Weekly Threat Advisory: APT Storm — 25 Clusters Active, Polymorphic Loader Surge, ICS/OT Threat Surface (Jul 20-26, 2026)

APT storm week. 25 named APT clusters ran in parallel — the widest concurrent APT footprint observed in this catalogue year-to-date. GoldenEyeDog surged to 7,848 unique hashes in seven days — polymorphic-build-farm signal. Two DPRK-adjacent operations active (BlueNoroff impersonating collaboration-platform video URLs; Wagemole IT-worker infiltration). Three Russian-aligned clusters (Turla, APT28-linked router campaigns, LAUNDRY BEAR). Iran-Middle-East regional operations. The LARVA cluster group triple-active (LARVA-15, -17, -47). And a rare ICS/OT signal — PLC Exploitation across three concentrated subnet anchors targeting industrial control systems. If your CTI team was quiet this week, this briefing is your priority reading list.

Sectioned for the working analyst: cluster catalogue, deep-dives on the high-tempo names, ATT&CK technique mapping per adversary, subnet anchors, top 15 IOCs per indicator type, four production-ready Sigma rules, Predictive Intelligence weaponisation forecast, and a 60-minute operationalisation plan. Vendor-neutral. Operator-grade. Archive of prior advisories.

01 · This week in numbers

The catalogue produced 77,118 unique IOCs across 155 adversary clusters this cycle. Framework-infrastructure entries dominate the topline volume (as usual), but the narrow-indicator layer is the intelligence story: 3,374 unique domains + 16,316 unique hashes + 503 URLs. The hash volume alone (16,316) is the second-highest weekly count observed in this catalogue this year — driven by two clusters (GoldenEyeDog at 7,848 and SmartLoader at 7,115) running at industrial-scale polymorphic-build volume. Every APT category is elevated: 25 named APT clusters concurrent is the widest APT footprint of the year.

02 · Five headlines — what defined this cycle

Headline 01 · APT Storm — 25 named clusters concurrent

Twenty-five named APT clusters produced fresh indicators this cycle — the widest concurrent APT footprint in the year-to-date window. The APT-category IOC total: 8,291 records across 25 named actors. Cluster diversity spans DPRK-adjacent (BlueNoroff, Wagemole), Russian-aligned (Turla, APT28-linked router campaigns, LAUNDRY BEAR), Iran-Middle-East regional operations, the LARVA cluster group (LARVA-15, -17, -47), UAT/UAC-tracked clusters, and the JadeProx / GoldenEyeDog / TAG-195 named clusters. Concurrent activity at this scale is a load-bearing intelligence signal.

Headline 02 · GoldenEyeDog — 7,848 unique hashes in 7 days

The single-cluster hash footprint of the year. GoldenEyeDog generated 7,848 unique HASH indicators this cycle. Volume at that scale from a single named cluster suggests a polymorphic build pipeline actively producing many binary variants per target — a defensive-evasion strategy that defeats hash-based endpoint content as fast as it can be updated. The operational implication: the hash-blocklist layer is fragile against this volume. Behavioural loader-detection is the durable defence layer. SmartLoader (7,115 hashes) shows the same industrial-scale build signal from a different family.

Headline 03 · ICS/OT threat surface — PLC Exploitation, 3 subnet anchors

A rare and operationally significant signal. The PLC Exploitation cluster produced 26 IOCs across DOMAIN + HASH + IP with three concentrated subnet anchors (185.82.73.0/24 with 8 IPs, 175.110.121.0/24 with 4 IPs, 88.80.150.0/24 with 3 IPs — 15 IPs across 3 blocks). PLC = Programmable Logic Controller. The cluster targets industrial control systems, not enterprise IT. Utilities, manufacturing, and critical-infrastructure operators are the primary victim profile. ICS ATT&CK techniques observed: T0819 exploit of internet-accessible device, T0866 unauthorised command execution, T0836 modify parameter, T0885 commonly-used-port abuse. If your organisation operates any OT/ICS environment, this cluster warrants immediate attention.

