216.73.217.22

Flax Typhoon

· Published 21/12/2025 07:13 · Modified 21/12/2025 07:13 · Source: AlienVault

Essential information

Confidence
100/100
Published
21/12/2025 07:13
Modified
21/12/2025 07:13
Updated at
21/12/2025 07:13
Revoked
No
Author / Source
AlienVault
Resource level
—
Primary motivation
—
Related entities
1 reports, 16 attack patterns (mitre), 1 malware, 5 sectors, 3 countries, 102 indicators, 1 vulnerabilities (cve)

Description

No description.

Marking (TLP)

TLP:CLEAR

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Reports (1)

  • Derailing the Raptor Train
    1 CVE 16 MITREs 1 Malware 198 Observables 1 APT
    Published 20/09/2024 11:41 · Modified 20/09/2024 12:18

Attack patterns (MITRE) (16)

  • T1573 uses
    Encrypted Channel
  • T1071 uses
    Application Layer Protocol
  • Multi-Stage Channels uses
    T1104
  • T1498 uses
    Network Denial of Service
  • T1572 uses
    Protocol Tunneling
  • T1090 uses
    Proxy
  • T1584 uses
    Compromise Infrastructure
  • T1105 uses
    Ingress Tool Transfer
  • T1133 uses
    External Remote Services
  • T1499 uses
    Endpoint Denial of Service
  • T1095 uses
    Non-Application Layer Protocol
  • T1571 uses
    Non-Standard Port
  • T1190 uses
    Exploit Public-Facing Application
  • T1132 uses
    Data Encoding
  • T1588 uses
    Obtain Capabilities
  • T1587 uses
    Develop Capabilities

Malware (1)

  • Nosedive uses
    Family
    Published 20/09/2024 11:41 · Modified 20/09/2024 11:41

Sectors (5)

  • Defense targets
  • Education targets
  • Telecommunications targets
  • Government targets
  • Technology targets

Countries (3)

  • United States of America targets
  • Taiwan targets
  • Kazakhstan targets

Indicators (102)

  • firc.b2047.com indicates
  • api.k3121.com indicates
  • obqlibg.com indicates
  • gmhrxhc.com indicates
  • cvgeuwo.com indicates
  • ujrtkw.com indicates
  • lomuzs.com indicates
  • blepmhnay.com indicates
  • woaba.com indicates
  • xaqw.k3121.com indicates
  • hfsdln.com indicates
  • axqw.k3121.com indicates
  • tvcvhzyk.com indicates
  • 546390a3a296154e36051dda745b573658311f9831789bb1faca411a3803a9bb indicates
  • awbpxtpi.w8510.com indicates
  • zuszr.com indicates
  • bzbatflwb.w8510.com indicates
  • sreudcnb.com indicates
  • aqakffj.com indicates
  • hy424.com indicates
  • wvsezu.com indicates
  • lfdx.k3121.com indicates
  • hy42.com indicates
  • 2aa12e5989065951be84ce932b65bd197dd6be3fa987838bad48536c0c74d145 indicates
  • c6fe1748e68923f278926ee8679aaee22800b9c93c38641d12ea0e945e116bb0 indicates
  • eufcj.com indicates
  • hersrr.com indicates
  • qsxgzu.com indicates
  • awqx.k3121.com indicates
  • ecvkiehs.com indicates
  • omviak.com indicates
  • dvujvkfu.com indicates
  • zasdfgasd.w8510.com indicates
  • qjknpv.com indicates
  • bcdkwwuah.com indicates
  • voias.b2047.com indicates
  • zdacasdc.w8510.com indicates
  • kmgzbowwg.com indicates
  • lofeuq.com indicates
  • grntjr.com indicates
  • hy30.com indicates
  • hy1025.com indicates
  • hyddh.com indicates
  • jgnsqihc.com indicates
  • kuyw.b2047.com indicates
  • nulp.k3121.com indicates
  • lfzupr.com indicates
  • awerdasvbjgrt.b2047.com indicates
  • hy324.com indicates
  • xxqw.b2047.com indicates
  • adjsn.com indicates
  • qwsd.k3121.com indicates
  • kliscjaisdjhi.w8510.com indicates
  • ayln.b2047.com indicates
  • saoadlg.com indicates
  • hy529.com indicates
  • hy619.com indicates
  • ttcyci.com indicates
  • xbqw.k3121.com indicates
  • zdacxzd.w8510.com indicates
  • nhcmdikkd.com indicates
  • tuisasdcxzd.w8510.com indicates
  • nmfagp.com indicates
  • rnjca.com indicates
  • hnai.k3121.com indicates
  • glxxet.com indicates
  • hy92.com indicates
  • lznmihdej.com indicates
  • hume.b2047.com indicates
  • cvmnomvxm.com indicates
  • lyblqwesfawe.w8510.com indicates
  • hyjk.k3121.com indicates
  • hy229.com indicates
  • mudvw.com indicates
  • bxgtbv.com indicates
  • oploz.com indicates
  • ocmnusdjdik.w8510.com indicates
  • ykcmewapc.com indicates
  • ysubryfv.com indicates
  • aewreiuicajo.w8510.com indicates
  • mvxnspcqr.com indicates
  • sbuybjv.com indicates
  • bkhqwfhtu.com indicates
  • osiso.com indicates
  • ftcexq.com indicates
  • oklm.k3121.com indicates
  • jkwxcc.com indicates
  • amdord.com indicates
  • mjiudwajhkf.w8510.com indicates
  • fajxtg.com indicates
  • dkuwbcen.com indicates
  • mail.k3121.com indicates
  • hy830.com indicates
  • clqqknzb.com indicates
  • oicdsgjxz.com indicates
  • wndaoyk.com indicates
  • iycwqot.com indicates
  • vbbrfvhrg.com indicates
  • hy811.com indicates
  • wmllxwkg.w8510.com indicates
  • apdfhhjcxcb.w8510.com indicates
  • vgbgwzmr.com indicates

Vulnerabilities (CVE) (1)

CVE-2024-21887 KEV
9.1 Critical

Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web …

Attack vector
Network
Published
10/01/2024
Modified
27/05/2026