d2f9ef2429312667f0512504b6a19ba4a9cc5514f1b2933923dd42f75a1c5934SHA-256 hash
Reported by 1 independent source · first reported by Google Threat Intelligence · last reported
Last reported 9 days ago
What the reports say
1 report, newest first · the exact sentence from each-
Investigating Ephemeral Supply Chain Tampering“During the 6-minute window on July 16, UNC7017 simultaneously modified Notifycfg.ini (SHA256: d2f9ef2429312667f0512504b6a19ba4a9cc5514f1b2933923dd42f75a1c5934), injecting over 35,000 lines of repetitive configuration sections named [dummy_XXXXXX].”
Indicators reported together
named in the same reports- checkip.amazonaws[.]comin 1 report
- 8.210.84[.]56in 1 report
- hxxps://www2.aomeisoftware[.]com/download/abpopup/down_html.iniin 1 report
- www2.aomeisoftware[.]comin 1 report
- hxxps://account.aomeitech[.]com/Notifycfg.iniin 1 report
- account.aomeitech[.]comin 1 report
- hxxps://www2.aomeisoftware[.]com/download/abpopup/upgrade-now.zipin 1 report
- hxxps://promotion.storage-data[.]com/download/abpopup/upgrade-now.zipin 1 report
- promotion.storage-data[.]comin 1 report
- ee89c99f3753231771170f5d9cbbae1ein 1 report
- 31323e7e738230fa6a8deef2b7894666in 1 report
- storage-data[.]comin 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.