Threat & Exposure

Threat Intelligence

Actors, indicators and ATT&CK coverage · open feeds first, commercial feeds where needed

Indicators

Indicator	Type	Linked to	Confidence	First seen	Source	Action
45.155.•••.•••/24	IPv4 range	Credential stuffing	High	2026-08-30	Internal + CrowdSec	Block
bb-goaml-update[.]com	Domain	Look-alike phishing	High	2026-10-26	Internal	Block
3f9a…c21e	SHA-256	Macro dropper · invoice_oct.xlsm	High	2026-10-27	Sandbox	Block
x7f3k9q2[.]duckdns[.]org	Domain	DNS tunnelling	Medium	2026-10-27	DNS analytics	Block
npm: finance-report-utils 2.1.4	Package	Lazarus-style fake package	Medium	2026-10-11	OSV + community	Block

Indicators are exchanged as STIX 2.1 with the national CIRT and partner FIUs through MISP or OpenCTI, under the traffic-light protocol.