162.219.30[.]165IP address
Reported by 2 independent sources · first reported by Google Threat Intelligence · last reported
Last reported 28 days ago
What the reports say
2 reports, newest first · the exact sentence from each-
Attackers Bypass WAFs to Exploit Oracle PeopleSoft Flaw and Deploy Web Shells“…, signed trojanized installer ("Ple64.exe") that loads in memory SIDEEYE, a C++ backdoor that communicates with an external server ("162.219.30[.]165") over TCP to facilitate browser and desktop application credential theft, process and file management, interactive reverse shell an…”
-
ShinyHunters Renewed Mass Exploitation Campaign Targeting Oracle PeopleSoft“Stage 3 is the SIDEEYE C++ backdoor that communicates with its command-and-control (C2) server (162.219.30[.]165) over raw TCP using separate control (TCP/3333) and data (TCP/3334) ports.”
Indicators reported together
named in the same reports- fbijobs[.]govin 1 report
- java[.]ioin 1 report
- azurenetfiles[.]netin 1 report
- microsoft-entra[.]netin 1 report
- enroll.azuredevice[.]cloudin 1 report
- winmanage-me[.]networkin 1 report
- 104.219.234[.]138in 1 report
- 5.199.162[.]157in 1 report
- 48b4a0827da7bbfc…fb4b1c3fe494in 1 report
- 2bee941fb40519d0…e3360dfdb5d7in 1 report
- 419c571ee38b7e72…73b762f07c86in 1 report
- ba14419beb2ec0bb…c2a4d97f7e07in 1 report
- 3ba215692665513a…0930c5c417c3in 1 report
Copy these 13 indicators · defanged
Also named with it: CVE-2026-35273
Thanks — we review every report.