hciaccounts[.]inDomain
Reported by 1 independent source · first reported by Zscaler ThreatLabz · last reported
Last reported 8 months ago
What the reports say
1 report, newest first · the exact sentence from each-
APT Attacks Target Indian Government Using SHEETCREEP, FIREPOWER, and MAILCREEP | Part 2“…ial payload by uploading a ZIP archive (Documents.zip) containing the SHEETCREEP backdoor to a threat actor-controlled site (hxxps://hciaccounts[.]in/Documents.zip).T1566.002Initial Access, Phishing: Spearphishing LinkThe threat actor used phishing PDFs which contained a ‘Download…”
Indicators reported together
named in the same reports- hxxps://hcidoc[.]in/in 1 report
- hcidoc[.]inin 1 report
- testfirebase-b24a8.appspot[.]comin 1 report
- domaincoadelhi[.]inin 1 report
- domainshciaccounts[.]inin 1 report
- hxxps://hciaccounts[.]in/Documents.zipin 1 report
Copy these 6 indicators · defanged
Thanks — we review every report.