Headline 04 · DPRK double-track — BlueNoroff + Wagemole

Two DPRK-adjacent operations active in parallel. BlueNoroff (83 IOCs) uses a distinctive domain-naming pattern impersonating collaboration-platform video URLs (02webus[.]zoom[.]02us[.]sbs, 05us[.]zoom[.]web05[.]sbs, etc.) with a subnet anchor at 45.61.163.0/24. Targets cryptocurrency-adjacent audiences. Separately, Wagemole (64 IOCs across all 4 primary IOC types) is the IT-worker infiltration operation — DPRK operatives applying to remote-work positions using fabricated identities to gain insider access. Wagemole is a HR-workflow threat, not an endpoint threat — detection requires identity-verification and hiring-workflow controls, not detection content.

Headline 05 · Novel delivery vector — SVG malicious scripts

The SVG Malicious Scripts cluster produced 25 IOCs across DOMAIN + HASH. Delivery pattern: attackers embed JavaScript payloads inside SVG image files. When the SVG is rendered in a browser (as an inline image, email attachment preview, or website asset), the embedded script executes. Bypasses many email attachment scanners that do not treat SVG as executable-adjacent. Combined with the ClearFake drive-by cluster (143 IOCs), this cycle shows a broader shift toward browser-rendering-time payload delivery. Defensive answer: content-inspection of SVG files at the mail-gateway and web-proxy layers.

03 · Indicator type, severity, and category mix

The narrow-indicator layer is the intelligence story this week: 16,316 unique HASH indicators is the highest hash-share observed year-to-date at 21 percent (driven by GoldenEyeDog + SmartLoader polymorphic builds). Domain volume at 3,374 is also elevated. Severity distribution shows 27 percent HIGH (20,804 records) — well above the year-to-date baseline. APT category at 8,291 IOCs (11 percent share) is the highest APT concentration of the year.

By indicator type

By severity

By category

04 · Top adversary clusters

36 clusters ranked by unique IOC footprint. Framework-infrastructure entries in grey to preserve visual clarity of the campaign-attributed clusters. GoldenEyeDog (7,848 hashes) and SmartLoader (7,115 hashes) are the polymorphic-build standouts. Lucid Phishing Kit (1,723 IOCs) is the broadest phishing infrastructure of the week.

05 · Cluster deep-dives — the names to act on

05.1 · GoldenEyeDog (APT) — 7,848 hashes, polymorphic build farm

The largest single-cluster hash footprint of the year. GoldenEyeDog generated 7,848 unique HASH indicators in seven days. Volume at that scale from a single named cluster indicates a polymorphic build pipeline actively producing many binary variants per target. The operational implication is significant: hash-blocklist-based defence is fragile against this volume — the operator can generate new variants faster than any hash feed can catalogue them.

Defensive actions: Push the catalogued hashes to endpoint quarantine as a baseline. But the durable defence layer is behavioural loader detection — process-tree anomalies, parent-child spawn patterns, network-flow shapes after execution. Deploy Sigma rule 01 below (universal loader-behaviour detector) as the primary defence against this cluster.

05.2 · SmartLoader — 7,115 hashes, industrial-scale build

Same polymorphic-build signal as GoldenEyeDog from a different family. 7,115 unique HASH indicators across the cycle. SmartLoader is a loader family designed to fetch and execute second-stage payloads. Standard commodity-loader tradecraft, industrial-scale build tempo.

Defensive actions: Same as GoldenEyeDog — hash-block as baseline, behavioural loader detection as durable defence.

05.3 · BlueNoroff (DPRK APT) — collaboration-platform impersonation

83 IOCs across DOMAIN + HASH + IP with a distinctive domain-naming pattern: 02webus[.]zoom[.]02us[.]sbs, 02webus[.]zoom[.]web02[.]sbs, 05us[.]zoom[.]web05[.]sbs, 06usweb[.]zoom[.]us06[.]sbs. The pattern impersonates collaboration-platform video-call URLs to lure victims into clicking fake “join meeting” links. Subnet anchor at 45.61.163.0/24. Targets cryptocurrency-adjacent audiences.

