prodaft/malware-iocThis repository contains indicators of compromise (IOCs) of our various investigations.
The Lucid Phishing-as-a-Service (PhAAS) platform, developed by the XinXin group, facilitates large-scale phishing campaigns targeting global organizations, including postal and courier services. Utilizing advanced technologies like RCS and iMessage, the group employs automated tools and evasion techniques to bypass detection. Key actors, such as LARVA-242, manage operations through a structured hierarchy, while monetizing stolen data. Lucid’s technical sophistication and global reach highlight the growing threat of PhAAS platforms.
The full report is available here.
101.32.109.9
107.189.12.219
124.156.195.69
154.205.139.195
154.205.154.32
154.205.155.66
154.205.157.216
154.223.17.8
156.244.14.101
156.244.44.205
156.244.45.252
170.106.111.141
170.106.136.174
170.106.158.82
170.106.64.155
170.106.72.48
170.106.73.7
185.92.181.72
196.251.70.76
196.251.72.218
196.251.72.242
196.251.83.148
196.251.85.112
196.251.87.205
204.152.213.102
205.185.123.3
23.94.26.195
38.246.70.53
38.49.43.220
38.54.56.235
38.54.6.122
38.54.6.95
38.54.85.163
38.60.136.192
38.60.203.221
43.128.231.197
43.128.253.137
43.130.10.37
43.130.116.4
43.130.66.138
43.130.74.130
43.130.78.87
43.131.28.15
43.131.31.120
43.131.4.186
43.131.41.51
43.133.172.141
43.133.184.156
43.133.195.86
43.133.198.251
43.133.216.118
43.133.221.218
43.133.3.250
43.133.9.223
43.134.239.192
43.134.49.210
43.135.147.107
43.135.153.232
43.135.156.73
43.135.157.56
43.135.161.151
43.135.182.201
43.135.183.187
43.135.184.42
43.135.186.70
43.153.10.119
43.153.131.221
43.153.131.41
43.153.171.79
43.153.25.239
43.153.35.140
43.153.53.29
43.153.84.240
43.153.92.102
43.153.98.27
43.156.234.116
43.156.52.188
43.156.90.128
43.157.200.29
43.157.201.135
43.157.201.28
43.157.211.181
43.157.23.22
43.157.4.230
43.157.66.89
43.157.84.163
43.159.147.250
43.159.51.190
43.163.201.54
43.163.224.147
43.163.228.112
43.163.245.130
43.163.82.111
43.163.91.106
43.163.94.76
43.163.98.218
43.166.130.248
43.166.133.33
43.166.143.32
43.166.241.100
43.166.242.126
43.166.252.253
43.167.185.2
43.167.206.130
43.167.215.233
43.167.224.78
43.167.227.68
43.167.227.85
43.167.236.146
43.167.236.64
43.167.242.160
45.204.194.204
46.8.227.88
47.252.79.102
47.252.81.247
47.253.121.226
47.253.203.31
47.83.143.74
47.89.176.237
47.89.247.154
47.90.206.120
49.51.188.187
49.51.251.2
66.42.87.2
74.48.78.135
8.208.13.88
8.219.212.226
8.219.4.237
82.180.139.210