Windows Server 2019

Reported Context (1)

LNK file forensics from Tor_20Browser.lnk and Session.lnk attribute the operator to a Windows Server 2019 machine with hostname windows-utah-8g, consistent with a rented VPS, operating as the built-in Administrator (SID CVE-2025-32975 KACE SMA Breach Revealed HIQ Data and 60+ Downstream Clients

CVE (3)

MITRE ATT&CK (21)

Vendors (2)

Products (6)

Tools (13)

Industries (7)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.