QuietCrabs

Search IOCs, vulnerabilities, APT…

216.73.217.47

← Back to intrusion sets

· Published 21/12/2025 19:13 · Modified 21/12/2025 19:13 · Source: AlienVault

Essential information

Confidence: 100/100
Published: 21/12/2025 19:13
Modified: 21/12/2025 19:13
Updated at: 21/12/2025 19:13
Revoked: No
Author / Source: AlienVault
Resource level: —
Primary motivation: —
Related entities: 1 reports, 17 attack patterns (mitre), 5 malware, 5 sectors, 8 countries, 75 indicators, 4 vulnerabilities (cve)

Description

No description.

Marking (TLP)

TLP:CLEAR

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Reports (1)

Dragons in Thunder

4 CVEs 17 MITREs 5 Malwares 67 Observables 1 APT

Attack patterns (MITRE) (17)

T1027 uses

Obfuscated Files or Information MITRE
T1016 uses

System Network Configuration Discovery MITRE
T1059 uses

Command and Scripting Interpreter MITRE
T1140 uses

Deobfuscate/Decode Files or Information MITRE
T1190 uses

Exploit Public-Facing Application MITRE

← Previous

Page / 2

13–17 of 17

LockBit uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Babuk - S0638 uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Sliver uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·
Babyk uses

The MITRE Corporation Confidence 100

[Babuk](https://attack.mitre.org/software/S0638) is a Ransomware-as-a-service (RaaS) malware that has been used since at least 2021. The operators of [Babuk](https://attack.mitre.org/software/S0638) employ a "Big Game Hunting" approach to targeting major enterprises…

First seen 01/01/1970 · Last seen 16/11/5138 ·
KrustyLoader uses

AlienVault Confidence 100

First seen 01/01/1970 · Last seen 16/11/5138 ·

Sectors (5)

Healthcare targets
Defense targets
Manufacturing targets
Government targets
Technology targets

Countries (8)

Iran, Islamic Republic of targets
United States of America targets
Taiwan targets
Germany targets
Philippines targets
Czechia targets
Russian Federation targets
United Kingdom of Great Britain and Northern Ireland targets

Indicators (75)

53c69869a6e186f1cd5f3908e59f2d77d25385642ec97b720550bb5fb4a64a35 indicates

stix 100/100

Win.Malware.Trojanx-10035542-0 SHA256 of 158119e7464af7d4f14d137a046de8adffef25d0

· Valid until 24/11/2026 · Source: AlienVault
167.172.64.55 indicates

stix 100/100 Revoked

CC=US ASN=AS14061 digitalocean llc

· Valid until 22/12/2025 · Source: AlienVault
36dc557b4ea173d9537392f64c1a9527a5832ca99718150fb430e0c13762758b indicates

stix 100/100

Win.Malware.Trojanx-10035542-0 SHA256 of bfcb8bd83bfa415d6e1c21a7686f2e79aea18d7a

· Valid until 24/11/2026 · Source: AlienVault
2890a9970502a7c20477a437571a260cb96375e6fe44912495daa77cb03ba470 indicates

stix 100/100

SHA256 of 3a5286acc24ec8c933182fcaccc094de148d8e06

· Valid until 24/11/2026 · Source: AlienVault
dd4f25657c4df7983c0d12b597df1ce737eeebd1c0b2bf185c93ec74a5f195c7 indicates

stix 100/100

SHA256 of d40e81552c778a66b2ca01eb38245acc63a19d5b

· Valid until 24/11/2026 · Source: AlienVault
178.128.53.239 indicates

stix 100/100 Revoked

CC=SG ASN=AS14061 digitalocean llc

· Valid until 22/12/2025 · Source: AlienVault
223.76.236.179 indicates

stix 100/100 Revoked

CC=CN ASN=AS9808 china mobile communications group co. ltd.

· Valid until 22/12/2025 · Source: AlienVault
f6665f41a2ea7c5eacbd908210ab332ba9a1f60c14fe855c52124fc81a4f13f9 indicates

stix 100/100

SHA256 of d61c9eba6d8267ed5836f670f58c9b12a737f89d

· Valid until 24/11/2026 · Source: AlienVault
143.198.8.180 indicates

stix 100/100 Revoked

CC=US ASN=AS14061 digitalocean llc

· Valid until 22/12/2025 · Source: AlienVault
288eed2f19b5087d074a291a55abafa206bdc7b9367785abff0ca6628c2dea38 indicates

stix 100/100

Win.Malware.Trojanx-10035542-0 SHA256 of c6783e6594f785f918f0d0d458854bc3cf02b9a4

· Valid until 24/11/2026 · Source: AlienVault
167.172.77.125 indicates

stix 100/100 Revoked

CC=US ASN=AS14061 digitalocean llc

· Valid until 22/12/2025 · Source: AlienVault
174.138.95.60 indicates

stix 100/100 Revoked

CC=US ASN=AS14061 digitalocean llc

· Valid until 22/12/2025 · Source: AlienVault

← Previous

Page / 7

37–48 of 75

Vulnerabilities (CVE) (4)

CVE-2021-27065 KEV targets

Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.

Published: 03/11/2021
Modified: 20/12/2025

CVE-2025-4428 KEV targets

7.2 High

Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability in the API component that allows an authenticated attacker to remotely execute …

Attack vector: Network
Published: 19/05/2025
Modified: 21/12/2025

CVE-2025-53770 KEV targets

9.8 Critical

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware …

Attack vector: Network
Published: 20/07/2025
Modified: 21/12/2025

Analyzed

CVE-2025-4427 KEV targets

5.3 Medium

Ivanti Endpoint Manager Mobile (EPMM) contains an authentication bypass vulnerability in the API component that allows an attacker to access protected resources …

Attack vector: Network
Published: 19/05/2025
Modified: 21/12/2025

Contact About Legal notice Privacy policy Terms of use