ru", "mucora.ru", "fortias.ru", "asilidae.online", "fanniidae.ru", "limenitis.ru"]}


ioc_type: ipv4
ioc_value: 89.108.77.133
source: otx
validated_at: 2026-04-02T19:17:05.055751
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.77.133", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 89.108.77.204
source: otx
validated_at: 2026-04-02T19:17:20.933424
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.77.204", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 1, "passive_dns_count": 122, "malware_samples": ["8831eb86996d4778be526a6fd281c98d624b155940aae463b45dda1c5f979f1c"], "passive_dns": ["www.ruwordie.site", "ruwordie.site", "interest7.navigation.holotran.ru", "megatos.online", "cerambycidae.online", "lophacris.online", "hymenoptera.online", "acrididae.online", "oderas.ru", "bla


ioc_type: ipv4
ioc_value: 89.108.77.202
source: otx
validated_at: 2026-04-02T19:17:26.838126
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.77.202", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 112, "malware_samples": [], "passive_dns": ["www.artemmanicureshop.ru", "artemmanicureshop.ru", "manikureshop.online", "www.manikureshop.online", "manikureshop.ru", "www.manikureshop.ru", "sand79.navy.mudarist.ru", "fanniidae.online", "hierodula.online", "maniola.online", "apaturinae.online", "brachycera.on


ioc_type: ipv4
ioc_value: 89.108.78.126
source: otx
validated_at: 2026-04-02T19:17:41.209827
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.78.126", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["3ddf33ac6cb84d92a62d6a22e09ce90fdcb9d430a5600da9b8153e445ef6ae7d"]}


ioc_type: ipv4
ioc_value: 89.108.78.128
source: otx
validated_at: 2026-04-02T19:18:02.653674
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.78.128", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["f57b76c112f72ec86f65e784e4ad13c0771d49033d9a459ab07c675adea6b940"]}


ioc_type: ipv4
ioc_value: 89.108.78.247
source: otx
validated_at: 2026-04-02T19:18:22.965781
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.78.247", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 89.108.78.252
source: otx
validated_at: 2026-04-02T19:18:43.739261
raw_response:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.78.252", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047", "slapstick"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Gamaredon OSINT Dump"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 89.108.78.82
source: otx
validated_at: 2026-04-02T19:19:04.169497
raw_response:
  {"pulse_count": 25, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.78.82", "tags": ["vnc client", "august", "gafgyt", "HermeticWiper", "wiper", "appdata", "runprogram", "russia", "poshc2", "alliance", "Gamardeon", "symantec", "asyncrat", "raccoon", "geopolitical conflict", "2022", "defender", "s0147", "palo alto", "alertinfo", "ukraine", "powgoop", "APT", "lazagne", "pupyrat", "primitivebear", "sha256", "ghostwriter", "deviceid", "powerstats", "dword", "mori backdoor", "unit", "trickbot", "pterodo", "WhisperGate", "g0047", "cluster", "shuckworm", "pupy", "vbscript b", "remcom", "ddos", "domain", "vbscript", "formbook", "redrum", "filehashmd5", "team", "unc1151"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "IOCs for the recent Cyber Activities of Russian Hackers Targeting Ukraine "], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 89.108.79.13
source: otx
validated_at: 2026-04-02T19:19:04.492706
raw_response:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.79.13", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "2022", "ukraine", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147", "wildfire", "Gamardeon", "quietsieve"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "Test Pulse", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake"], "malware_count": 0, "passive_dns_count": 58, "malware_samples": [], "passive_dns": ["devrm.ru", "mvrm.ru", "www.devctl.ru", "devctl.ru", "devctl.online", "www.devicectl.online", "devicectl.online", "alloy.vadilops.ru", "false.grafitto.ru", "coleopteras.online", "mamberis.ru", "mycodar.ru", "tomond.ru", "acetobacter.online", "polyphemus.online", "morphinaes.online", "mantidae.online", "apaturinae.online", "empusidae.online", "melitaeas.online"]


ioc_type: ipv4
ioc_value: 89.108.79.91
source: otx
validated_at: 2026-04-02T19:19:10.730928
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.79.91", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 4, "malware_samples": [], "passive_dns": ["www.nitkiplus.ru", "nitkiplus.ru", "ty.bvoltaa.ru", "bigtraff.tech"]}


ioc_type: ipv4
ioc_value: 89.108.81.106
source: otx
validated_at: 2026-04-02T19:19:30.783014
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.81.106", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 89.108.81.201
source: otx
validated_at: 2026-04-02T19:19:48.524863
raw_response:
  {"pulse_count": 10, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.81.201", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group", "unc1151", "ip addresses", "service", "pterodo", "contact", "footer", "vnc domains", "ghostwriter", "PartyTicket", "reload", "open", "iocs cluster", "install", "ukraine", "Primitive Bear", "russia", "sha256", "form", "main", "ransomware", "HermeticWiper", "filehashmd5", "virustotal", "pteranodon", "june"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Gamaredon OSINT Dump", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 3, "passive_dns_count": 0, "malware_samples": ["a33ccc612a03de4f42a6f5ab5277470f6a7e8ee7abe52725b13704366e8da48b", "8f4a91ecfb9190461459a2d05e5cb944da80ec30a2b1d69f9817ecb431a5ac8f", "71442782fda29a9f77bef9b71b9250e88b287561859e0885290cb65dce8f203c"]}


ioc_type: ipv4
ioc_value: 89.108.81.210
source: otx
validated_at: 2026-04-02T19:19:53.906154
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.81.210", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group", "unc1151", "ip addresses", "service", "pterodo", "contact", "footer", "vnc domains", "ghostwriter", "PartyTicket", "reload", "open", "iocs cluster", "install", "ukraine", "Primitive Bear", "russia", "sha256", "form", "main", "ransomware", "HermeticWiper", "filehashmd5", "virustotal", "pteranodon", "june"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 93, "malware_samples": [], "passive_dns": ["89-108-81-210.cloudvps.regruhosting.ru", "alloy.vadilops.ru", "hurama.ru", "nematoceras.ru", "ovinus.ru", "merostomata.ru", "heteroptera.ru", "gromphadorhina.ru", "polyphemus.ru", "dipteran.ru", "empusidae.ru", "anisoptera.ru", "arctiidae.ru", "megascolias.online", "morphon.online", "asilidae.ru", "chelicerata.ru", "eurypterida.ru", "coleopteras.online", "nymphalidaes.online"]}


ioc_type: ipv4
ioc_value: 89.108.81.30
source: otx
validated_at: 2026-04-02T19:20:13.941065
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.81.30", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 89.108.81.77
source: otx
validated_at: 2026-04-02T19:20:34.274059
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.81.77", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 89.108.81.8
source: otx
validated_at: 2026-04-02T19:20:53.201889
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.81.8", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon", "script", "primitivebear", "sha256", "ghostwriter", "github", "code", "path", "quietsieve", "runprogram", "span", "gamaredon group", "unit", "star", "russia", "button", "whispergate", "pterodo", "install", "armageddon", "enterprise", "iocs cluster", "primitive bear", "Gamardeon", "alliance"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 89.108.83.23
source: otx
validated_at: 2026-04-02T19:21:13.741455
raw_response:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.83.23", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047", "slapstick"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Gamaredon OSINT Dump"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 89.108.83.235
source: otx
validated_at: 2026-04-02T19:21:34.337200
raw_response:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.83.235", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047", "slapstick"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Gamaredon OSINT Dump"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 89.108.88.15
source: otx
validated_at: 2026-04-02T19:21:37.027206
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.88.15", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon", "script", "primitivebear", "sha256", "ghostwriter", "github", "code", "path", "quietsieve", "runprogram", "span", "gamaredon group", "unit", "star", "russia", "button", "whispergate", "pterodo", "install", "armageddon", "enterprise", "iocs cluster", "primitive bear", "Gamardeon", "alliance"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 67, "malware_samples": [], "passive_dns": ["ws.yourhotelapp.ru", "static.yourhotelapp.ru", "media.yourhotelapp.ru", "lovers.semara.ru", "kilogar.ru", "alloy.vadilops.ru", "graphosoma.ru", "apaturinae.ru", "cyrestinae.ru", "scorpiones.online", "acrididae.ru", "merostomata.online", "shermano.ru", "melitaeas.online", "blattodea.ru", "empusidae.online", "morphinaes.online", "hamadryas.online", "apidaet.online", "brachycera.online"]}


ioc_type: ipv4
ioc_value: 89.108.88.174
source: otx
validated_at: 2026-04-02T19:21:55.041414
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.88.174", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon", "script", "primitivebear", "sha256", "ghostwriter", "github", "code", "path", "quietsieve", "runprogram", "span", "gamaredon group", "unit", "star", "russia", "button", "whispergate", "pterodo", "install", "armageddon", "enterprise", "iocs cluster", "primitive bear", "Gamardeon", "alliance"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 2, "passive_dns_count": 0, "malware_samples": ["1164ba0688458c44b2063894100ecdc52221eb85b82a5044c55043e7918d4a19", "3e1d17efe857c935869fc28ce94c3528f7f5232fcebd40442a7c3c388e3d69be"]}


