Threat Actors Rapidly Adopt Web3 IPFS Technology
Tags
cmtmf-attack-pattern: Masquerading
country: Japan
maec-delivery-vectors: Watering Hole
attack-pattern: Data Model Botnet - T1583.005 Botnet - T1584.005 Clipboard Data - T1414 Credentials - T1589.001 Dns - T1071.004 Dns - T1590.002 Domains - T1583.001 Domains - T1584.001 Exploits - T1587.004 Exploits - T1588.005 Impersonation - T1656 Javascript - T1059.007 Keylogging - T1056.001 Keylogging - T1417.001 Malware - T1587.001 Malware - T1588.001 Masquerading - T1655 Phishing - T1660 Phishing - T1566 Python - T1059.006 Server - T1583.004 Server - T1584.004 Software - T1592.002 Clipboard Data - T1115 Masquerading - T1036 Masquerading
Show in Graph
Common Information
Type Value
UUID 42d7dc8a-3673-4043-bf44-92395b393551
Fingerprint a5100999aa3a83c9
Analysis status DONE
Considered CTI value 2
Text language
Published April 19, 2023, 1 p.m.
Added to db April 19, 2023, 3:15 p.m.
Last updated Nov. 4, 2024, 1:09 p.m.
Headline Threat Actors Rapidly Adopt Web3 IPFS Technology
Title Threat Actors Rapidly Adopt Web3 IPFS Technology
Detected Hints/Tags/Attributes 97/4/76
Source URLs
Redirection Url
Details Redirection https://unit42.paloaltonetworks.com/ipfs-used-maliciously/?&web_view=true
Details Source https://unit42.paloaltonetworks.com/ipfs-used-maliciously/?web_view=true
Details Source https://unit42.paloaltonetworks.com/ipfs-used-maliciously/
URL Provider
Details Provider Source level domain
Details paloaltonetworks.com unit42.paloaltonetworks.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 99 ✔ Cyware News - Latest Cyber News https://cyware.com/allnews/feed 2024-08-30 22:08
Details 120 ✔ Unit 42 https://feeds.feedburner.com/Unit42 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details Domain 76 
ipfs.io
Details Domain 3 
app.headlessforms.cloud
Details Domain 1 
fairpartner.ru
Details Domain 1 
bafybeiafb63z73aoz3d4jdpve2rhlwo6ujlzjyri26z63flqnara2dqwoa.ipfs.dweb.link
Details Domain 1 
bafybeicokadgkcohrqslwdnmtu5mcc2zmo2hveiw2bh5j5z35onsxe3cy4.ipfs.dweb.link
Details Domain 1 
bafybeibgc3snqi6qesnhskujhjcbduu7lfhju7eppumuqhymapuwvln6tq.ipfs.nftstorage.link
Details Domain 1 
bafybeihtuhj7ezvjbtig75qpv43t7eh6dmcnarlm454fx5yjb4uzqbidpy.ipfs.infura-ipfs.io
Details Domain 2 
ipfs.infura.io
Details Domain 3 
bafybeidravcab5p3acvthxtwosm4rfpl4yypwwm52s7sazgxaezfzn5xn4.ipfs.infura-ipfs.io
Details Domain 1 
bafybeibmryvvmv6vzdsewqw63j46k72pm4lqkb37hnc757qa3jyqktscxy.ipfs.infura-ipfs.io
Details Domain 1 
bafybeiehf33obq42jx73m3nfilstzgk52wuvwmoechf4wmbt652p36jsia.ipfs.nftstorage.link
Details Domain 1 
bafybeidqh7dk3sse4u5d66web5v446nnygtw5jeav5vunueyonjx5wp6gm.ipfs.nftstorage.link
Details Domain 93 
bazaar.abuse.ch
Details File 1 
nillis.html
Details File 4 
new.html
Details File 1 
