SophiaX

🔍

LIVE

· New victim: cipher.systems — m3rx· New victim: International Chemical Co. — Barracuda· New victim: M****n — payoutsking· New victim: Applied Composites — Storm· New victim: Magna Legal Services — Storm· New KEV: CVE-2026-65660 · Microsoft· New KEV: CVE-2026-87902 · WordPress· New KEV: CVE-2026-67279 · MikroTik· New KEV: CVE-2026-71362 · Adobe· New KEV: CVE-2026-5430 · WSO2· New victim: 4,078 new IOCs ingested in last 24h cipher.systems — m3rx· New victim: International Chemical Co. — Barracuda· New victim: M****n — payoutsking· New victim: Applied Composites — Storm· New victim: Magna Legal Services — Storm· New KEV: CVE-2026-65660 · Microsoft· New KEV: CVE-2026-87902 · WordPress· New KEV: CVE-2026-67279 · MikroTik· New KEV: CVE-2026-71362 · Adobe· New KEV: CVE-2026-5430 · WSO2· 4,078 new IOCs ingested in last 24h

◈

Indicators of Compromise

Aggregated IOC feed from 20+ open-source threat intelligence sources including ThreatFox, URLhaus, MalwareBazaar, and Feodo Tracker. Search, filter, and export IPs, domains, URLs, and hashes linked to active malware campaigns.

Unique IOCs

419,969

deduplicated across all sources

Multi-Source

16,670

confirmed by 2+ feeds

Enriched

3,092

VT / AbuseIPDB / GreyNoise

By Type

url

161k

sha256

65k

domain

60k

md5

54k

sha1

49k

◈ IOC Browser12 results

Deduplicated · cross-source confirmed

🔍

12 IOCs

Type	Value	Sources	Threat / Family	Confidence	Enrichment	Last Seen
md5	afb3fbf55c…9f3fd0	1×malwarebazaar	malware_sample CNBackdoor	80	not yet enrichedCheck on VirusTotal	2026-09-03 recent
sha1	d5a9108e72…ba9575	1×malwarebazaar	malware_sample CNBackdoor	80	not yet enrichedCheck on VirusTotal	2026-09-03 recent
sha256	d7a1cbe50f…7be35d	1×malwarebazaar	malware_sample CNBackdoor	80	not yet enrichedCheck on VirusTotal	2026-09-03 recent
md5	0dda1e6bf6…2255ec	1×malwarebazaar	malware_sample CNBackdoor	80	not yet enrichedCheck on VirusTotal	2026-09-03 recent
sha1	6ac1f1917f…50ee3d	1×malwarebazaar	malware_sample CNBackdoor	80	not yet enrichedCheck on VirusTotal	2026-09-03 recent
sha256	461ec124b1…780232	1×malwarebazaar	malware_sample CNBackdoor	80	not yet enrichedCheck on VirusTotal	2026-09-03 recent
sha256	1d5d0dfa7d…710a48	2×malwarebazaarthreatfox	malware_sample CNBackdoor	95	not yet enrichedCheck on VirusTotal	2026-08-02 aging
md5	18b77efc3d…2f8e22	2×malwarebazaarthreatfox	malware_sample CNBackdoor	95	not yet enrichedCheck on VirusTotal	2026-08-02 aging
sha1	2dd37623bf…50fb43	2×malwarebazaarthreatfox	malware_sample CNBackdoor	95	not yet enrichedCheck on VirusTotal	2026-08-02 aging
sha1	ecdc202271…4c6125	1×malwarebazaar	malware_sample CNBackdoor	80	not yet enrichedCheck on VirusTotal	2026-08-02 aging
sha256	dea2d24eee…19857a	1×malwarebazaar	malware_sample CNBackdoor	80	not yet enrichedCheck on VirusTotal	2026-08-02 aging
md5	ab1d68a300…b08b66	1×malwarebazaar	malware_sample CNBackdoor	80	not yet enrichedCheck on VirusTotal	2026-08-02 aging

Recent Victims9 today

cipher.systems

United States

m3rx

International Chemical Co.

Barracuda

M****n

United States

payoutsking

Applied Composites

United States

Storm

Magna Legal Services

United States

Storm

Ligue se Grupo

Portugal

thegentlemen

Charles Keith

Singapore

thegentlemen

ENKEI*******

thegentlemen

FTAPI Software

United States

thegentlemen

Crossett

United States

termite

N...

SilentRansomGroup

S...

SilentRansomGroup

GE Vernova Inc.

United States

metaencryptor

PKF Hadiwinata

ID

metaencryptor

Platinum Healthcare Staffing

United States

metaencryptor

Electrolux & Ontrac

emperador

Securitas Group

Sweden

everest

Morula IVF

South Africa

everest

Tobin & Company

United States

Wallstreet

Ar Valve Resources

United Kingdom

Wallstreet

New KEV Entries10 this week

CVE-2026-65660HIGH

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVE-2026-87902HIGH

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for bot

CVE-2026-67279MEDIUM

RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an

CVE-2026-71362CRITICAL

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive res

CVE-2026-5430CRITICAL

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which

CVE-2026-93616CRITICAL

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.

CVE-2026-85102CRITICAL

Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.

CVE-2026-94127CRITICAL

When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG

CVE-2026-93952CRITICAL

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may

CVE-2026-7273HIGH

A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and