Enterprise IOC & Threat Actor Synchronization Hub

Bi-directional STIX 2.1 / TAXII 2.1 server propagating hashes, C2 endpoints, YARA rules, and Sigma patterns.

Synchronized IOC Registry

14,890

SHA256, IPs, Domains, YARA

STIX 2.1 TAXII Feeds

12 Inbound / 8 Out

100% Schema Validated

Active Threat Actors

24 Monitored

LockBit, APT29, ALPHV, Lazarus

EDR/SIEM Enforcement

100% Synced

CrowdStrike & Sentinel live

IOC TYPE:

Active Synchronized Indicators (5)STIX 2.1 Automated Propagation

SHA256LockBit 3.0 (ALPHV Affiliates)

● ENFORCED (99%)

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

High-entropy polymorphic encryptor targeting ESXi and Windows hypervisors with ChaCha20/RSA.

Origin: cerberus-rePropagated to: 5 fleets

IP_C2BlackCat / ALPHV

● ENFORCED (95%)

185.220.101.44

Hardcoded fast-flux C2 endpoint routing exfiltrated customer PII to bulletproof VPS.

Origin: cerberus-rePropagated to: 4 fleets

DOMAINAPT29 (Cozy Bear)

● ENFORCED (92%)

update-telemetry-resolver-darknet.su

Domain-fronted DNS/HTTPS staging domain used for DLL side-loading payloads.

Origin: cerberus-rePropagated to: 3 fleets

YARA_RULELockBit Affiliates

● ENFORCED (98%)

rule Expedite_LockBit3_ChaCha20_Routine { strings: $s1 = { 8B 44 24 10 33 C0 85 C0 7E 1E } condition: $s1 }

Extracted compiled cryptographic loop detecting in-memory key scheduling routines.

Origin: cerberus-rePropagated to: 3 fleets

SIGMA_RULEOpportunistic Cloud Attackers

● SYNCING (90%)

title: Web_App_SSRF_IMDSv2_Attempt
status: production
logsource:
  category: webserver
detection:
  selection:
    request.uri|contains: '169.254.169.254'
  condition: selection

Sigma rule auto-generated from live AXIOM DAST blind SSRF exploitation test.

Origin: axiom-dastPropagated to: 2 fleets

IOC Intel Specification (IOC-001)

INDICATOR PATTERN

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Threat Actor

LockBit 3.0 (ALPHV Affiliates)

Malware Family

LockBit Black Builder v3

MITRE ATT&CK TACTICS

T1486 Data Encrypted for ImpactT1489 Service StopT1490 Inhibit System Recovery

PROPAGATION STATUS ACROSS FLEET

CERBERUS-RE✓ ACTIVE & ENFORCED

AEGIS-RECOVERY✓ ACTIVE & ENFORCED

AXIOM-DAST✓ ACTIVE & ENFORCED

EDR-CROWDSTRIKE✓ ACTIVE & ENFORCED

SIEM-SENTINEL✓ ACTIVE & ENFORCED