file-05-2022.exe
Details File 1 
inv-scl0093-05-22pdf.exe
Details File 1 
sign-reurn-pdf.exe
Details File 47 
order.exe
Details File 2 
phpupdate.exe
Details File 2 
ipfs.inf
Details sha256 1 
460a3720734df53891c36340dc037122d73103517fe57b7c36480dfae3c0f4d7
Details sha256 1 
2a060e0db155844605077e78270b45b8627c2aedef503b26fc6ecaf2f6742023
Details sha256 1 
edfc3c3090eba1aba9c9960d68a1464bcf668773a1eec38ec8c54c357dca0c61
Details sha256 1 
3b9ef32ea71c375cd63e599a54ca3f5b58ac8b6e589c3036a3a0d4886c730ddd
Details sha256 1 
3072a7ec1f71a9adc7a714092172e4b763a9f7128ead2ae67e72663863b1143b
Details sha256 1 
b6f8699b55c9e9ca2d84c18c689eff12be9b7bd849a527a44d39e2aaa4dbf3a0
Details sha256 1 
c7ceafc46a828d2ccca49936ddc8d5da666e885455ecd6ad6bd77aa23c284fe6
Details sha256 1 
a12635fd762876c38da85b88adf42141beb117cc12464c3e0d122c9395bd2a4b
Details sha256 1 
1a41a5bf751fd2deb7cf46b231e45843adc5f036149979de847c053177be2eb8
Details sha256 1 
d1ea28dee35382c510a49e4304ed7cead25bcee5cc869c73c9c53f333139e060
Details sha256 1 
a372e07a691f8759e482615fd7624bfca2a2bc2cd8652a47ff9951ff035759a5
Details sha256 1 
894b5e81fe56418b8df30639fd8b8c484c934aba8a121397b592039e07f766ee
Details sha256 1 
b8ee3897aff6c6660557a4c73b243870020705df6c87287040bfcd68b7c8b100
Details sha256 1 
765a4d57b2db92c2fd904b11a3e2dd26cdaa38843cc1760ae84e3334822bf4c4
Details sha256 1 
cdddd240d432b084b2c5cbe6b4a89b39a33d97840630210772b7758ec87dcacd
Details sha256 3 
65a1b3fb9430c7342d13f79b460b2cc7d9f9ddced2aeecd37f2862a67083e68c
Details sha256 3 
c9deeda7cd7adb4ff584d13ea64cdb50c9e8b5c616f1dff476f372e86c9b9be6
Details sha256 1 
554f955a405be9393eb2e9af182029029d562d79d23a6a8663704b1c00abfb56
Details sha256 1 
583d96d55608ab7079b7867c34c195766699a711ef3aa9df826ac3c5bc5c3232
Details sha256 1 
e1512098be4bd1a8b67839b077a58451941a87407257beb05752155ef5e04d40
Details sha256 1 
ba81c3a82a01fcd2f4c24904e4dc0b7ca26f472e50db9056af6e2217f925e9f5
Details sha256 1 
cfa0a616bb5e61e215e915a3d7942094db58b8c3f8a613d9410a807df4837d5a
Details IPv4 1 
51.254.127.82
Details Url 1 
https://bafybeicw4jjag57bk3czji7wjznkkpbocg27qk3fjvqh5krbrfiqbksr2a.ipfs.w3s.link/nills.html
Details Url 1 
http://bafybeifm5vcoj35hhuxf7ha3gg6asrrlrwu3bvcysgmrvygnm3qjmugwxq.ipfs.w3s.link/new.html?email=
Details Url 1 
https://ipfs.io/ipfs/qmxtvwamvhvxzzuezcmn2xdsprkn8us17ycuztigx1rynv?filename=file-05-2022.exe
Details Url 1 
https://ipfs.io/ipfs/qmqbpupxy3nzjk2yvspsujvhutajafrqpnjc58racujfrh?filename=inv-scl0093-05-22pdf.exe
Details Url 1 
https://ipfs.io/ipfs/qmy4kdbuk8vym8zzn1rvgfa3c4ybma4evmbfywwyieazxw?filename=sign-reurn-pdf.exe
Details Url 1 
https://ipfs.io/ipfs/qmczj1mxq2sh8dexbtjffgsrapm5bshglsh1mqry4vxc4c?filename=ref
Details Url 1 
http://bafybeiafb63z73aoz3d4jdpve2rhlwo6ujlzjyri26z63flqnara2dqwoa.ipfs.dweb.link/order.exe
