https://kevintswaney.com/ioc-library Indicators of compromise worth hunting for, curated by Kevin Swaney, with the detection angle that matters. Sourced from public advisories and real-world analysis. en-us Sun, 25 Oct 2026 12:00:00 GMT https://kevintswaney.com/ioc-library Hunt MeshCentral at mesh[.]buttruyen[.]com, AdaptixC2 at 64[.]94[.]85[.]14:4321, staging at sthyjk[.]com:8443 and alknene[.]shop, forged prof_admin CGIINFO requests to FortiWeb, and rogue eight-character admin accounts with trusted-host 0.0.0.0/0. Sources: Group-IB/NyxLab; The Hacker News. By Kevin Swaney. Sun, 25 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library Hunt proxy.php requests with encoded traversal or shell substitution in remote_font_config.url, unexpected PHP web shells on Nextcloud hosts, and post-exploitation searches for credential stores and wallets. Sources: CISA KEV; The Hacker News. By Kevin Swaney. Sat, 24 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library Version 1.1.5 backdoors used dc[.]cathaypacifice[.]com and net[.]dpworldto[.]com; version 1.1.7 pulled encrypted configs from GitHub. Hunt signed executables loading adjacent malicious DLLs, config.ini reads followed by in-memory execution, anomalous vssadmin use, and ntds.dit access. Source: Sophos. By Kevin Swaney. Fri, 23 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library Arista observed 74[.]82[.]197[.]86 and 38[.]54[.]50[.]151 in attacks on the CVE-2026-114625 zero-day. Block both, and hunt VCO web logs for unusual URL paths, encoded payloads, and unexpected outbound connections. Source: Arista Security Advisory 0199. By Kevin Swaney. Fri, 23 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library Any install of litellm==1.107.0 from the October 21 PyPI window (roughly 11:39 to 13:23 UTC) or Docker tags live until about 14:20 UTC is a compromise indicator: the payload activates through Python startup hooks even when never imported. Treat the host or CI runner as burned and rotate every secret. Source: BerriAI; Socket. By Kevin Swaney. Thu, 22 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library Eight eMudhra intermediates had trivially recoverable P-384 private keys (one was the number 4), chaining to emSign ECC Root CA - G3. Browsers blocked them October 17 to 20, but non-browser trust stores in containers, runtimes, and appliances may still trust the chain. Source: Cloudflare; Mozilla. By Kevin Swaney. Thu, 22 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library 149.248.47.234, 208.83.239.114, and 66.42.72.14 are tied to active exploitation of the PAN-OS management-interface RCE. Block at the edge and scan firewall and network logs for historical connections. Source: F5 Labs, October 21, 2026. By Kevin Swaney. Thu, 22 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library Nine IPs tied to victim intrusions, victim-data hosting, client login panels, exfiltration, and soc.dll command and control, published in the joint CISA/FBI SafePay advisory of October 20, 2026. Investigate before blocking. By Kevin Swaney. Wed, 21 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library Hashes for the 1.exe ransomware binary, soc.dll, and SharpShares.exe from the joint SafePay advisory. Feed to EDR blocklists and hunt historical detections. Source: CISA AA26-293A, October 20, 2026. By Kevin Swaney. Wed, 21 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library Unit 42 published nine attacker IPs and four suspicious host IDs seen in GlobalProtect gateway-connected events from ransomware exploitation. Hunt GlobalProtect logs for successful logins from these. Source: Palo Alto Networks Unit 42, updated October 19, 2026. By Kevin Swaney. Wed, 21 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library mangoapi.php in the web root, /usr/bin/dbus-authd (SUID /bin/sh copy), the zz-root-persist boot script, the /uidchanarge HAProxy URI path, and /ns/config/sudoers.template modifications. Hunt with on-disk artifacts, not logs, since the actor deletes them. Source: Google Threat Intelligence Group indicators. By Kevin Swaney. Tue, 20 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library TSDS hits a SaaS vendor (Canny, August 28) then pivots into customers through standing integrations, claiming 72+ hours inside Canva's Salesforce. Hunt OAuth grants and API tokens held by feedback, support, and survey tools reaching your CRM. Sources: DataBreaches.net, Cyber Daily. By Kevin Swaney. Mon, 19 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library 108.165.147[.]64 observed as UTA0576-controlled infrastructure in the Connect Secure intrusion investigated by Volexity. Per the OP Innovate writeup of Volexity's research, October 14, 2026. By Kevin Swaney. Sun, 18 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library /dana-na/auth/url_default/welcome.cgi targeted as the public entry point; the X-DSCGI-PATH header manipulated to route requests to arbitrary CGI files and bypass authentication. Per the OP Innovate writeup of Volexity's research, October 14, 2026. By Kevin Swaney. Sun, 18 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library /data/.icscap/ capture directory plus LDAP tooling (/tmp/ml.py, /tmp/rq5.py) and Kerberos tooling (/tmp/mk.py, /tmp/rr.py). Per the OP Innovate writeup of Volexity's research, October 14, 2026. By Kevin Swaney. Sun, 18 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library No malware or web shells: the actor re-exploits per command, manipulates in-memory libraries, reverts config changes, and selectively deletes logs. Evades Ivanti's Integrity Checker Tool; hunts LAPS passwords and BitLocker keys. Per Volexity via OP Innovate, October 14, 2026. By Kevin Swaney. Sun, 18 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library PEERSTITCH infrastructure per Unit 42: 23.240.77[.]233 and 47.18.167[.]159 hosting installers; 45.32.41[.]202 and 198.199.122[.]22 for rogue FortiGate registrations; stager URLs on port 8085; ACME abuse endpoints on port 8084; traffic markers TCP 8550 and IP 169.254.0.1. Sat, 17 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library Unit 42 hashes for the PEERSTITCH ARM64 ELF injector, mmap shellcode bootstrap, core hook injection block, staging script, Node.js orchestrator, Emscripten runtime and WebAssembly module, and runtime shared-secret artifact. Sat, 17 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library Rogue FortiGate named localhost registered to FortiManager; auto-script object named ../../..