ioc_type: ipv4
ioc_value: 89.108.88.6
source: otx
validated_at: 2026-04-02T19:22:22.337022
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.88.6", "tags": ["domain", "copy", "main", "explore", "cyclopsblink c", "footer", "ukraine", "PartyTicket", "IsaacWiper", "stealer", "open", "samples", "ip addresses", "APT", "HermeticWiper", "desktop", "filehashmd5", "form", "team", "repository", "template", "unc1151", "powershell", "gamaredon", "body", "pteranodon", "script", "primitivebear", "sha256", "ghostwriter", "github", "code", "path", "quietsieve", "runprogram", "span", "gamaredon group", "unit", "star", "russia", "button", "whispergate", "pterodo", "install", "armageddon", "enterprise", "iocs cluster", "primitive bear", "Gamardeon", "alliance"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 89.108.98.101
source: otx
validated_at: 2026-04-02T19:22:47.414543
raw_response:
  {"pulse_count": 13, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.98.101", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "Bruteforce", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group", "unc1151", "ip addresses", "service", "pterodo", "contact", "Honeypot", "footer", "vnc domains", "ghostwriter", "PartyTicket", "reload", "open", "iocs cluster", "install", "ukraine", "Primitive Bear", "russia", "sha256", "form", "main", "ransomware", "HermeticWiper", "filehashmd5", "virustotal"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "IPs and hashes of various types of attacks on the global network of honeypots", "Malicious IP", "Lion Team_Honeypots_Bruteforce_Source_IP 2022/07/02", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Gamaredon OSINT Dump", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 111, "malware_samples": [], "passive_dns": ["kilogar.ru", "lovers.semara.ru", "tubercur.ru", "alloy.vadilops.ru", "hurama.ru", "libellulidae.ru", "mucora.ru", "arctiidae.ru", "libellulat.ru", "nematoceras.ru", "polyphemus.ru", "arachnidas.ru", "heliconiinae.online", "gromphadorhina.online", "scorpiones.online", "xiphosura.online", "merostomata.online", "apaturinae.ru", "cyrestinae.ru", "acrididae.ru"]}


ioc_type: ipv4
ioc_value: 89.108.88.67
source: otx
validated_at: 2026-04-02T19:22:47.715448
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.88.67", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 89.108.98.113
source: otx
validated_at: 2026-04-02T19:23:05.260608
raw_response:
  {"pulse_count": 9, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.98.113", "tags": ["palo alto", "WhisperGate", "vnc samples", "alliance", "ddos", "stealer", "span", "explore", "runprogram", "samples", "primitive bear", "body", "powershell", "gamaredon", "primitivebear", "cluster", "github", "script", "armageddon", "APT", "copy", "userprofile", "IsaacWiper", "link", "gamaredon group", "unc1151", "ip addresses", "service", "pterodo", "contact", "footer", "vnc domains", "ghostwriter", "PartyTicket", "reload", "open", "iocs cluster", "install", "ukraine", "Primitive Bear", "russia", "sha256", "form", "main", "ransomware", "HermeticWiper", "filehashmd5", "virustotal", "pteranodon", "june"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Spam Email Dump", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine", "Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "Russia\u2019s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine", "https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 89.108.98.124
source: otx
validated_at: 2026-04-02T19:23:25.504355
raw_response:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.98.124", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "2022", "ukraine", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147", "wildfire", "Gamardeon", "quietsieve"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Gamaredon OSINT Dump"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 89.108.98.125
source: otx
validated_at: 2026-04-02T19:23:30.997783
raw_response:
  {"pulse_count": 25, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS197695 domain names registrar reg.ru  ltd", "indicator": "89.108.98.125", "tags": ["qakbot", "WhisperGate", "slapstick", "remcom", "powgoop", "armageddon", "lazagne", "crackmapexec", "shuckworm", "vbscript b", "tsunami", "ghostwriter", "malware", "sha256", "symantec", "wildfire", "Gamardeon", "defender", "alertinfo", "domain", "deviceid", "Cyclops", "ip address", "palo alto", "ddos", "stealer", "wiper", "kernel32", "c server", "g0047", "PartyTicket", "august", "muddywater", "dword", "russia", "explorer", "actinium", "ransomware", "filehashmd5", "virustotal", "redrum", "trickbot", "geopolitical conflict", "raccoon", "whispergate", "mimikatz", "mirai", "cyclopsblink c", "powersploit", "gafgyt"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "IOCs for the recent Cyber Activities of Russian Hackers Targeting Ukraine "], "malware_count": 1, "passive_dns_count": 2, "malware_samples": ["109a181071c29030ef0611e0aa5378513d2af91c7b4db8ff1c4d597d1e1fc786"], "passive_dns": ["l706de22.justinstalledpanel.com", "b.clkey.com"]}


ioc_type: ipv4
ioc_value: 89.185.84.141
source: otx
validated_at: 2026-04-02T19:23:50.119670
raw_response:
  {"pulse_count": 6, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS207713 tim windelschmidt", "indicator": "89.185.84.141", "tags": ["as207713", "as14061", "as211211", "backdoors", "apt", "as212189", "as39798", "stealers", "as207651"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "Gamaredon's Rapid Data Exfiltration Tactics Following Initial Compromise", "Summary information on the activities of the UAC-0010 group as of July 23", "Summary information on the activities of the UAC-0010 group as of July 23", "Summary information on the activities of the UAC-0010 group as of July 23"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 89.185.84.204
source: otx
validated_at: 2026-04-02T19:24:04.107919
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS207713 tim windelschmidt", "indicator": "89.185.84.204", "tags": ["welivesecurity", "sample hashes", "backdoors", "apt", "malicious", "pterolnk", "pteropshell", "word template", "stealers", "office macro", "vbscript", "gamaredon", "pterosteal", "first", "options"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 89.19.209.154
source: otx
validated_at: 2026-04-02T19:24:33.149785
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS41465 limited liability company volgogaztelecom", "indicator": "89.19.209.154", "tags": ["welivesecurity", "sample hashes", "backdoors", "apt", "malicious", "pterolnk", "pteropshell", "word template", "stealers", "office macro", "vbscript", "gamaredon", "pterosteal", "first", "options"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 89.223.123.121
source: otx
validated_at: 2026-04-02T19:24:53.542928
raw_response:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "89.223.123.121", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "2022", "ukraine", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147", "wildfire", "Gamardeon", "quietsieve"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Gamaredon OSINT Dump"], "malware_count": 3, "passive_dns_count": 0, "malware_samples": ["a1c87b7485e88889d7b7884d0d9fce70d974019dc6ff30cd6b29680275651c32", "1c7804155248e2596ec9de97e5cddcddbafbb5c6d066d972bad051f81bbde5c4", "2042a2feb4d9f54d65d7579a0afba9ee1c6d22e29127991fbf34ea3da1659904"]}


ioc_type: ipv4
ioc_value: 89.23.107.188
source: otx
validated_at: 2026-04-02T19:25:05.960118
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Yekaterinburg", "asn": "AS48687 noviton ltd", "indicator": "89.23.107.188", "tags": ["backdoors", "vbscript", "malicious", "gamaredon", "options", "word template", "stealers", "apt", "sample hashes", "pterosteal", "pteropshell", "pterolnk", "first", "office macro", "welivesecurity"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023"], "malware_count": 0, "passive_dns_count": 6, "malware_samples": [], "passive_dns": ["nl.atlanta-internet.ru", "lesnoygaff.ru", "sekabeting.com", "vz99betvn.com", "footballbet18.com", "ufaclubs.com"]}


ioc_type: ipv4
ioc_value: 91.188.222.50
source: otx
validated_at: 2026-04-02T19:25:21.814322
raw_response:
  {"pulse_count": 6, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": "Moscow", "asn": "AS208626 servtech ltd", "indicator": "91.188.222.50", "tags": ["Gamaredon", "domain", "jazi", "Trident Ursa", "gamaredon", "tweet see", "url https", "threatactor.primitivebear", "threatactor/tridentursa", "apt sfx", "Gamaredon Group", "threatactor/actinium", "sample", "ip address", "threatactor/gamaredon"], "pulses": ["Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "gamaredon", "Twitter Feed - h2jazi - 07-07-2022"], "malware_count": 2, "passive_dns_count": 3, "malware_samples": ["ff7954bbfbf12f4b3e76fa28b3cf19aad0915ef1a209924629e7d6ba74a2d618", "ed81f2872b1424f8591bc6e58d2791637a6ca22b28ba285f2efc2a01cc510413"], "passive_dns": ["mail.bitsbfree.com", "bitsbfree.com", "la6c6a02.justinstalledpanel.com"]}


ioc_type: ipv4
ioc_value: 91.200.148.232
source: otx
validated_at: 2026-04-02T19:25:39.560153
raw_response:
  {"pulse_count": 3, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "Bromley", "asn": "AS26636 quickpacket  llc", "indicator": "91.200.148.232", "tags": ["backdoors", "vbscript", "malicious", "gamaredon", "options", "word template", "stealers", "apt", "sample hashes", "pterosteal", "pteropshell", "pterolnk", "first", "office macro", "welivesecurity"], "pulses": ["Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023", "C&C-IP-List", "Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023"], "malware_count": 0, "passive_dns_count": 0, "passive_dns": []}


ioc_type: ipv4
ioc_value: 92.242.62.112
source: otx
validated_at: 2026-04-02T19:25:59.816959
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Redwood City", "asn": "AS201192 dilmax corporation", "indicator": "92.242.62.112", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 201, "malware_samples": [], "passive_dns": ["newsihundred.site", "rfitarmail.online", "myces.ru", "teroba.ru", "krashand.ru", "youthful-fermat.92-242-62-112.plesk.page", "mysussdtc.com", "mypoloekrese.com", "myreditreskres.com", "myakshhpp.com", "myasrekantopres.com", "ipureksjes.com", "myokkoshhhh.com"