Details Url 1 
https://bafybeibgc3snqi6qesnhskujhjcbduu7lfhju7eppumuqhymapuwvln6tq.ipfs.nftstorage.link
Details Url 1 
https://cloudflareipfs.com/ipns/12d3koowddu1ttg9jrzfisv8hbxe2zi2qpqs1r2vb88vee1ws5mc/phpupdate.exe
Details Url 1 
https://bafybeihtuhj7ezvjbtig75qpv43t7eh6dmcnarlm454fx5yjb4uzqbidpy.ipfs.infura-ipfs.io
Details Url 1 
https://ipfs.infura.io/ipfs/qmejgueysvxlmaaymxe3exmjfnoaqmdvfn4ojto1yltghk
Details Url 1 
https://bazaar.abuse.ch/sample/460a3720734df53891c36340dc037122d73103517fe57b7c36480dfae3c0f4d7
Details Url 1 
https://bazaar.abuse.ch/sample/2a060e0db155844605077e78270b45b8627c2aedef503b26fc6ecaf2f6742023
Details Url 1 
https://bazaar.abuse.ch/sample/edfc3c3090eba1aba9c9960d68a1464bcf668773a1eec38ec8c54c357dca0c61
Details Url 1 
https://bazaar.abuse.ch/sample/3b9ef32ea71c375cd63e599a54ca3f5b58ac8b6e589c3036a3a0d4886c730ddd
Details Url 1 
https://bazaar.abuse.ch/sample/3072a7ec1f71a9adc7a714092172e4b763a9f7128ead2ae67e72663863b1143b
Details Url 1 
https://bazaar.abuse.ch/sample/b6f8699b55c9e9ca2d84c18c689eff12be9b7bd849a527a44d39e2aaa4dbf3a0
Details Url 1 
https://bazaar.abuse.ch/sample/c7ceafc46a828d2ccca49936ddc8d5da666e885455ecd6ad6bd77aa23c284fe6
Details Url 1 
https://bazaar.abuse.ch/sample/a12635fd762876c38da85b88adf42141beb117cc12464c3e0d122c9395bd2a4b
Details Url 1 
https://bazaar.abuse.ch/sample/1a41a5bf751fd2deb7cf46b231e45843adc5f036149979de847c053177be2eb8
Details Url 1 
https://bazaar.abuse.ch/sample/d1ea28dee35382c510a49e4304ed7cead25bcee5cc869c73c9c53f333139e060
Details Url 1 
https://bazaar.abuse.ch/sample/a372e07a691f8759e482615fd7624bfca2a2bc2cd8652a47ff9951ff035759a5
Details Url 1 
https://bazaar.abuse.ch/sample/894b5e81fe56418b8df30639fd8b8c484c934aba8a121397b592039e07f766ee
Details Url 1 
https://bazaar.abuse.ch/sample/b8ee3897aff6c6660557a4c73b243870020705df6c87287040bfcd68b7c8b100
Details Url 1 
https://bazaar.abuse.ch/sample/765a4d57b2db92c2fd904b11a3e2dd26cdaa38843cc1760ae84e3334822bf4c4
Details Url 1 
https://bazaar.abuse.ch/sample/cdddd240d432b084b2c5cbe6b4a89b39a33d97840630210772b7758ec87dcacd
Details Url 1 
https://bazaar.abuse.ch/sample/65a1b3fb9430c7342d13f79b460b2cc7d9f9ddced2aeecd37f2862a67083e68c
Details Url 1 
https://bazaar.abuse.ch/sample/c9deeda7cd7adb4ff584d13ea64cdb50c9e8b5c616f1dff476f372e86c9b9be6
Details Url 1 
https://bazaar.abuse.ch/sample/554f955a405be9393eb2e9af182029029d562d79d23a6a8663704b1c00abfb56
Details Url 1 
https://bazaar.abuse.ch/sample/583d96d55608ab7079b7867c34c195766699a711ef3aa9df826ac3c5bc5c3232
Details Url 1 
https://bazaar.abuse.ch/sample/e1512098be4bd1a8b67839b077a58451941a87407257beb05752155ef5e04d40
Details Url 1 
https://bazaar.abuse.ch/sample/ba81c3a82a01fcd2f4c24904e4dc0b7ca26f472e50db9056af6e2217f925e9f5