//setup; Apache mod_md abused for SSH reverse shells; syslog termination, crash-log clearing, telemetry disruption, and auto-deletion of rogue admins and auto-scripts. Sat, 17 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library SAWFLY PHP web shell, unexpected root SUID shells, passwordless-sudo boot scripts, BARECLAW SOCKS5-over-WebSocket tunnels routed through HAProxy config, Jump Item roles raised to Administrator, and log deletions. Behavior is the detection angle since the actor rotates infrastructure per victim. Sat, 17 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library C2 domain rank1cdn[.]com; three malicious wp_options keys; rogue administrator accounts; PHP-executable .cache files; a fake WordPress core file; and a system cron marker. Tied to trojanized 3.0.123 packages served October 15-16, 2026. Sat, 17 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library Hunt angles from the Microsoft-led YAM Store takedown: the phishing kits used device-code phishing to steal tokens and held tenant admin access through app-only auth with stolen client secrets. Hunt Entra ID sign-in logs for device-code flow abuse and audit app consent grants. Fri, 16 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library The COPC attacker posed as a trusted source on a voice call to reach files holding protected health information, with no malware involved. The Chaos ransomware group's claimed credit is UNVERIFIED. Correlate helpdesk voice requests with subsequent data access and require call-back verification. Fri, 16 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library Cisco Secure Email Gateway self-check log alerts ("Suspected compromise indicator was found", "Security scan did not complete") from the Oct 14 advisory. The first confirms a compromise indicator; contact TAC and rotate credentials and crypto material. The second is not a clean bill of health. Thu, 15 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library Hunt firewall and network logs for unusual uploads or downloads between SEG appliances and external or suspicious IPs. Attackers may wipe on-box evidence after gaining root, so the network trail matters. Shadowserver counts nearly 300 SEG instances exposed online. Thu, 15 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library Palo Alto's interim detection for the PAN-OS management-interface RCE: Threat IDs 510046 and 510047 (content 9159-10287+, needs SSL decryption). Also audit management-plane logs for unexplained authenticated sessions, especially from untrusted IPs. Thu, 15 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library UTA0576 operator host for the Ivanti Connect Secure zero-day campaign (Volexity, Oct 13, 2026). Hunt for outbound connections, especially from VPN or edge appliances. Defang when sharing: 108.165.147[.]64. Wed, 14 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library UTA0576 post-exploitation tooling on Ivanti Connect Secure: custom LDAP, Kerberos (Kerberoast-capable), and password-spraying scripts. Sweep /tmp on internet-facing ICS boxes. Wed, 14 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library UTA0576 packet-capture credential harvesting on Ivanti Connect Secure: dsstatmond sniffs LDAP, HTTP, FTP, telnet for credentials and NTLM material. Hunt processes running from hidden directories and BPF socket filters on edge appliances. Wed, 14 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library UTA0576 auth-bypass exploit pattern (CVE-2026-104935): the URL passes the access check while the header routes to a protected script. Monitor for URL/header mismatches and bursts of welcome.cgi requests. Wed, 14 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library UTA0576 root payloads (ics-root-run-inband-*.pl) patch /home/lib/libdsplibs.so in memory only, defeating Ivanti's Integrity Checker Tool. A clean check does not rule out compromise: use memory and network forensics. Wed, 14 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library UTA0576 wipes recent entries from /home/runtime/dlogs/debuglog and /var/log/audit/audit.log. Gaps or truncated audit windows on ICS appliances are themselves a signal. Wed, 14 Oct 2026 12:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library Seven domains tied to Flax Typhoon / Integrity Technology Group, seized by the FBI on October 8, 2026 (MicroScan scanner and FishHub phishing infrastructure; several mimic Microsoft, LinkedIn, YouTube branding). Hunt in historical mail, proxy, and DNS logs. Mon, 12 Oct 2026 16:30:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library Flax Typhoon / Integrity Technology Group persistence mechanism. Hunt for renamed SoftEther installers on endpoints. Mon, 12 Oct 2026 16:30:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library Flax Typhoon / Integrity Technology Group indicator. DiagTrack making outbound HTTP is abnormal; investigate the endpoint. Mon, 12 Oct 2026 16:30:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library Flax Typhoon / Integrity Technology Group artifacts. Hunt for DC.exe and office-cli presence across the fleet. Mon, 12 Oct 2026 16:30:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library Integrity Technology Group / Flax Typhoon exploitation of CVE-2015-3306. Review FTP logs for these commands. Sun, 11 Oct 2026 16:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library Integrity Technology Group / Flax Typhoon exploitation of CVE-2016-3081. Inventory and remediate exposed instances. Sun, 11 Oct 2026 16:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library Integrity Technology Group / Flax Typhoon exploitation of CVE-2015-5477. Monitor resolver query patterns. Sun, 11 Oct 2026 16:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney) https://kevintswaney.com/ioc-library Integrity Technology Group / Flax Typhoon tactic. Alert on anomalous authentication bursts against Exchange. Sun, 11 Oct 2026 16:00:00 GMT kevin@kevinswaneycyber.com (Kevin Swaney)