ioc_type: ipv4
ioc_value: 92.242.62.132
source: otx
validated_at: 2026-04-02T19:26:03.566014
raw_response:
  {"pulse_count": 24, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Redwood City", "asn": "AS201192 dilmax corporation", "indicator": "92.242.62.132", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "2022", "ukraine", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147", "wildfire", "Gamardeon", "quietsieve"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "Twitter Feed - romonlyht - 11-01-2023", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake"], "malware_count": 0, "passive_dns_count": 30, "malware_samples": [], "passive_dns": ["signinaccountscoinbase.com", "webdisk.scirelinks.top", "managerupdate.top", "www.payple.com.managerupdate.top", "payple.com.managerupdate.top", "amzn.com.managerupdate.top", "www.amzn.com.managerupdate.top", "servicesectorupdate.com", "www.noreplyservice0009.top", "noreplyservice0009.top", "trade-coinbase.servicesectorupdate.com", "


ioc_type: ipv4
ioc_value: 92.242.62.186
source: otx
validated_at: 2026-04-02T19:26:33.629135
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Redwood City", "asn": "AS201192 dilmax corporation", "indicator": "92.242.62.186", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 1, "passive_dns_count": 7, "malware_samples": ["e7d26be376f98a69062faf699bdf6d336088d0ae9a6349ae738719ce7222e993"], "passive_dns": ["offerfollowing.life", "onlinenewshot.pro", "monexelent.shop", "myces.ru", "teroba.ru", "krashand.ru", "stefany.club"]}


ioc_type: ipv4
ioc_value: 92.242.62.181
source: otx
validated_at: 2026-04-02T19:26:35.630940
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Redwood City", "asn": "AS201192 dilmax corporation", "indicator": "92.242.62.181", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 92.242.62.254
source: otx
validated_at: 2026-04-02T19:26:45.015127
raw_response:
  {"pulse_count": 25, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Redwood City", "asn": "AS201192 dilmax corporation", "indicator": "92.242.62.254", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "phishing", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "Twitter Feed - romonlyht - 08-03-2023", "InQuest - 08-03-2023", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake"], "malware_count": 0, "passive_dns_count": 9, "malware_samples": [], "passive_dns": ["regisedmade.monster", "bestdomain.click", "makedell.yachts", "makedell.xyz", "tralosp.shop", "myces.ru", "teroba.ru", "krashand.ru", "microsoftware.net"]}


ioc_type: ipv4
ioc_value: 92.242.62.45
source: otx
validated_at: 2026-04-02T19:26:57.943362
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Redwood City", "asn": "AS201192 dilmax corporation", "indicator": "92.242.62.45", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 3, "malware_samples": [], "passive_dns": ["andcaster.lat", "vaudevilless.live", "mushroomlilly.com"]}


ioc_type: ipv4
ioc_value: 92.242.62.96
source: otx
validated_at: 2026-04-02T19:27:11.668771
raw_response:
  {"pulse_count": 25, "reputation": 0, "country": "United States of America", "country_code": "US", "city": "Redwood City", "asn": "AS201192 dilmax corporation", "indicator": "92.242.62.96", "tags": ["qakbot", "WhisperGate", "slapstick", "remcom", "powgoop", "armageddon", "lazagne", "crackmapexec", "shuckworm", "vbscript b", "tsunami", "ghostwriter", "malware", "sha256", "symantec", "wildfire", "Gamardeon", "defender", "alertinfo", "domain", "deviceid", "Cyclops", "ip address", "palo alto", "ddos", "stealer", "wiper", "kernel32", "c server", "g0047", "PartyTicket", "august", "muddywater", "dword", "russia", "explorer", "actinium", "ransomware", "filehashmd5", "virustotal", "redrum", "trickbot", "geopolitical conflict", "raccoon", "whispergate", "mimikatz", "mirai", "cyclopsblink c", "powersploit", "gafgyt"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "IOCs for the recent Cyber Activities of Russian Hackers Targeting Ukraine "], "malware_count": 0, "passive_dns_count": 325, "malware_samples": [], "passive_dns": ["doilyrete.site", "payple.com.manage-srvicse-updateds.com", "manage-srvicse-updateds.com", "verfiyupdte-mngeraccount.com", "secureupdte-accnt.com", "redytrcg.com", "paypled.com.manage-auths-securdes.com", "manage-auths-securdes.com", "payple.com.verfiyupdte-mngeraccount.com", "www.payple.com.verfiyupdte-mngeraccoun


ioc_type: ipv4
ioc_value: 92.255.76.169
source: otx
validated_at: 2026-04-02T19:27:22.375507
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "92.255.76.169", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 5, "malware_samples": [], "passive_dns": ["howtosl.com", "icecream.jokyprod.com", "anna.jokyprod.com", "www.jokyprod.com", "jokyprod.com"]}


ioc_type: ipv4
ioc_value: 92.53.97.145
source: otx
validated_at: 2026-04-02T19:27:43.139883
raw_response:
  {"pulse_count": 29, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "92.53.97.145", "tags": ["powersploit", "qakbot", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "gamaredon", "razy", "wiper", "armageddon", "APT", "lazagne", "crackmapexec", "gamaredon group", "powerstats", "pupyrat", "tsunami", "g0047", "asyncrat", "poshc2", "muddywater", "russia", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147", "wildfire", "raccoon", "whispergate", "pupy", "mimikatz", "mirai"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "data of hhh", "vvvvv", "vvvvv", "jintingtingtesttest", "jintingtingtesttest", "jintingtingtesttest", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["6ca1e2eec3fe93a8123ed81920d01df0cea35443318fb3c1628cf8e4d26c719f"]}


ioc_type: ipv4
ioc_value: 94.228.120.181
source: otx
validated_at: 2026-04-02T19:27:48.724237
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS9123 timeweb ltd.", "indicator": "94.228.120.181", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["l61eb776.justinstalledpanel.com"]}


ioc_type: ipv4
ioc_value: 94.250.251.39
source: otx
validated_at: 2026-04-02T19:28:09.320801
raw_response:
  {"pulse_count": 24, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS29182 jsc iot", "indicator": "94.250.251.39", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "2022", "ukraine", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147", "wildfire", "Gamardeon", "quietsieve"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Gamaredon OSINT Dump"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 95.179.216.77
source: otx
validated_at: 2026-04-02T19:28:26.057046
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "France", "country_code": "FR", "city": "Aubervilliers", "asn": "AS20473 the constant company  llc", "indicator": "95.179.216.77", "tags": ["url https", "Gamaredon", "Gamaredon Group", "sample", "threatactor.primitivebear", "Trident Ursa", "domain", "threatactor/actinium", "threatactor/gamaredon", "threatactor/tridentursa", "ip address"], "pulses": ["Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine", "Russia\u2019s Trident Ursa (aka Gamaredon APT) Cyber Conflict Operations Unwavering Since Invasion of Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 95.179.221.114
source: otx
validated_at: 2026-04-02T19:28:40.324208
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "France", "country_code": "FR", "city": "Aubervilliers", "asn": "AS20473 the constant company  llc", "indicator": "95.179.221.114", "tags": ["domain", "mimikatz", "cyclopsblink c", "formbook", "ukraine", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "filehashmd5", "muddywater", "powersploit", "wiper", "unc1151", "powershell", "gamaredon", "crackmapexec", "pteranodon", "mirai", "primitivebear", "sha256", "ghostwriter", "tsunami", "quietsieve", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "pterodo", "armageddon", "august stealer", "iocs cluster", "primitive bear", "Gamardeon", "ransomware", "WhisperGate", "asyncrat", "raccoon", "wildfire", "g0047"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 95.179.221.147
source: otx
validated_at: 2026-04-02T19:28:54.936944
raw_response:
  {"pulse_count": 30, "reputation": 0, "country": "France", "country_code": "FR", "city": "Aubervilliers", "asn": "AS20473 the constant company  llc", "indicator": "95.179.221.147", "tags": ["mimikatz", "formbook", "powgoop", "PartyTicket", "IsaacWiper", "stealer", "APT", "gafgyt", "lazagne", "redrum", "HermeticWiper", "pupyrat", "muddywater", "powersploit", "wiper", "VPN", "gamaredon", "crackmapexec", "pteranodon", "mirai", "tsunami", "powerstats", "mori backdoor", "gamaredon group", "russia", "whispergate", "poshc2", "qakbot", "trickbot", "armageddon", "august stealer", "primitive bear", "Gamardeon", "TOR", "asyncrat", "raccoon", "WhisperGate", "wildfire", "g0047", "slapstick", "geopolitical conflict", "pupy", "razy", "s0147", "remcom", "Cyclops"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "test", "test", "test", "test", "test", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022"], "malware_count": 0, "passive_dns_count": 14, "malware_samples": [], "passive_dns": ["animesamadlapk.xyz", "street-hypnose.fr", "www.street-hypnose.fr", "hangout.street-hypnose.fr", "formations.preprod.hunkaar.fr", "formations.hunkaar.fr", "jec.hunkaar.fr", "preprod.hunkaar.fr", "hunkaar.fr", "www.hunkaar.fr", "teroba.ru", "myces.ru", "krashand.ru", "cyberdek.xyz"]}


