216.73.217.22

Runningcrab

· Published 19/03/2026 14:53 · Modified 19/03/2026 14:53 · Source: AlienVault

Essential information

Confidence
100/100
Published
19/03/2026 14:53
Modified
19/03/2026 14:53
Updated at
19/03/2026 14:53
Revoked
No
Author / Source
AlienVault
Resource level
—
Primary motivation
—
Related entities
1 reports, 20 attack patterns (mitre), 3 malware, 2 sectors, 2 countries, 7 indicators

Description

No description.

Marking (TLP)

TLP:CLEAR

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Reports (1)

Attack patterns (MITRE) (20)

Malware (3)

  • PlugX - S0013 uses
    Family
    Published 05/06/2026 18:07 · Modified 05/06/2026 18:07
  • Korplug uses
    The MITRE Corporation Confidence 100

    [PlugX](https://attack.mitre.org/software/S0013) is a remote access tool (RAT) with modular plugins that has been used by multiple threat groups.(Citation: Lastline PlugX Analysis)(Citation: FireEye Clandestine Fox Part 2)(Citation: New DragonOK)(Citation: …

    First seen 01/01/1970 · Last seen 16/11/5138 Published 31/05/2017 23:32 · Modified 08/06/2026 10:23
  • Infostealer.Speagle uses
    Family
    Published 19/03/2026 11:00 · Modified 19/03/2026 11:00

Sectors (2)

  • Defense targets
  • Technology targets

Countries (2)

  • China targets
  • Hong Kong targets

Indicators (7)

  • 03298f85eaf8880222cf8a83b8ed75d90712c34a8a5299a60f47927ad044b43b indicates
  • http://222.222.254.165:8090/CDGServer3/CDGClientDiagnostics?flag=syn_user_policy indicates
  • d7f167cbf1676c14fd487219447e30fadf26885eb25ec4cafdeabe333bddf877 indicates
  • dcd3f06093bf34d81837d837c5a5935beb859ba6258e5a80c3a5f95638a13d4d indicates
  • 60.30.147.18 indicates
  • fad8d0307db5328c8b9f283a2cc6f7e4f4333001623fef5bd5c32a1c094bf890 indicates
  • http://60.30.147.18:8091/CDGServer3/CDGClientDiagnostics?flag=syn_user_policy indicates