Daily Threat Intelligence Report — 2026-05-14

Executive Summary

🔴 Indicators of Compromise

🟣 MITRE ATT&CK TTPs

🟢 Hunt Queries

DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemoteIP in ('162.243.103.246', '50.16.16.211', '34.204.119.63', '178.62.3.223', '27.133.154.218')
| where ActionType == 'ConnectionSuccess'
| project TimeGenerated, DeviceName, LocalIP, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessParentFileName
| order by TimeGenerated desc

DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName in~ ('winword.exe', 'excel.exe', 'powerpnt.exe', 'outlook.exe', 'onenote.exe')
| where FileName in~ ('cmd.exe', 'powershell.exe', 'wscript.exe', 'cscript.exe', 'mshta.exe', 'regsvr32.exe', 'rundll32.exe')
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath
| order by TimeGenerated desc

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationIP in ('162.243.103.246', '50.16.16.211', '34.204.119.63', '178.62.3.223', '27.133.154.218')
| project TimeGenerated, SourceIP, SourceHostName, DestinationIP, DestinationPort, RequestURL, Activity, DeviceVendor, DeviceProduct
| order by TimeGenerated desc

✅ Recommended Actions

→ IMMEDIATE: Block all five Feodotracker C2 IPs (162.243.103.246, 50.16.16.211, 34.204.119.63, 178.62.3.223, 27.133.154.218) at perimeter firewall, proxy, and DNS sinkholes

→ IMMEDIATE: Run the provided MDE KQL query across all endpoints — any device with a ConnectionSuccess hit to these IPs must be isolated and triaged as a potential active infection

→ IMMEDIATE: Notify SOC L2/L3 analysts of active QakBot and Emotet C2 beaconing — escalate any positive hits to incident response within 30 minutes

→ SHORT-TERM: Run retrospective 7-day and 30-day log searches against all five C2 IPs to identify any prior undetected beaconing activity indicating established footholds

→ SHORT-TERM: Disable macro execution in Microsoft Office via Group Policy for all users who do not have a documented business requirement; enforce Protected View for documents received from external sources

→ SHORT-TERM: Search email gateway logs for attachments that triggered macro warnings or sandbox detonations in the last 72 hours and correlate sending domains with known QakBot/Emotet delivery infrastructure

→ LONG-TERM: Integrate Feodotracker C2 blocklist into SIEM/SOAR automated threat intelligence ingestion pipeline for continuous blocking without manual intervention

→ LONG-TERM: Evaluate network segmentation controls to restrict workstation-to-internet direct connections; route all outbound HTTP/HTTPS through inspecting proxy

🔴 Indicators of Compromise

🟣 MITRE ATT&CK TTPs

🟢 Hunt Queries

DeviceFileEvents
| where TimeGenerated > ago(24h)
| where SHA256 in (
    'be27d319f75643466bcfdbbfbd522616cd38771102dcd7af6bfe7a1b088228c6',
    '4ef4745dd219d096a39548d22e3b35021a60e7336e8a468115468266b1b45560',
    '7cd1d037e07aae06ee395005504aaefa652d463ab3751609903f3a71aef8e7be',
    '382532451215dd8a3c5fa070ced106e02f3eceb33bb4ff20c1c3c1d800ed587a',
    'cbbe7ef922e2127c492e4a0fcf56e198e330c964512c92bdd34ece7e08a6d2ce',
    '1a59b44271e873fbbbe7b142c598723725f3838aeb31ad2389f31eef6a5315fa',
    '82b2d959f05dff769caf3609d40624c268940ea47181dcbc0ef1fe9e09f06dd2',
    '6bc133276ca529863571f49aeea200ea88720827afd2c99450278473cc467c6e'
)
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemoteIP in ('222.140.198.163', '123.4.236.124', '124.163.55.40', '110.36.92.72', '115.49.78.36', '119.114.195.42', '220.192.238.82')
| where ActionType == 'ConnectionSuccess'
| project TimeGenerated, DeviceName, LocalIP, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationIP in ('222.140.198.163', '123.4.236.124', '124.163.55.40', '110.36.92.72', '115.49.78.36', '119.114.195.42', '220.192.238.82')
    or RequestURL has_any ('/bin.sh', '222.140.198.163', '123.4.236.124', '124.163.55.40')
| project TimeGenerated, SourceIP, SourceHostName, DestinationIP, DestinationPort, RequestURL, Activity, DeviceVendor
| order by TimeGenerated desc

✅ Recommended Actions

→ IMMEDIATE: Block all URLhaus-listed Mirai distribution IPs (222.140.198.163, 123.4.236.124, 124.163.55.40, 110.36.92.72, 115.49.78.36, 119.114.195.42, 220.192.238.82) at perimeter firewall and DNS