ioc_type: ipv4
ioc_value: 106.51.89.49
source: otx
validated_at: 2026-04-02T19:29:17.056523
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "India", "country_code": "IN", "city": "Bengaluru", "asn": "AS24309 atria convergence technologies", "indicator": "106.51.89.49", "tags": ["fancy bear", "credential theft", "spypress.roundish", "ukraine", "roundcube", "webmail", "xdsfeerdfbn", "chlg url", "government", "filehashsha256", "email", "css injection", "xss", "apt28", "go implant", "httd", "filehashmd5", "filehashsha1"], "pulses": ["Operation Roundish: Uncovering an APT28 Roundcube Exploitation Toolkit Targeting Ukraine", "Malware Filter - Botnet List - 19-03-2026 (Part 1)", "EbeeMar2026 Pt4", "Operation Roundish: Uncovering an APT28 Roundcube Exploitation Toolkit Targeting Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": [], "passive_dns": []}


ioc_type: ipv4
ioc_value: 95.179.223.56
source: otx
validated_at: 2026-04-02T19:29:17.098502
raw_response:
  {"pulse_count": 23, "reputation": 0, "country": "France", "country_code": "FR", "city": "Aubervilliers", "asn": "AS20473 the constant company  llc", "indicator": "95.179.223.56", "tags": ["powersploit", "qakbot", "WhisperGate", "ddos", "stealer", "gafgyt", "august stealer", "mori backdoor", "slapstick", "remcom", "primitive bear", "powgoop", "powershell", "gamaredon", "razy", "wiper", "primitivebear", "cluster", "armageddon", "APT", "lazagne", "crackmapexec", "IsaacWiper", "gamaredon group", "unc1151", "powerstats", "pupyrat", "tsunami", "g0047", "pterodo", "asyncrat", "ghostwriter", "poshc2", "PartyTicket", "muddywater", "iocs cluster", "2022", "ukraine", "Primitive Bear", "russia", "sha256", "ransomware", "HermeticWiper", "filehashmd5", "pteranodon", "formbook", "redrum", "trickbot", "geopolitical conflict", "s0147"], "pulses": ["Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine", "BLOCK_2024", "BLOCK_2025_DIC", "SOC2023", "2024-blocking-soc-ene25", "2024-blocking-soc-ene25", "CLON IPIF", "2024-DIC-10-Clon", "_CLON_2024_NOV11", "SOC_BLOCK_NEW", "SOC2022ALL", "Spam Email Dump", "BACKUP BLOC TRR", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Cyber War IOCs 2022", "Cyber War IOCs 2022", "ETAC Vetted Ukraine Russia War IOCs", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Russia-Ukraine 2022 conflict related IOCs from CERT Orange Cyberdefense Threat Intelligence Datalake", "Primitive Bear Uses Malicious Downloader in a Resume to Target a Western Government Entity in Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 121.127.232.250
source: otx
validated_at: 2026-04-02T19:29:44.753490
raw_response:
  {"pulse_count": 29, "reputation": 0, "country": "Hong Kong", "country_code": "HK", "city": null, "asn": "AS64050 bgpnet global asn", "indicator": "121.127.232.250", "tags": ["ioc", "malicious", "cyber security", "phishing", "Nextray"], "pulses": ["IOC Records Provided by @NextRayAI", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOCs Industriales", "IOC Records \u2192Provided by @NextRayAI", "HIVE           (Pulse created by RVS_i_am)", "HIVE           (Pulse created by RVS_i_am)", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "HIVE", "IOC Records \u2192Provided by @NextRayAI", "IOC Records \u2192Provided by @NextRayAI"], "malware_count": 3, "passive_dns_count": 5, "malware_samples": ["2216da2e5548b1a10231c7201d96df0e2d32df3fcfb1ed6d86be111e4bbf5641", "e6db2948af8a8a84405552336e66fa4a827924a569e57b15cd3beeaf7ab7a773", "05757c2692f68a5ec6d328d02eebe0260fd9fffc31d7bdb9d70da1a27007ee7a"], "passive_dns": ["us-binance.net", "cntdg.com", "vsinapp.com", "ww.hk200.wsdns.cc", "jinsupermars.hk200.wshost.cc"]}


ioc_type: ipv4
ioc_value: 144.126.202.227
source: otx
validated_at: 2026-04-02T19:30:02.508417
raw_response:
  {"pulse_count": 12, "reputation": 0, "country": "United Kingdom of Great Britain and Northern Ireland", "country_code": "GB", "city": "London", "asn": "AS14061 digitalocean  llc", "indicator": "144.126.202.227", "tags": ["apt28", "forensics", "info", "openai", "control", "win64", "command line", "certua", "investigation", "enabled", "o365", "falconshield", "fancy bear", "pawn storm", "clfs", "graphic", "path dropped", "linkedin", "windows nt", "sednit", "llms", "sofacy", "download", "command", "programdata", "august", "api key", "malware samples", "malware", "urls", "delete", "follow", "face", "ukraine", "levpn", "computername", "lamehug", "windows", "llm integration", "twitter", "ransomware", "android", "virustotal", "june", "python", "desktop", "example", "cyber security", "teamviewer", "story"], "pulses": ["IOC TCS- IP", "Prompts as Code &amp; Embedded Keys | The Hunt for LLM-Enabled Malware | SentinelOne", "Prompts as Code & Embedded Keys | The Hunt for LLM-Enabled Malware.", "EbeeAugust2025 Pt1", "APT28\u2019s New Arsenal: LAMEHUG, the First AI-Powered Malware", "LAMEHUG as AI-Powered Malware Strikes Organizations through Compromised Official Email Accounts", "LAMEHUG LLM Attack", "Cato CTRL\u2122 Threat Research: Analyzing LAMEHUG | Cato Networks", "IOC to be blocked", "LameHug malware uses AI LLM to craft Windows data-theft commands in real-time", "UAC-0001 cyberattacks on the security and defense sector using the LAMEHUG software tool, which uses LLM (large language model) (CERT-UA#16039).", "\u041a\u0456\u0431\u0435\u0440\u0430\u0442\u0430\u043a\u0438 UAC-0001 \u043d\u0430 \u0441\u0435\u043a\u0442\u043e\u0440 \u0431\u0435\u0437\u043f\u0435\u043a\u0438 \u0442\u0430 \u043e\u0431\u043e\u0440\u043e\u043d\u0438 \u0456\u0437 \u0437\u0430\u0441\u0442\u043e\u0441\u0443\u0432\u0430\u043d\u043d\u044f\u043c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043d\u043e\u0433\u043e \u0437\u0430\u0441\u043e\u0431\u0443 LAMEHUG, \u0449\u043e \u0432\u0438\u043a\u043e\u0440\u0438\


ioc_type: ipv4
ioc_value: 184.95.51.172
source: otx
validated_at: 2026-04-02T19:30:11.711824
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS20454 secured servers llc", "indicator": "184.95.51.172", "tags": ["gru", "apt28", "fancy bear", "sofacy"], "pulses": ["US firm says Russia hacked company at heart of Trump impeachment"], "malware_count": 0, "passive_dns_count": 5, "malware_samples": [], "passive_dns": ["whm.pumadventuresperu.com", "www.jenkins.pumadventuresperu.com", "sitemap.pumadventuresperu.com", "184.95.51.172", "liveserviceonedrive.com"]}


ioc_type: ipv4
ioc_value: 185.141.63.103
source: otx
validated_at: 2026-04-02T19:30:33.165024
raw_response:
  {"pulse_count": 1, "reputation": 0, "country": "Cyprus", "country_code": "CY", "city": null, "asn": "AS44901 belcloud ltd", "indicator": "185.141.63.103", "tags": ["gru", "apt28", "fancy bear", "sofacy"], "pulses": ["US firm says Russia hacked company at heart of Trump impeachment"], "malware_count": 3, "passive_dns_count": 0, "malware_samples": ["43795e1070f5a398743a22242f1c3f41e2b4f90b309c6c10b811333f756da514", "e5504123eebac8b102a7bc91c7f5f525fd18ef44d35098c1fd63620fee6c1a47", "d09b7169f18ac1787f04ff6aaa9343dc42216ff5424c21c8a6dc35f8ed764797"]}


ioc_type: ipv4
ioc_value: 185.236.25.119
source: otx
validated_at: 2026-04-02T19:30:52.090779
raw_response:
  {"pulse_count": 6, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS22773 cox communications inc.", "indicator": "185.236.25.119", "tags": ["foudre", "reconnaissance", "proactive defense", "filehashsha256", "iranian apt", "arenac2", "cve-2025-54068", "cve-2025-34291", "geopolitical tensions", "cve-2026-1281", "tonnerre", "filehashmd5", "time", "generatedbotid", "command and control", "cve-2025-55182", "encoded url", "uwhi6jqzqh7", "computername", "cve-2026-1731", "tsundere", "cve-2025-9316", "tamecat", "cyber espionage", "filehashsha1", "vulnerability exploitation", "keyc2", "tls fingerprinting", "cyberattacks", "tsundere botnet", "mois", "date", "persianc2", "cve-2024-55591", "username", "sliver", "cve-2025-68613", "threat intelligence", "infrastructure analysis", "fmapp.exe", "geopolitical conflict", "cve-2025-52691", "asn patterns", "cve-2022-42475", "cve-2025-5777", "cve-2024-23113", "exfiltration"], "pulses": ["MuddyWater Exposed: Inside an Iranian APT operation", "Iranian APT Infrastructure in Focus: Mapping State-Aligned Clusters During Geopolitical Escalation", "EbeeMar2026 Pt1", "MuddyWater Exposed: Inside an Iranian APT operation", "avault clone \"MuddyWater Exposed: Inside an Iranian APT operation\"", "Malware Filter - Botnet List - 05-03-2026 (Part 3)"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 2.58.15.158
source: otx
validated_at: 2026-04-02T19:31:24.744760
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "Netherlands", "country_code": "NL", "city": "Amsterdam", "asn": "AS8100 quadranet enterprises llc", "indicator": "2.58.15.158", "tags": ["diplomatic", "cherryspy", "double-tap", "kazakhstan", "apt28", "central asia", "hatvibe", "cyber espionage"], "pulses": ["Russia-nexus APT possibly related to APT28 conducts cyber espionage on Central Asia and Kazakhstan diplomatic relations", "IOC TCS- IP", "Russia-nexus APT possibly related to APT28 conducts cyber espionage on Central Asia and Kazakhstan diplomatic relations", "Double-Tap Campaign: Russia-nexus APT possibly related to APT28 conducts cyber espionage on Central Asia and Kazakhstan diplomatic relations"], "malware_count": 0, "passive_dns_count": 1, "malware_samples": [], "passive_dns": ["background-services.net"]}