Defensive actions: Regex-block the naming pattern at the DNS resolver: ^\d{2}[a-z]+\.zoom\.[a-z0-9]+\.sbs$. Block the subnet anchor. Alert users in cryptocurrency-adjacent roles specifically.

05.4 · Wagemole (DPRK IT-worker infiltration)

64 IOCs across DOMAIN + HASH + IP + URL. The IT-worker infiltration operation — DPRK operatives applying to remote-work positions using fabricated identities to gain insider access. Wagemole is not primarily an endpoint threat; it is a HR-workflow threat. The operator wins by getting hired, not by exploiting a technical vulnerability.

Defensive actions: HR-workflow controls: video-verify interviews (not chat-only), verify education and employment claims independently, cross-check identity documents against second-source records, flag applicants using VPN or unusual geolocation during interviews. Deploy the catalogued IOCs as watchlist targets for outbound corporate-network traffic after any suspected Wagemole-profile hire.

05.5 · PLC Exploitation — ICS/OT threat with 3 subnet anchors

The rare-and-significant signal. 26 IOCs across DOMAIN + HASH + IP with three concentrated subnet anchors:

• 185.82.73.0/24 — 8 IPs concentrated
• 175.110.121.0/24 — 4 IPs concentrated
• 88.80.150.0/24 — 3 IPs concentrated

15 IPs across 3 blocks targeting industrial control systems. ICS ATT&CK techniques observed: T0819 exploit of internet-accessible device, T0866 unauthorised command execution, T0836 modify parameter, T0885 commonly-used-port abuse. Utilities, manufacturing, energy, and critical-infrastructure operators are the primary victim profile.

Defensive actions: If your organisation operates any OT/ICS environment: block all three /24 anchors at the perimeter now. Verify no internet-accessible PLCs in your environment (Shodan-search-adjacent inventory). Alert on any modbus / EtherNet-IP / DNP3 / Profinet traffic from unfamiliar external sources.

05.6 · Russian-aligned APT triad (Turla + APT28-linked + LAUNDRY BEAR)

Three concurrent Russian-aligned clusters active. Turla APT at IP anchor 103.31.250.253. APT28-linked router campaigns at 104.194.159.150 — targets network-edge router firmware for long-persistence intrusion. LAUNDRY BEAR at 104.248.134.194 with 3 IPs concentrated in 216.252.238.0/24. Combined footprint suggests coordinated regional operational tempo.

Defensive actions: Block all catalogued anchor IPs. For router-focused activity, prioritise firmware integrity scans on network-edge appliances. Hunt for anomalous configuration changes on internet-facing routers.

05.7 · LARVA cluster group (LARVA-15, -17, -47)

Three related tracked clusters totalling 143 IOCs. Standard APT credential-access + collection + exfil chain with distinctive password-store theft (T1555) and unsecured-credentials (T1552.001) focus. LARVA-47 has a subnet anchor at 45.138.26.0/24 with 4 IPs and a second anchor at 188.227.106.0/24 with 3 IPs.

05.8 · ClearFake drive-by + SVG script delivery — browser-render-time payload delivery

Two clusters point at the same shift — adversaries increasingly delivering payloads via browser-render-time execution rather than direct file execution. ClearFake (143 IOCs combined) compromises legitimate websites to inject fake browser-update prompts. SVG Malicious Scripts (25 IOCs) embed JavaScript inside SVG image files that execute on browser render. Both defeat email-attachment-scanner defensive controls because the payload is not delivered as an attachment.

Defensive actions: Content inspection of SVG files at mail-gateway and web-proxy layers (treat SVG as executable-adjacent). For ClearFake, detect the fake-update-prompt pattern: user visits a legitimate-looking site, then downloads a browser-update from a non-corporate domain.

05.9 · Iran-Middle-East regional campaign

33 IOCs across DOMAIN + HASH + OTHERS + URL. Nation-state-adjacent campaign targeting Middle East / North Africa regional interests. Broad TTP profile (T1566, T1190, T1078, T1059, T1105, T1071, T1021, T1003, T1041) indicates full-attack-lifecycle intrusion capability.