→ IMMEDIATE: Submit all eight Mirai SHA256 hashes to EDR/AV platforms for immediate blocking and conduct a retroactive scan across all enrolled Linux and embedded systems

→ IMMEDIATE: Audit all internet-facing IoT devices, routers, NAS appliances, and IP cameras — change all default credentials and disable Telnet where not required

→ SHORT-TERM: Run the MDE and Sentinel KQL queries to identify any internal hosts that have communicated with Mirai distribution infrastructure or have matching file hashes

→ SHORT-TERM: Review firewall rules to ensure Telnet (port 23) and unnecessary SSH access from the internet is blocked at the perimeter for all non-managed network devices

→ SHORT-TERM: Implement outbound traffic volume alerting on all network devices — sudden traffic spikes may indicate DDoS participation by a Mirai-compromised device

→ LONG-TERM: Establish an asset inventory for all internet-exposed embedded Linux and IoT devices; enforce firmware update policies and monitor for new CVE disclosures affecting deployed device models

→ LONG-TERM: Integrate URLhaus malware-download feed into web proxy and DNS filtering for automated blocking of newly identified Mirai distribution infrastructure

🔴 Indicators of Compromise

🟣 MITRE ATT&CK TTPs

🟢 Hunt Queries

DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemoteUrl has_any (
    'insta-clone-application.vercel.app',
    'facebook-similer.vercel.app',
    'program-ads-agency.com',
    'siginjai99.com',
    'talentsync.co.uk',
    'sonhaberleri255.shop',
    'sahityasarokar.com',
    'amber-fossil-mosquito.garden',
    'phase-shift-bridge-driver.garden',
    'survey.refassured.com/BZXOR4xm',
    'ning1-ddere5bmduh3h7gd.z03.azurefd.net',
    'roblox.et'
)
| project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, AccountName
| order by TimeGenerated desc

IdentityLogonEvents
| where TimeGenerated > ago(24h)
| where ActionType == 'LogonSuccess'
| summarize IPList=make_set(IPAddress), LocationList=make_set(Location), LogonCount=count() by AccountDisplayName, bin(TimeGenerated, 30m)
| where array_length(IPList) > 1
| where array_length(LocationList) > 1
| order by LogonCount desc

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where RequestURL has_any (
    'insta-clone-application.vercel.app',
    'facebook-similer.vercel.app',
    'program-ads-agency.com',
    'siginjai99.com',
    'talentsync.co.uk',
    'sonhaberleri255.shop',
    'sahityasarokar.com',
    'amber-fossil-mosquito.garden',
    'phase-shift-bridge-driver.garden',
    'survey.refassured.com',
    'ning1-ddere5bmduh3h7gd.z03.azurefd.net',
    'roblox.et',
    'b35n.com',
    'thewabisabinook.com/wp-content/nf74nd'
)
| project TimeGenerated, SourceIP, SourceHostName, DestinationIP, RequestURL, Activity, DeviceVendor
| order by TimeGenerated desc

✅ Recommended Actions

→ IMMEDIATE: Push all 15 OpenPhish-confirmed phishing URLs and associated domains to web proxy, DNS filtering, and email gateway block lists

→ IMMEDIATE: Block program-ads-agency.com, siginjai99.com, sonhaberleri255.shop, roblox.et, and the two amber-fossil-mosquito.garden / phase-shift-bridge-driver.garden domains at DNS and proxy layer

→ IMMEDIATE: Alert the security awareness team to distribute urgent user notification about active Instagram, Facebook, Bank of America, and Roblox phishing campaigns matching today's OpenPhish intelligence

→ SHORT-TERM: Run the Sentinel KQL query across all proxy and DNS logs for the past 7 days to identify any users who may have already accessed these phishing pages before today's blocking

→ SHORT-TERM: For any user identified as having visited a phishing URL, immediately force password reset for the targeted platform account and review for signs of account compromise or MFA bypass

→ SHORT-TERM: Review conditional access policies to ensure that new device registrations and logins from new locations require step-up MFA — this directly mitigates FlowerStorm AiTM session-cookie theft as reported by AlienVault OTX

→ SHORT-TERM: Audit Azure Front Door and Vercel-hosted applications in your environment — ensure that .azurefd.net and *.vercel.app subdomains not belonging to your organization are blocked at proxy

→ LONG-TERM: Implement a PhaaS-aware detection strategy including AiTM-specific indicators such as token-theft detection in Entra ID (formerly Azure AD) sign-in logs, aligned with the FlowerStorm KrakVM VM-obfuscation capability reported by AlienVault OTX