ioc_type: ipv4
ioc_value: 203.161.50.145
source: otx
validated_at: 2026-04-02T19:31:44.738091
raw_response:
  {"pulse_count": 12, "reputation": 0, "country": "Malaysia", "country_code": "MY", "city": null, "asn": "AS22612 namecheap  inc.", "indicator": "203.161.50.145", "tags": ["apt28", "impact", "post body", "xss", "linux x8664", "metasploit", "loop", "nop exec", "certua", "go implant", "address range", "appdata", "roundcube", "powershell", "entity akamai", "fancy bear", "zimbra", "proton", "APT", "squirrelmail", "totp", "credential theft", "khtml", "capture", "type", "gecko", "filehashsha256", "sednit", "scripttaker.js", "squirrelmail xss", "filehashsha1", "idrsa r", "blizzard", "ubuntu", "css injection", "august", "september", "whois server", "xdsfeerdfbn", "handle", "ukraine", "webmail", "Kimsuky", "AsyncRAT", "albania", "c2 server", "error", "filehashmd5", "status", "ctrlaltintel"], "pulses": ["Operation Roundish: Uncovering an APT28 Roundcube Exploitation Toolkit Targeting Ukraine", "EbeeMar2026 Pt5", "still not Alkaline", "IOC - FancyBear Exposed: Major OPSEC Blunder Inside Russian Espionage Ops", "FancyBear Exposed: Major OPSEC Blunder Inside Russian Espionage Ops", "EbeeMar2026 Pt4", "Operation Roundish: Uncovering an APT28 Roundcube Exploitation Toolkit Targeting Ukraine", "Malware Filter - Botnet List - 13-03-2026 (Part 4)", "Twitter Feed - skocherhan - 13-03-2026", "Cyberattack UAC-0001 (APT28): PowerShell command in the clipboard as an \u2018entry point\u2019 (CERT-UA#11689)", "Cyberattack UAC-0001 (APT28): PowerShell command in the clipboard as an \u2018entry point\u2019 (CERT-UA#11689)", "Cyberattack UAC-0001 (APT28): PowerShell command in the clipboard as an \u2018entry point\u2019 (CERT-UA#11689)"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 209.74.87.100
source: otx
validated_at: 2026-04-02T19:32:03.759772
raw_response:
  {"pulse_count": 13, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "ASNone ", "indicator": "209.74.87.100", "tags": ["c2", "watchtowr", "exfiltration", "time", "attempt", "cve20170199", "cve-2025-55182", "bitcoinaddress", "http", "keyc2", "ai-assisted", "devtcp", "download", "sent baseinfo", "mena", "sliver", "encoded url", "uwhi6jqzqh7", "post-exploitation", "proactive defense", "execution", "domain", "ivanti", "foudre", "cyber espionage", "cve-2025-68613", "system", "palo alto", "infrastructure analysis", "rust backdoor", "charmpower", "tsundere botnet", "arenac2", "classloader", "tls fingerprinting", "username", "fmapp.exe", "cve-2025-5777", "tsundere", "logic", "telegram bot", "computername", "ghostbackdoor", "command and control", "registry", "date", "cve-2026-1281", "cve-2025-54068", "filehashmd5", "bash"], "pulses": ["Operation Olalampo: Inside MuddyWater's Latest Campaign", "MuddyWater Exposed: Inside an Iranian APT operation", "Iranian APT Infrastructure in Focus: Mapping State-Aligned Clusters During Geopolitical Escalation", "EbeeFeb2026 Pt5", "Malware Filter - Botnet List - 23-02-2026 (Part 4)", "Operation Olalampo: Inside MuddyWater's Latest Campaign", "IOC -  Operation Olalampo: Inside MuddyWater's Latest Campaign", "EbeeMar2026 Pt1", "Iranian APT Actors-Pt5", "Mass exploitation of CVE-2026-1281 and CVE-2026-1340 in Ivanti EPMM", "MuddyWater Exposed: Inside an Iranian APT operation", "avault clone \"MuddyWater Exposed: Inside an Iranian APT operation\"", "Emerging Iranian Cyber Retaliation Campaign Impacting Western Sectors"], "malware_count": 1, "passive_dns_count": 0, "malware_samples": ["7d9fb236607e7fe5e0921b06f45d9cb69acbdb923e2877d87a99720b8dc964c9"]}


ioc_type: ipv4
ioc_value: 217.146.67.241
source: otx
validated_at: 2026-04-02T19:32:38.246241
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "Estonia", "country_code": "EE", "city": null, "asn": "AS49604 zone media ou", "indicator": "217.146.67.241", "tags": ["fancy bear", "credential theft", "spypress.roundish", "ukraine", "roundcube", "webmail", "xdsfeerdfbn", "chlg url", "government", "filehashsha256", "email", "css injection", "xss", "apt28", "go implant", "httd", "filehashmd5", "filehashsha1"], "pulses": ["Operation Roundish: Uncovering an APT28 Roundcube Exploitation Toolkit Targeting Ukraine", "Malware Filter - Botnet List - 19-03-2026 (Part 5)", "EbeeMar2026 Pt4", "Operation Roundish: Uncovering an APT28 Roundcube Exploitation Toolkit Targeting Ukraine"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 38.180.206.61
source: otx
validated_at: 2026-04-02T19:33:17.010247
raw_response:
  {"pulse_count": 8, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS174 cogent communications", "indicator": "38.180.206.61", "tags": ["apt28", "word", "espionage", "double-tap", "kazakhstan", "copy", "hatvibe", "microsoft word", "insikt group", "logpie", "tag110", "word startup", "pyplunderplug", "central asia", "soar", "insikt", "cherryspy", "kremlin", "future", "diplomatic", "hta hatvibe", "russia-aligned", "tajikistan", "government", "cases prevent", "phishing", "template", "cyber espionage", "sub procedure", "february"], "pulses": ["Targets Tajikistan: New Macro Word Documents Phishing Tactics", "Russia-nexus APT possibly related to APT28 conducts cyber espionage on Central Asia and Kazakhstan diplomatic relations", "IOC TCS- IP", "TAG-110 Targets Tajikistan: New Macro Word Documents Phishing Tactics", "TAG-110 Targets Tajikistan: New Macro Word Documents Phishing Tactics", "Targets Tajikistan: New Macro Word Documents Phishing Tactics", "Russia-nexus APT possibly related to APT28 conducts cyber espionage on Central Asia and Kazakhstan diplomatic relations", "Double-Tap Campaign: Russia-nexus APT possibly related to APT28 conducts cyber espionage on Central Asia and Kazakhstan diplomatic relations"], "malware_count": 0, "passive_dns_count": 0}


ioc_type: ipv4
ioc_value: 38.180.207.137
source: otx
validated_at: 2026-04-02T19:33:34.659389
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "United States of America", "country_code": "US", "city": null, "asn": "AS174 cogent communications", "indicator": "38.180.207.137", "tags": ["central asia", "apt28", "hatvibe", "cherryspy", "double-tap", "diplomatic", "cyber espionage", "kazakhstan"], "pulses": ["Russia-nexus APT possibly related to APT28 conducts cyber espionage on Central Asia and Kazakhstan diplomatic relations", "IOC TCS- IP", "Russia-nexus APT possibly related to APT28 conducts cyber espionage on Central Asia and Kazakhstan diplomatic relations", "Double-Tap Campaign: Russia-nexus APT possibly related to APT28 conducts cyber espionage on Central Asia and Kazakhstan diplomatic relations"], "malware_count": 0, "passive_dns_count": 0, "malware_samples": []}


ioc_type: ipv4
ioc_value: 92.243.65.243
source: otx
validated_at: 2026-04-02T19:36:02.028583
raw_response:
  {"pulse_count": 4, "reputation": 0, "country": "Russian Federation", "country_code": "RU", "city": null, "asn": "AS30968 ooo national telecommunications", "indicator": "92.243.65.243", "tags": ["infrastructure analysis", "tls fingerprinting", "cyberattacks", "fmapp.exe", "foudre", "asn patterns", "proactive defense", "tsundere", "sliver", "phishing", "iranian apt", "malware", "Kimsuky", "geopolitical tensions", "tamecat", "threat intelligence", "tonnerre"], "pulses": ["Iranian APT Infrastructure in Focus: Mapping State-Aligned Clusters During Geopolitical Escalation", "Twitter Feed - skocherhan - 07-03-2026", "Malware Filter - Botnet List - 05-03-2026 (Part 5)", "Twitter Feed - Cyberteam008 - 22-01-2024"], "malware_count": 0, "passive_dns_count": 0}