05.10 · WebDAV Campaign (275 IOCs) — alternative delivery transport

275 IOCs across HASH + IP + URL. Uses WebDAV as the payload-delivery transport rather than HTTP/HTTPS. WebDAV traffic frequently escapes conventional web-proxy content inspection because it is treated as file-sharing rather than web browsing.

Defensive actions: Alert on outbound WebDAV traffic from non-collaboration-tool hosts. If your environment has no legitimate WebDAV use case, block WebDAV outbound at the perimeter.

06 · ATT&CK mapping per named cluster

Per-cluster technique mapping with operational narrative. Detection content that fires on these techniques catches the cluster even after IOC rotation.

Detection-engineering takeaway. The universal APT chain (T1583.001 → T1566 → T1105 → T1071.001 → T1041) covers most of the 25 named clusters this week. Two well-designed detectors — one on adversary-acquired-domain first-seen contact, one on the ingress-tool-transfer-plus-exfil sequence within 5 minutes — cover most of the APT surface with minimal per-cluster tuning. For the loader-heavy layer (GoldenEyeDog + SmartLoader), behavioural loader-detection is the durable defence layer (Sigma 01 below).

07 · ATT&CK tactic-pressure roll-up

08 · Subnet anchors — the shared-infrastructure signal

The asymmetric block. PLC Exploitation operates across three distinct /24 anchors with 15 concentrated IPs — unusual for an ICS/OT-focused cluster. Blocking all three /24s at the perimeter costs the defender nothing (no legitimate business use) and forces the operator to rebuild across three different hosting tenants simultaneously to defeat the block. Brunhilda Project (9 IPs in a single /24) and BlueNoroff (3 IPs concentrated) are the other high-leverage blocks.

08b · Predictive intelligence — forecast weaponisation

Retrospective indicators tell you what has happened; predictive indicators tell you what is about to. This week’s catalogue-driven forecast layer surfaces three infrastructure blocks with a high forward-looking probability of adversary weaponisation. Derived from passive-DNS drift, registration-velocity clustering, hosting-tenant reputation drift, and pattern-match against previously-catalogued operator behaviours. Push into your perimeter watchlist now — not because they are compromised today, but because they are the highest-probability rotation candidates for adversary use over the next week.

How the forecast is derived

The forward-looking signal combines four inputs. Passive-DNS drift — how fast the block’s resolutions are changing relative to its historical baseline. Registration-velocity clustering — adjacent-block domain-registration rates compared against operator-fingerprint baselines. Hosting-tenant reputation drift — whether the anchor’s hosting tenant is trending toward adversary-adjacent reputation classes. And pattern-match against catalogued operator behaviours — whether the block’s early observable signature (open ports, TLS fingerprints, cert patterns) resembles any known operator anchor from the last 90 days. When two or more inputs converge, the block enters the forecast layer with a days-to-weaponisation estimate.

Operational actions

• Perimeter watchlist — add all three anchors to a watchlist lane (not automatic block) that alerts on any outbound contact.
• 3-day forecast (185.82.73.0/24) already-anchoring PLC Exploitation warrants provisional blocking of the /24 at the perimeter now if your environment has no legitimate business use in that range.
• CIDR-level block for the discrete 185.177.93.0/24 anchor (Brunhilda Project).
• Retrospective hunt — run a 90-day historical lookback for any past contact with these anchor ranges.

What predictive intelligence gives you. The classical intelligence catalogue tells you what has been observed already; the predictive layer tells you what is about to be observed. That shift buys the SOC a lead time it does not otherwise have — block an operator anchor before the operator’s rotation reaches you, not after your first compromise. The forecast is probabilistic, not deterministic — treat the days-to-weaponisation estimates as watchlist priorities, not automated-blocking triggers.

09 · Top 15 IOCs per indicator type

Operator-grade extractions. All indicators are defanged (re-fang on import: [.] → . and hxxp → http).

