azurenetfiles[.]netDomain
Reported by 2 independent sources · first reported by Google Threat Intelligence · last reported
Last reported 29 days ago
What the reports say
3 reports, newest first · the exact sentence from each-
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft“…, and meshagent.db) under the PeopleSoft service account, routing outbound connections to Microsoft-masquerading domains including azurenetfiles[.]net, microsoft-entra.net, and enroll.azuredevice.cloud.”
-
Gotta Breach 'Em All! The Journey Of ShinyHunters“| where url.domain == "azurenetfiles[.]net"”
-
ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit“Static analysis indicates these agents were hardcoded to establish communication with the command and control (C2) server wss://azurenetfiles[.]net:443/agent.ashx.”
Indicators reported together
named in the same reports- 142.11.200[.]186in 2 reports
- 162.219.30[.]165in 1 report
- security[.]orgin 1 report
- java[.]ioin 1 report
- microsoft-entra[.]netin 1 report
- enroll.azuredevice[.]cloudin 1 report
- winmanage-me[.]networkin 1 report
- 104.219.234[.]138in 1 report
- 5.199.162[.]157in 1 report
- 48b4a0827da7bbfc…fb4b1c3fe494in 1 report
- 2bee941fb40519d0…e3360dfdb5d7in 1 report
- 419c571ee38b7e72…73b762f07c86in 1 report
- ba14419beb2ec0bb…c2a4d97f7e07in 1 report
- 3ba215692665513a…0930c5c417c3in 1 report
- 142.11.200[.]187in 1 report
- 142.11.200[.]188in 1 report
- 142.11.200[.]189in 1 report
- 142.11.200[.]190in 1 report
- 176.120.22[.]24in 1 report
Copy these 19 indicators · defanged
Also named with it: CVE-2026-35273
Thanks — we review every report.