ioc_type: ipv4
ioc_value: 94.198.40.4
source: otx
validated_at: 2026-04-02T19:36:11.785769
raw_response:
  {"pulse_count": 11, "reputation": 0, "country": "Germany", "country_code": "DE", "city": "Frankfurt am Main", "asn": "AS9009 m247 ltd", "indicator": "94.198.40.4", "tags": ["word", "html", "span", "hta file", "description", "angolaministry", "find", "small", "sugargh0st", "body", "umbrella", "cluster", "foreign affairs", "github", "rat", "script", "friday", "homepage", "copy", "link", "talos", "tornet", "contact", "windows task", "download", "rar file", "footer", "sneakychef", "reload", "cisco secure", "open", "threats", "courier", "sugargh0st rat", "form", "close", "main", "spicerat", "c2 server", "dll loader", "june", "sideloading", "gh0st rat", "team", "enterprise", "generatedthe", "star", "button", "ministry", "write"], "pulses": ["Unveiling SpiceRAT: Latest tool targeting EMEA and Asia", "Unveiling SpiceRAT: SneakyChef&#x27;s latest tool targeting EMEA and Asia", "C&C-IP-List", "DOH IP & URL IOC", "Domain-URL-IP-Hash-IOC", "Domain-URL-IP-Hash-IOC", "SneakyChef espionage group targets government agencies with SugarGh0st and more infection techniques", "SneakyChef espionage group targets government agencies with SugarGh0st and more infection techniques", "SneakyChef espionage group targets government agencies with SugarGh0st and more infection techniques", "Unveiling SpiceRAT: SneakyChef's latest tool targeting EMEA and Asia", "SneakyChef and SugarGh0stRAT targets governments"], "malware_count": 0, "passive_dns_count": 11, "malware_samples": [], "passive_dns": ["app.turkmensk.org", "login.pnmukkcp0byonvbeirhkryzrr.ml", "www.pnmukkcp0byonvbeirhkryzrr.ml", "www.cra-101.ca", "handphonearena.com", "isonic-int.com", "find.sppwoods.com", "matbet239.com", "travelkhatlon.com", "boom.asamerla.live", "img.krdtele.com"]}


ioc_type: ipv4
ioc_value: 139.59.85.26
source: dshield
validated_at: 2026-04-02T20:04:35.001917
raw_response:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@digitalocean.com", "as": 14061, "asname": "DIGITALOCEAN-ASN", "ascountry": "US", "assource": "", "network": "139.59.80.0/20", "threatfeeds": {"blocklistde22": {"lastseen": "2025-07-22", "firstseen": "2022-02-21"}, "blocklistdeasterisk": {"lastseen": "2025-07-22", "firstseen": "2022-02-20"}, "ciarmy": {"lastseen": "2025-07-22", "firstseen": "2021-07-29"}, "rosti": {"lastseen": "2025-07-22", "firstseen": "2025-07-02"}}}


ioc_type: ipv4
ioc_value: 141.164.45.200
source: dshield
validated_at: 2026-04-02T20:04:36.286452
raw_response:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@choopa.com", "as": 20473, "asname": "AS-CHOOPA", "ascountry": "US", "assource": "", "network": "141.164.32.0/19", "threatfeeds": {"blocklistde443": {"lastseen": "2024-08-13", "firstseen": "2024-08-11"}, "blocklistde80": {"lastseen": "2024-08-13", "firstseen": "2024-08-11"}, "blocklistdeapache": {"lastseen": "2024-08-13", "firstseen": "2024-08-11"}, "blocklistdebruteforcelogin": {"lastseen": "2024-08-13", "firstseen": "2024-08-11"}}}


ioc_type: ipv4
ioc_value: 143.244.134.188
source: dshield
validated_at: 2026-04-02T20:04:39.618462
raw_response:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@digitalocean.com", "as": 14061, "asname": "DIGITALOCEAN-ASN", "ascountry": "US", "assource": "", "network": "143.244.128.0/20", "threatfeeds": {"blocklistde22": {"lastseen": "2026-01-26", "firstseen": "2022-01-31"}, "blocklistdeasterisk": {"lastseen": "2026-01-26", "firstseen": "2022-02-04"}, "ciarmy": {"lastseen": "2026-01-26", "firstseen": "2023-05-04"}, "rosti": {"lastseen": "2026-01-26", "firstseen": "2025-07-02"}}}


ioc_type: ipv4
ioc_value: 144.126.218.218
source: dshield
validated_at: 2026-04-02T20:04:40.166468
raw_response:
  {"count": 4, "attacks": 3, "maxdate": "2026-03-09", "mindate": "2026-03-09", "updated": "2026-03-10 06:41:17", "comment": null, "asabusecontact": "abuse@digitalocean.com", "as": 14061, "asname": "DIGITALOCEAN-ASN", "ascountry": "US", "assource": "", "network": "144.126.208.0/20", "threatfeeds": {"blocklistde110": {"lastseen": "2026-03-09", "firstseen": "2023-05-20"}, "blocklistde143": {"lastseen": "2026-03-09", "firstseen": "2023-05-20"}, "blocklistde25": {"lastseen": "2026-03-09", "firstseen": "2023-05-20"}, "blocklistde993": {"lastseen": "2026-03-09", "firstseen": "2023-05-20"}, "blocklistdecourierimap": {"lastseen": "2026-03-09", "firstseen": "2023-05-20"}, "ciarmy": {"lastseen": "2026-03-09", "firstseen": "2022-11-17"}, "rosti": {"lastseen": "2026-03-09", "firstseen": "2025-07-02"}}}


ioc_type: ipv4
ioc_value: 195.62.53.63
source: dshield
validated_at: 2026-04-02T20:06:02.513374
raw_response:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@ipserver.su", "as": 44812, "asname": "IPSERVER-RU-NET Fiord", "ascountry": "RU", "assource": "", "network": "195.62.52.0/23", "threatfeeds": {"blocklistde443": {"lastseen": "2017-03-13", "firstseen": "2017-03-10"}, "blocklistde80": {"lastseen": "2017-03-13", "firstseen": "2017-03-10"}, "blocklistdeapache": {"lastseen": "2017-03-13", "firstseen": "2017-03-10"}, "blocklistdebruteforcelogin": {"lastseen": "2017-03-13", "firstseen": "2017-03-10"}}}


ioc_type: ipv4
ioc_value: 46.29.234.46
source: dshield
validated_at: 2026-04-02T20:06:28.112958
raw_response:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "abuse@fionera.de", "as": 207713, "asname": "GIR-AS", "ascountry": "RU", "assource": "", "network": "46.29.234.0/24", "threatfeeds": {"blocklistde443": {"lastseen": "2015-10-02", "firstseen": "2015-10-01"}, "blocklistde80": {"lastseen": "2015-10-03", "firstseen": "2015-10-01"}, "blocklistdeapache": {"lastseen": "2015-10-03", "firstseen": "2015-10-01"}, "blocklistdebruteforcelogin": {"lastseen": "2015-10-02", "firstseen": "2015-10-01"}, "rosti": {"lastseen": "2025-07-02", "firstseen": "2025-07-02"}}}


ioc_type: ipv4
ioc_value: 92.242.62.186
source: dshield
validated_at: 2026-04-02T20:07:35.545392
raw_response:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "support@neoserver.site", "as": 201192, "asname": "DILMAX", "ascountry": "US", "assource": "", "network": "92.242.62.0/23", "threatfeeds": {"blocklistde110": {"lastseen": "2019-11-17", "firstseen": "2019-11-15"}, "blocklistde143": {"lastseen": "2019-11-17", "firstseen": "2019-11-15"}, "blocklistde25": {"lastseen": "2019-11-16", "firstseen": "2019-11-15"}, "blocklistde993": {"lastseen": "2019-11-16", "firstseen": "2019-11-15"}, "blocklistdecourierimap": {"lastseen": "2019-11-16", "firstseen": "2019-11-15"}}}


ioc_type: ipv4
ioc_value: 92.242.62.45
source: dshield
validated_at: 2026-04-02T20:07:36.833230
raw_response:
  {"count": 0, "attacks": 0, "maxdate": null, "mindate": null, "updated": null, "comment": null, "asabusecontact": "support@neoserver.site", "as": 201192, "asname": "DILMAX", "ascountry": "US", "assource": "", "network": "92.242.62.0/23", "threatfeeds": {"blocklistde110": {"lastseen": "2019-02-09", "firstseen": "2019-02-08"}, "blocklistde143": {"lastseen": "2019-02-09", "firstseen": "2019-02-08"}, "blocklistde25": {"lastseen": "2019-02-09", "firstseen": "2019-02-08"}, "blocklistde993": {"lastseen": "2019-02-09", "firstseen": "2019-02-08"}, "blocklistdecourierimap": {"lastseen": "2019-02-09", "firstseen": "2019-02-08"}}}


