Analysis Maps 54 Network Indicators Linked to Five 2026 Cyberattacks

Summary

An analysis of five 2026 cyberattacks compiled 54 network indicators and used traffic, DNS, WHOIS, and related data to identify connections, historical resolutions, and additional artifacts.

Key points

The investigation examined indicators associated with Cisco SD-WAN, Stryker, Ivanti EPMM, and two ShinyHunters-related attacks.
The 54 indicators comprised five subdomains, 14 domains, and 35 IP addresses.
Sample traffic showed four client IPs querying three domain indicators 12 times between June 16 and July 19, 2026.
The researchers found 161 potential victim IP addresses communicating with 20 IP indicators between January 22 and July 17, 2026.
WHOIS history and DNS lookups identified six email-connected domains and 13 additional IP addresses.
The article cautions that indicators labeled malicious may require further investigation and corroboration.

Article Details

Attack Vectors: Zero-day exploitation of CVE-2026-20245 in Cisco Catalyst SD-WAN Manager.
Critical vulnerabilities in Ivanti EPMM were exploited.
A wiper attack against Stryker.
ShinyHunters attacks involving Canvas and an Oracle PeopleSoft exploit.
Defensive Notes: The source recommends conducting supplementary investigations to corroborate entities identified as threats or malicious, as some may later be deemed harmless.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`azurenetfiles[.]net`	Domain IoC associated with ShinyHunters' broader attacks.
DOMAIN	`ceye[.]io`	Identified as a domain IoC associated with the Ivanti EPMM attacks.
DOMAIN	`ddns[.]1433[.]eu[.]org`	Listed as a subdomain IoC associated with the Ivanti EPMM attacks; the article calls it the most suspicious subdomain.
DOMAIN	`e598292a5fbd[.]ngrok-free[.]app`	Listed as a subdomain IoC associated with the Ivanti EPMM attacks; the registrant is masked and sibling hosts were tagged as malware.
DOMAIN	`handala-hack[.]to`	Domain IoC associated with the Stryker wiper attack.
DOMAIN	`main[.]interacth3[.]io`	Listed as a subdomain IoC associated with the Ivanti EPMM attacks; the article reports no threat-intelligence hits.
DOMAIN	`oast[.]fun`	Domain IoC associated with the Ivanti EPMM attacks; it continued to record hits.
DOMAIN	`oast[.]live`	Identified as a domain IoC connected to the Ivanti EPMM attacks.
DOMAIN	`oast[.]me`	Domain IoC associated with the Ivanti EPMM attacks; it continued to record hits.
DOMAIN	`oast[.]online`	Reported as bulk-registered with Ivanti EPMM-related domain IoCs.
DOMAIN	`oast[.]site`	Domain IoC associated with the Ivanti EPMM attacks; it continued to record hits.
DOMAIN	`shinyhunte[.]rs`	Domain IoC associated with the ShinyHunters Canvas breach.
DOMAIN	`zeetcckhtudizieudqyck5o4ez16y973h[.]oast[.]fun`	Listed as a subdomain IoC associated with the Ivanti EPMM attacks; the article notes malware-tagged sibling subdomains.
IPV4	`142[.]11[.]200[.]186`	IP IoC associated with ShinyHunters' broader attacks.
IPV4	`152[.]32[.]173[.]138`	IP IoC associated with the Ivanti EPMM attacks.
IPV4	`23[.]245[.]7[.]178`	IP IoC associated with the Cisco SD-WAN attacks.
IPV4	`82[.]25[.]35[.]25`	IP IoC associated with the Stryker wiper attack.
IPV4	`91[.]215[.]85[.]103`	IP IoC associated with the ShinyHunters Canvas breach.