Top 15 · IP addresses (High severity)

Top 15 · Domains (High severity)

Top 15 · File hashes (High severity)

Top 15 · URLs (High severity)

10 · Sigma detection rules

Sigma 01 · Universal loader behaviour (GoldenEyeDog + SmartLoader durable defence)

title: Universal Loader Behaviour — Polymorphic Build Family Detector
id: 6a2c8e1f-5b74-4930-a681-3f9b5c2e8d10
status: experimental
description: Detects the universal loader behaviour signature — a downloaded
  binary spawns from a browser or document reader parent process, then triggers
  outbound network traffic to a non-corporate destination within 60 seconds.
  Catches polymorphic-build families (GoldenEyeDog, SmartLoader, and similar)
  where hash-blocking is defeated by build-farm volume.
references:
  - https://hackforlab.com/weekly-threat-advisory-july-20-26-2026/
author: HackForLab Threat Intelligence
date: 2026/07/27
tags:
  - attack.execution
  - attack.t1204
  - attack.command_and_control
  - attack.t1105
  - attack.t1071.001
logsource:
  product: correlation
detection:
  s1_downloaded_binary:
    EventID: 4688
    ParentImage|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\edge.exe'
      - '\OUTLOOK.EXE'
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\AcroRd32.exe'
    Image|contains:
      - '\Downloads\'
      - '\Temp\'
      - '\AppData\Local\Temp\'
  s2_outbound_web:
    EventID: 5156
    DestinationPort: [80, 443, 8080, 8443]
    DestinationIp|expand: '%non_corporate_destinations%'
  condition: s1_downloaded_binary and s2_outbound_web within 60s
falsepositives:
  - Legitimate software installers from allowlisted domains
level: high

Sigma 02 · BlueNoroff collaboration-platform impersonation

title: BlueNoroff Collaboration-Platform Impersonation Domain Pattern
id: 4e8b7c1d-3a95-4620-b791-6d8f2c1e5a90
status: experimental
description: Detects DNS queries matching the BlueNoroff APT domain-naming
  pattern impersonating collaboration-platform video-call URLs. Regex-tight
  enough to avoid false positives against legitimate platform domains.
references:
  - https://hackforlab.com/weekly-threat-advisory-july-20-26-2026/
author: HackForLab Threat Intelligence
date: 2026/07/27
tags:
  - attack.initial_access
  - attack.t1566
  - attack.resource_development
  - attack.t1583.001
logsource:
  category: dns_query
detection:
  selection:
    QueryName|re:
      - '^[0-9]{2}[a-z]+web?\.zoom\.[a-z0-9]+\.sbs$'
      - '^[0-9]{2}[a-z]+\.zoom\.web[0-9]{2}\.sbs$'
  condition: selection
falsepositives:
  - None — the .sbs TLD + this naming pattern has no legitimate collaboration-platform use
level: critical

Sigma 03 · PLC Exploitation subnet + OT-protocol egress

title: PLC Exploitation Subnet Anchor Contact (ICS/OT)
id: 8d1a4b6f-5c92-4670-a881-3f9c7d5b2a40
status: experimental
description: Detects any outbound connection to the PLC Exploitation cluster's
  three concentrated subnet anchors. 15 IPs across 3 /24 blocks — critical
  signal for OT/ICS environments. Also fires on OT-protocol traffic to any
  destination outside the internal OT segment.
references:
  - https://hackforlab.com/weekly-threat-advisory-july-20-26-2026/
author: HackForLab Threat Intelligence
date: 2026/07/27
tags:
  - attack.command_and_control
  - attack.t1071
  - ics.t0819
  - ics.t0866
logsource:
  category: network_connection
detection:
  ot_subnet_anchors:
    DestinationIp|cidr:
      - '185.82.73.0/24'
      - '175.110.121.0/24'
      - '88.80.150.0/24'
  ot_protocol_egress:
    DestinationPort:
      - 502    # Modbus TCP
      - 44818  # EtherNet/IP
      - 20000  # DNP3
      - 34962  # Profinet
      - 34963  # Profinet
      - 34964  # Profinet
    DestinationIp|expand: '%external_destinations%'
  condition: ot_subnet_anchors or ot_protocol_egress
falsepositives:
  - Legitimate OT vendor remote-support (allowlist by known-good IPs)
level: critical