ioc_type: ipv4
ioc_value: 1.0.1.1
source: stevenblack
validated_at: 2026-04-02T20:12:07.860112
raw_response:
  {"hostnames_checked": ["planetven.us", "traefik.heatherward.dev", "deathegg.win", "bloreblat.com", "get.datamate.org", "www.kevinolson.com", "www.49v.icu", "nocodb.bloreblat.com", "vpn.dev.rjpalombo.com", "ha.dataedgelabs.online", "veibell.com", "vpn.int.sysad.dev", "home.dataedgelabs.online", "kituo.dpdns.org", "vpn.london.murrayweb.ca", "api.vpn.playa.delcar.men", "nftelligence.app", "dashboard.vpn.playa.delcar.men", "jodoky.com", "apmac.us"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 109.234.38.232
source: stevenblack
validated_at: 2026-04-02T20:12:07.896129
raw_response:
  {"hostnames_checked": ["wa.me", "www.vipescortsingapore.com", "www.7noch.ru", "www.myladyescort.ru", "www.beijinghotelmassage.net", "whatsapp.com", "nehaindependentescort.com", "beijinghotelmassage.net", "myces.ru", "www.pensacolamassagecenter.com", "7noch.ru", "elektroraduga.direct.quickconnect.to", "v444379.hosted-by-vdsina.com", "myladyescort.ru", "www.diamondtantramassage.com", "www.backtohealthmassage.org", "vipescortsingapore.com", "www.riga-escort.com", "backtohealthmassage.org", "pensacolamassagecenter.com", "diamondtantramassage.com", "whatsapp.net", "riga-escort.com", "www.nehaindependentescort.com"], "hostnames_count": 24, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 140.82.29.65
source: stevenblack
validated_at: 2026-04-02T20:12:07.963886
raw_response:
  {"hostnames_checked": ["penknife45.quyenzo.ru", "bid.navigation63.quyenzo.ru", "interface.alter95.quyenzo.ru", "sample.penknife85.quyenzo.ru", "navigation7.quyenzo.ru", "140.82.29.65.vultrusercontent.com", "interface.alter29.quyenzo.ru", "salary48.minhizo.ru", "sincro.armandoqs.com", "penknife59.quyenzo.ru", "festiva.tech", "vagif.shop", "sought.sorry89.quyenzo.ru", "destroy.asierdo.ru", "intercourse20.cavalierso.ru", "ntx.tshsuport.ml", "bike.intercourse20.cavalierso.ru", "alter77.quyenzo.ru", "interface.alter40.quyenzo.ru", "bahirdo.ru", "fishitor.ru", "api.sincro.armandoqs.com", "alter53.quyenzo.ru"], "hostnames_count": 23, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 143.110.168.51
source: stevenblack
validated_at: 2026-04-02T20:12:08.014733
raw_response:
  {"hostnames_checked": ["www.bitflo.io", "www.ryanwelch.me", "gitops.ryanwelch.co.uk", "ryanwelch.me", "lyre-group-bitflo-frontend.ci.ryanwelch.co.uk", "le-36955211.ci.ryanwelch.co.uk", "ryantwr-transaction-sync-frontend-staging.ci.ryanwelch.co.uk", "www.ryanwelch.co.uk", "ryantwr-butea-site-staging.ci.ryanwelch.co.uk", "ryantwr-butea-site.ci.ryanwelch.co.uk", "ryanwelch.co.uk", "www.butea.co.uk", "butea.co.uk", "bitflo.io", "staging.ryanwelch.co.uk", "le-22489223.ci.ryanwelch.co.uk", "le-17572127.ci.ryanwelch.co.uk", "local.ryanwelch.co.uk"], "hostnames_count": 18, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 151.248.114.88
source: stevenblack
validated_at: 2026-04-02T20:12:08.073348
raw_response:
  {"hostnames_checked": ["lovers.semara.ru", "tubercur.ru", "support2.yvgrishin.ru", "support2.rbs-net.ru", "kilogar.ru", "preyai.site", "my.yvgrishin.ru", "hurama.ru", "oderas.ru", "eurypterida.online", "www.support2.rbs-net.ru", "showroom.preyai.site", "fortias.ru", "gromphadorhina.online", "cyrestinae.online", "asilidae.ru", "alloy.vadilops.ru", "heliconiinae.online", "chelicerata.online", "merostomata.online"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 151.248.117.250
source: stevenblack
validated_at: 2026-04-02T20:12:08.091237
raw_response:
  {"hostnames_checked": ["limulusa.online", "storiesmoscow.ru", "libellulat.online", "lycaenidae.online", "haromo.ru", "dahmke.ru", "coleopteras.online", "megatos.online", "cholerd.ru", "acrididae.online", "debarys.ru", "shermano.ru", "mantidae.online", "www.storiesmoscow.ru", "fanniidae.online", "blaberidae.online", "apaturinae.online", "limenitidinae.online", "151-248-117-250.cloudvps.regruhosting.ru", "mamberis.ru", "biblidinae.online"], "hostnames_count": 21, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 151.248.121.176
source: stevenblack
validated_at: 2026-04-02T20:12:08.097250
raw_response:
  {"hostnames_checked": ["acetobacter.online", "cholerd.ru", "lophacris.online", "apidaet.online", "cdn.onlyplanks.fun", "api.onlyplanks.fun", "dahmke.ru", "papiliot.online", "oderas.ru", "onlyplanks.ru", "fanniidae.online", "limenitidinae.online", "maniola.online", "onlyplanks.fun", "blaberidae.online", "hymenoptera.online", "gonepteryx.online", "megatos.online", "arachnidas.online", "api.onlyplanks.ru", "151-248-121-176.cloudvps.regruhosting.ru", "shermano.ru", "kallima.online"], "hostnames_count": 23, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 151.248.125.140
source: stevenblack
validated_at: 2026-04-02T20:12:08.106916
raw_response:
  {"hostnames_checked": ["horoton.ru", "akunir.ru", "integer.relative.protimas.ru", "printing65.luck.ouichi.ru", "priest30.allen.gribata.ru", "country33.salary.nemoiti.ru", "counter.vositra.ru", "salt.utrado.ru", "salmon12.perfume.warau.ru", "timerto.ru", "bokujanai.ru", "country77.salary.nemoiti.ru", "jipitor.ru", "voranfi.ru", "bortogat.ru", "prevented.registration.pirovot.ru", "alvarados.ru", "kozikra.ru", "go9.regret.warau.ru", "kiesoud.ru"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 176.118.164.187
source: stevenblack
validated_at: 2026-04-02T20:12:08.400496
raw_response:
  {"hostnames_checked": ["cyrestinae.ru", "kilogar.ru", "acrididae.ru", "fortias.ru", "sparkasse-verwaltung.com", "securego-vr.com", "codes-nordea.com", "libellulidae.ru", "bestsign-verwaltung.com", "lepidopteras.ru", "apaturinae.ru", "raiffeisen-verwaltung.com", "blaberidae.ru", "fanniidae.ru", "alloy.vadilops.ru", "lovers.semara.ru", "tubercur.ru", "alert-volksbank.com", "bestsign-alert.com", "coliadinae.ru"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 185.20.225.35
source: stevenblack
validated_at: 2026-04-02T20:12:08.512532
raw_response:
  {"hostnames_checked": ["delusion.teasagaki.ru", "source68.alternate.vadilops.ru", "deluge.degrade.teasagaki.ru", "amid89.luxury.clank.nomukou.ru", "185-20-225-35.cloudvps.regruhosting.ru", "relax.elitoras.ru", "wokoras.ru", "lumber5.am.sumikko.ru", "stoop13.performed.pride.nomukou.ru", "amazing.garbani.ru", "neat.trobona.ru", "miwosaga.ru", "pzles.ru", "navigation33.countries.hibigaru.ru", "www.pzles.ru", "l11fc91a.justinstalledpanel.com", "luxury.clank.nomukou.ru", "designer.fishardo.ru", "intent14.erostipa.ru", "pride.nomukou.ru", "stopped95.famous.filorta.ru"], "hostnames_count": 21, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 185.46.10.17
source: stevenblack
validated_at: 2026-04-02T20:12:08.566350
raw_response:
  {"hostnames_checked": ["dionysi.online", "acrididae.online", "cholerd.ru", "apidaet.online", "apaturinae.online", "185-46-10-17.cloudvps.regruhosting.ru", "secure-coplogic.com", "papiliot.online", "oderas.ru", "coleopteras.online", "fanniidae.online", "cerambycidae.online", "limulusa.online", "maniola.online", "gonepteryx.online", "ariuma.ru", "arachnidas.online", "shermano.ru", "coliadinae.online", "mamberis.ru"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 188.225.58.233
source: stevenblack
validated_at: 2026-04-02T20:12:08.810917
raw_response:
  {"hostnames_checked": ["static.mgimo.wwdev.ru", "crmfastrans.ru", "etc.d.grb.agency", "billing.webway.ru", "confluence.avangardus.ru", "test.d.grb.agency", "emd.d.grb.agency", "traefik.d.grb.agency", "la.d.grb.agency", "s.d.grb.agency", "crocushall.wwdev.ru", "oceanarium.wwdev.ru", "dashboard.taras.io", "jira.avangardus.ru", "fourth.d.grb.agency", "538645-cd89829.tmweb.ru", "api.emd.d.grb.agency", "avangardus.ru", "docs.avangardus.ru", "first.d.grb.agency"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 193.124.206.128
source: stevenblack
validated_at: 2026-04-02T20:12:08.860193
raw_response:
  {"hostnames_checked": ["geografteach.ru", "acetobacter.online", "cholerd.ru", "nematoceras.online", "i.s-microsoft.com", "mantidae.online", "blattodea.ru", "metcalfas.online", "morphinaes.online", "chelicerata.online", "l9dff363.justinstalledpanel.com", "microsoft.com", "wwwqa.microsoft.com", "c.s-microsoft.com", "eurypterida.online", "limenitidinae.online", "staticview.microsoft.com", "nymphalidaes.online", "cyrestinae.online", "hamadryas.online", "gonepteryx.online", "www.microsoft.com", "ariuma.ru", "api.geografteach.ru", "danainae.online", "privacy.microsoft.com", "haromo.ru"], "hostnames_count": 27, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 194.58.108.140
source: stevenblack
validated_at: 2026-04-02T20:12:08.941458
raw_response:
  {"hostnames_checked": ["acrididae.online", "acetobacter.online", "hierodula.online", "nematoceras.online", "lepidopteras.online", "apidaet.online", "sporog.ru", "194-58-108-140.cloudvps.regruhosting.ru", "papiliot.online", "mesant.online", "fusari.ru", "mantodeas.online", "maniola.online", "cyrestinae.online", "disco.r2-x2.ru", "megatos.online", "ariuma.ru", "meandrusas.online", "tomond.ru", "apoxipodes.online", "mamberis.ru"], "hostnames_count": 21, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 194.58.121.94
source: stevenblack
validated_at: 2026-04-02T20:12:09.022627
raw_response:
  {"hostnames_checked": ["www.public-soft.ru", "www.publicsoft.ru", "dokfilm24.ru", "www.federaltorg.ru", "www.111.federaltorg.ru", "www.dev.dokfilm24.ru", "www.look-lit.ru", "dev.dokfilm24.ru", "kukuha.ru", "public-soft.ru", "111.federaltorg.ru", "www.krasnodar.federaltorg.ru", "ivilica.pro", "federaltorg.ru", "publicsoft.ru", "www.ivilica.pro", "look-lit.ru", "krasnodar.federaltorg.ru", "www.kukuha.ru", "www.dokfilm24.ru"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 194.58.122.110
source: stevenblack
validated_at: 2026-04-02T20:12:09.037954
raw_response:
  {"hostnames_checked": ["lepidopteras.online", "crm.norbekov.online", "api.norbekov.ru", "hesperiidae.online", "criocash.fun", "empusidae.online", "erp.norbekov.online", "api.norbekov.online", "cerambycidae.online", "norbekov.ru", "nrb.ayurvedarussia.online", "biblidinae.online", "libellulat.online", "maniola.online", "cyrestinae.online", "blaberidae.online", "megatos.online", "false.grafitto.ru", "coliadinae.online", "mamberis.ru"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 194.58.123.47
source: stevenblack
validated_at: 2026-04-02T20:12:09.070341
raw_response:
  {"hostnames_checked": ["heteroptera.ru", "hurama.ru", "cholerd.ru", "mantidae.online", "www.autoserviscrm.ru", "sporog.ru", "telegrme.ru", "autoserviscrm.ru", "194-58-123-47.cloudvps.regruhosting.ru", "nematoceras.ru", "dahmke.ru", "morphon.online", "oderas.ru", "ssl.autoserviscrm.ru", "gromphadorhina.ru", "www.ssl.autoserviscrm.ru", "hymenoptera.online", "megascolias.online", "aerogenosa.ru", "melitaeas.online"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 194.58.90.120
source: stevenblack
validated_at: 2026-04-02T20:12:09.079839
raw_response:
  {"hostnames_checked": ["194-58-90-120.cloudvps.regruhosting.ru", "haromo.ru", "maniola.online", "hamadryas.online", "dahmke.ru", "miragenails.ru", "coleopteras.online", "megatos.online", "sporog.ru", "libellulidae.online", "nymphalidaes.online", "papiliot.online", "test2.tpopractice.online", "blattodea.online", "btrx.tpopractice.online", "blattodea.ru", "apaturinae.online", "kallima.online", "ariuma.ru", "biblidinae.online"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 194.58.92.102
source: stevenblack
validated_at: 2026-04-02T20:12:09.085063
raw_response:
  {"hostnames_checked": ["5qcvpxsbtj2thebu.jolotras.ru", "0xibtllmqln.jolotras.ru", "5x6tmceskjfa.jolotras.ru", "8sh7ssik1icsfkqdm13ja.jolotras.ru", "ef0lvjovzzdnz.jolotras.ru", "aesz0zbeln2i7o.moolin.ru", "esports-team.com", "tfvlwjyu.jolotras.ru", "etdfio9xcgft9.jolotras.ru", "aaaaaa.krashand.ru", "a.bokuwai.ru", "pmghrklyf67.jolotras.ru", "bokuwai.ru", "ezvz5lpwubmtqnyttq.jolotras.ru", "rchi9vryn2aev.moolin.ru", "wwxnv7n2g4eat.jolotras.ru", "tpjlj6wdw.jolotras.ru", "aaaa.krashand.ru", "p6eyuf3yckpvnegci.jolotras.ru", "bilargo.ru"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 194.58.97.115
source: stevenblack
validated_at: 2026-04-02T20:12:09.100715
raw_response:
  {"hostnames_checked": ["dionysi.online", "promo.bestcourse.pro", "bestcourse.pro", "www.xn--e1ajpfcja6ek.xn--p1ai", "watchsports.ru", "www.watchsports.ru", "owa.xn--e1ajpfcja6ek.xn--p1ai", "limenitis.online", "lycaenidae.online", "cerambycidae.online", "libellulat.online", "api.effort.advase.digital", "hymenoptera.online", "cadence.fishing", "www.cadence.fishing", "false.grafitto.ru", "www.nviot.space", "nviot.space", "xn--e1ajpfcja6ek.xn--p1ai", "coliadinae.online"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 194.67.109.14
source: stevenblack
validated_at: 2026-04-02T20:12:09.163593
raw_response:
  {"hostnames_checked": ["acrididae.online", "forvpsult.online", "www.medvedkovo.olimpic-fit.ru", "informpanton.online", "anisoptera.online", "medvedkovo.olimpic-fit.ru", "apidaet.online", "proteug.ru", "informpanton.site", "194-67-109-14.cloudvps.regruhosting.ru", "mycodar.ru", "informpanton.space", "babushkinskaya.olimpic-fit.ru", "erati.ru", "dahmke.ru", "oderas.ru", "fusari.ru", "www.babushkinskaya.olimpic-fit.ru", "megatos.online", "graphiuma.online", "haromo.ru"], "hostnames_count": 21, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 194.67.109.164
source: stevenblack
validated_at: 2026-04-02T20:12:09.173836
raw_response:
  {"hostnames_checked": ["2uvh.moolin.ru", "xfqfmo.moolin.ru", "lvdar49kcr.moolin.ru", "ml5gll.moolin.ru", "phymateus.ru", "zgsabtluknpapo.moolin.ru", "eukkx9cnsogih.moolin.ru", "ngxlrex.moolin.ru", "firasto.ru", "nonimak.ru", "dxr7fhmldd13gnltx1i.moolin.ru", "6hhbhqt.moolin.ru", "ryncm4q.moolin.ru", "g9lkosqfeq.moolin.ru", "ptvr5otdau.moolin.ru", "aaa.nonimak.ru", "mieemmrgl.moolin.ru", "aaaaaa.bokuwai.ru", "1levnzee.moolin.ru", "rprszzqep6htj.moolin.ru"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 194.67.113.186
source: stevenblack
validated_at: 2026-04-02T20:12:09.267195
raw_response:
  {"hostnames_checked": ["morphinaes.online", "graphiuma.online", "asilidae.online", "libellulat.online", "dahmke.ru", "coleopteras.online", "megatos.online", "polyphemus.online", "papiliot.online", "gonepteryx.online", "limenitis.online", "zarkino.online", "blattodea.ru", "putrif.ru", "194-67-113-186.cloudvps.regruhosting.ru", "www.primextula.ru", "blaberidae.online", "primextula.ru", "dionysi.online", "nematoceras.online", "tomond.ru"], "hostnames_count": 21, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 31.31.203.219
source: stevenblack
validated_at: 2026-04-02T20:12:09.640889
raw_response:
  {"hostnames_checked": ["acrididae.online", "hurama.ru", "proguru.space", "mucora.ru", "kilogar.ru", "acrididae.ru", "keitaro.shelbycompany.space", "31-31-203-219.cloudvps.regruhosting.ru", "fortias.ru", "merostomata.online", "www.xn----etb1b.xn--p1ai", "xn----etb1b.xn--p1ai", "shelbycompany.space", "baryo.ru", "empusidae.ru", "alloy.vadilops.ru", "lovers.semara.ru", "tubercur.ru", "lb130473.justinstalledpanel.com", "coliadinae.ru"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


ioc_type: ipv4
ioc_value: 37.140.195.137
source: stevenblack
validated_at: 2026-04-02T20:12:09.688299
raw_response:
  {"hostnames_checked": ["heliconiinae.online", "hurama.ru", "mucora.ru", "lepist.ru", "kilogar.ru", "gromphadorhina.online", "counter.podloka.ru", "skud.skladovka.ru", "lepist.space", "baryo.ru", "37-140-195-137.xen.vps.regruhosting.ru", "37-140-195-137.ovz.vps.regruhosting.ru", "arctiidae.ru", "arachnidas.ru", "libellulat.ru", "alloy.vadilops.ru", "lovers.semara.ru", "tubercur.ru", "37-140-195-137.cloudvps.regruhosting.ru", "37-140-195-137.xs.vps.regruhosting.ru"], "hostnames_count": 20, "matched_domains": [], "match_count": 0, "blocklist_size": 91978}


