www.joeware[.]netDomain
Reported by 1 independent source · first reported by Group-IB · last reported
Last reported 2 years ago
What the reports say
1 report, newest first · the exact sentence from each-
Patch or Peril: A Veeam vulnerability incident“…er, AdFind, a command-line query tool that can be used for gathering information from Active Directory, was downloaded from “hxxp://www.joeware[.]net/freetools/tools/adfind/” and used by the threat actor to enumerate domain users.”
Indicators reported together
named in the same reports- 149.28.106[.]252in 1 report
- 149.28.99[.]61in 1 report
- 45.76.232[.]205in 1 report
- 77.238.245[.]11in 1 report
- hxxp://www.joeware[.]net/freetools/tools/adfind/%E2%80%9Din 1 report
- cb704d2e8df80fd3…dc262d80ddb8in 1 report
- 2c56e9beea9f0801…9b4fa0661362in 1 report
- 5e460a517f0579b8…58ac0dd3d4fain 1 report
- 107ec3a7ed7ad908…d4b999d4690cin 1 report
Copy these 9 indicators · defanged
Also named with it: CVE-2023-27532
Thanks — we review every report.