Sigma 04 · SVG file with embedded script content

title: SVG File Delivery with Embedded Script Content
id: 5c9e7b2d-1a83-4550-b721-3f9b6d4f2a10
status: experimental
description: Detects delivery of SVG files (inbound mail attachment or web
  download) that contain embedded JavaScript. Catches the SVG Malicious Scripts
  cluster and any future SVG-based delivery.
references:
  - https://hackforlab.com/weekly-threat-advisory-july-20-26-2026/
author: HackForLab Threat Intelligence
date: 2026/07/27
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.execution
  - attack.t1204.002
  - attack.t1059.007
logsource:
  category: file_event
detection:
  svg_delivery:
    TargetFilename|endswith: '.svg'
    FileContent|contains:
      - '

 
11 · Hunt queries — SIEM-agnostic pseudo-syntax
Hunt 01 · Loader chain — browser/document parent + outbound web within 60s
// Pseudo-query
FROM process_creates AS pc
JOIN network_flows AS nf
  ON pc.host = nf.src_host
  AND nf.flow_time BETWEEN pc.create_time AND pc.create_time + 60s
WHERE pc.parent_process IN ('chrome.exe', 'firefox.exe', 'edge.exe',
                             'OUTLOOK.EXE', 'winword.exe', 'excel.exe',
                             'powerpnt.exe', 'AcroRd32.exe')
  AND pc.image_path MATCHES regex '\\(Downloads|Temp)\\'
  AND nf.dest_ip NOT IN (allowlisted_ranges)
  AND nf.dest_port IN (80, 443, 8080, 8443)
| PROJECT pc.host, pc.image_path, nf.dest_ip, nf.dest_domain
| SORT BY pc.create_time DESC
Hunt 02 · APT anchor first-seen (top clusters)
// Pseudo-query
FROM network_flows
WHERE dest_ip IN (
  '103.235.46.102',    -- UAT-8837
  '103.31.250.253',    -- Turla
  '104.194.159.150',   -- APT28-linked
  '104.248.134.194',   -- LAUNDRY BEAR
  '103.97.0.57'         -- Hermes AI Agent
)
  AND first_seen_pair(src_ip, dest_ip) WITHIN 90d
| PROJECT src_ip, dest_ip, first_seen
| SORT BY first_seen DESC
Hunt 03 · PLC Exploitation subnet + OT protocol traffic
// Pseudo-query
FROM network_flows
WHERE (dest_ip IN CIDR('185.82.73.0/24', '175.110.121.0/24', '88.80.150.0/24'))
   OR (dest_port IN (502, 44818, 20000, 34962, 34963, 34964)
       AND dest_ip NOT IN (internal_ot_segment))
| AGGREGATE BY src_ip, dest_ip, dest_port
| SORT BY flow_count DESC
Hunt 04 · BlueNoroff DNS pattern
// Pseudo-query
FROM dns_queries
WHERE query_name MATCHES regex '(?i)^[0-9]{2}[a-z]+web?\.zoom\.[a-z0-9]+\.sbs$'
   OR query_name MATCHES regex '(?i)^[0-9]{2}[a-z]+\.zoom\.web[0-9]{2}\.sbs$'
| PROJECT src_host, query_name, query_time
| SORT BY query_time DESC
12 · Operationalise in 60 minutes
Minute 00 – 15 · Block + sinkhole

Block all three PLC Exploitation subnet anchors: 185.82.73.0/24, 175.110.121.0/24, 88.80.150.0/24.
Block Brunhilda Project anchor 185.177.93.0/24 (9 concentrated IPs).
Block BlueNoroff anchor 45.61.163.0/24 + LAUNDRY BEAR 216.252.238.0/24.
Block 103.31.250.253 (Turla) + 104.194.159.150 (APT28-linked router).
Add outbound-deny for WebDAV traffic from non-collaboration-tool hosts.
Minute 15 – 30 · Detection content

Deploy Sigma 01 (universal loader behaviour) — catches GoldenEyeDog + SmartLoader without hash volatility.
Deploy Sigma 02 (BlueNoroff collaboration-platform DNS pattern).
Deploy Sigma 03 (PLC Exploitation subnet + OT-protocol egress) — critical for OT/ICS environments.
Deploy Sigma 04 (SVG with embedded script).
Minute 30 – 45 · Retrospective hunt

