83.142.209[.]194IP address
Reported by 1 independent source · first reported by Datadog Security Labs · last reported
Last reported 5 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
Backdoored Cemu release linked to TanStack and Mistral supply chain campaign“Exfiltration follows a tiered fallback process: results are POSTed to 83.142.209[.]194/v1/weights first, then a dead-drop resolver that polls public GitHub commits for RSA-signed C2 addresses matching the pattern FIRESCALE <base64url>.<base64sig>, and finally — if both network path…”
-
Shai-Hulud Goes Open Source“83.142.209[.]194”
Indicators reported together
named in the same reports- m[.]groupin 1 report
- 3f3f42d072bd3686…ec0ea572eea7in 1 report
- 29ac906c8bd801df…278c24e4f1a7in 1 report
- 619c56acf572df75…2da3a44f10b4in 1 report
- 0f35abda19fb6943…ab31256a9dd6in 1 report
- a6fb0a48eb437a8a…ae0433bf8f98in 1 report
- c234e6e5f5366cf1…65342eb4c4e8in 1 report
- 7718b9ded0efa2d6…45f6ee680acbin 1 report
- 1bf72f05191d8490…a14add7c886din 1 report
- f140e76236b96adf…fa3e4b8327ccin 1 report
- d07a29c4458d00e4…43c628e0b41ain 1 report
- hxxps://safedep[.]io/mass-npm-supply-chain-attack-tanstack-mistral/in 1 report
- safedep[.]ioin 1 report
- git-tanstack[.]comin 1 report
- hxxps://api.github[.]com/userin 1 report
- f2157f1cecbf3995…266ad2b3d625in 1 report
- 77d92efe7af3547f…ac866911694din 1 report
- f7a1e56b6dbd4277…615ddfee52e4in 1 report
- c55a10759f6f415a…abf6d88ae492in 1 report
- ab4fcadaec49c032…f2fa8601266cin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.