51.195.127[.]124IP address
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 16 days ago
What the reports say
1 report, newest first · the exact sentence from each-
Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer“…ft Edge process, being dropped in Temp folders, followed by miner network connections being established on port 8029 to an XMR pool (51.195.127[.]124:8029, xmr.kryptex.network).”
Indicators reported together
named in the same reports- 177.4.12[.]11in 1 report
- apistructsaction[.]javain 1 report
- updatereceivers[.]doin 1 report
- hxxp://imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com/javas/Office/win/Taskgmr.ps1in 1 report
- 38.60.252[.]110in 1 report
- 107.191.47[.]199in 1 report
- 185.220.236[.]49in 1 report
- 104.234.26[.]10in 1 report
- 123.202.208[.]37in 1 report
- hxxp://imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com/javas/Office/win/edge.exein 1 report
- hxxp://imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com/javas/Office/win/msedge.exein 1 report
- hxxp://imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com/javas/Office/win/config.jsonin 1 report
- hxxp://imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com/javas/Office/win/WinRing0x64.sysin 1 report
- 05f69ae6b2b89c1c…045d06139034in 1 report
- 4dcb0202fe8b2d4d…f4bce1dd6f3din 1 report
- 481728a7c9c4c02b…4818e3d25d21in 1 report
Copy these 16 indicators · defanged
Also named with it: CVE-2026-105133, CVE-2026-105134
Thanks — we review every report.