Run Hunt 01 (loader chain) baseline scan across last 30 days.
Run Hunt 02 (APT anchor first-seen) across last 90 days.
Run Hunt 03 (PLC Exploitation + OT-protocol egress) across last 60 days.
Run Hunt 04 (BlueNoroff DNS pattern) across last 30 days.
Minute 45 – 60 · Awareness + policy

Brief cryptocurrency-adjacent users on BlueNoroff collaboration-platform impersonation.
Brief HR on the Wagemole IT-worker infiltration pattern — video-verify interviews, cross-check identities.
For OT/ICS environments: emergency verification that no internet-accessible PLCs are exposed. Immediate Shodan-adjacent inventory recommended.
Update mail-gateway policy to inspect SVG file contents (treat as executable-adjacent).
// CONTINUE WITH HUNTINTEL
This briefing ships 15 indicators per type. The catalogue carries the full 77,118 unique IOCs from this week — adversary attribution, ATT&CK technique, confidence score, source provenance included.
Open HuntIntel →
13 · Frequently asked questions

25 named APTs in one week — is that unusual?
Yes. Twenty-five concurrent named APT clusters is the widest APT footprint in this catalogue year-to-date. The typical week sees 5-10 concurrent named clusters; this week's 25 is more than double baseline. What matters operationally: organisations in strategic-vertical environments (research, government-adjacent, critical infrastructure, cryptocurrency-adjacent) should prioritise indicator ingestion this week. The APT-storm signal is a leading indicator of near-term intrusion activity.


GoldenEyeDog produced 7,848 hashes in one week. How does hash-blocking survive that?
It doesn't. Hash-blocking is fragile against polymorphic-build volume at that scale — the operator can generate new variants faster than any hash feed can catalogue them. The durable defence is behavioural loader detection (Sigma 01 above). Detect the pattern browser/document parent → downloaded binary → outbound web within 60s, and you catch the family regardless of hash variance.


Why is PLC Exploitation flagged as critical when it's only 26 IOCs?
Because it targets industrial control systems, not enterprise IT. A single successful PLC compromise can shut down a power substation, contaminate a water treatment facility, or halt a manufacturing line. The impact-per-IOC is orders of magnitude higher than typical malware. For any organisation operating OT/ICS environments, PLC Exploitation belongs in the priority-block queue regardless of IOC count.


What is Wagemole and why is it different?
Wagemole is the DPRK IT-worker infiltration operation — DPRK operatives applying to legitimate remote-work positions using fabricated identities to gain insider access to target organisations. It is not primarily an endpoint threat; it is a HR-workflow threat. The operator wins by getting hired. Detection requires HR-workflow controls (video-verify interviews, independent identity verification, second-source employment/education checks) — not detection content.


Why is SVG script delivery worth its own detection rule?
Because most email-attachment scanners don't treat SVG as executable-adjacent. SVG files can contain embedded JavaScript that executes when the file is rendered in a browser — including via inline preview in mail clients. The delivery vector defeats attachment-scanning defensive controls that would catch a malicious .exe / .doc / .zip. Adding SVG content inspection at the mail gateway closes the gap.


What confidence threshold should the SOC use for automated blocking?
High confidence only for automatic blocklist promotion. Medium and above for watchlist enrichment. Include Low for retrospective hunting.


Where can I see this briefing's intelligence operationally?
The HuntIntel operator console exposes every IOC with adversary attribution, ATT&CK technique, severity, confidence, and source provenance pre-joined. Open at huntintel.hackforlab.com/login.html. For the underlying frameworks reference, see Indicators of Compromise and Threat Intelligence: A Practitioner Reference.

Related reading:

Previous week (Jul 13-19) ·

Two weeks back (Jul 6-12) ·

Practitioner Reference (IOC + TI) ·

Cloud Threat Hunting Library ·

15-Month Threat Hunter Roadmap ·

Threat Intelligence archive
 
 
SHARE
Tweet


Reddit
Share on Tumblr
Like this:
Like Loading…
Related