cyber_threat_intelligence/actors/HawkEye

HawkEye - Cyber Threat Intelligence

These indicators were reported, collected, and generated during the VulDB CTI analysis of the actor known as HawkEye. The activity monitoring correlates data from social media, forums, chat rooms, and darknet markets. It helps to determine associated actors, specific activities, expected intentions, emerging research, and ongoing attacks. Our unique predictive model uses big data to forecast activities and their characteristics.

Live data and more analysis capabilities are available at https://vuldb.com/?actor.hawkeye

IOC - Indicator of Compromise

These indicators of compromise (IOC) indicate associated network resources which are known to be part of research and attack activities of HawkEye.

ID	IP address	Hostname	Campaign	Confidence
1	1.1.1.1	one.one.one.one	-	High
2	3.24.51.219	awcp037.server-cpanel.com	-	High
3	6.43.51.17	-	-	High
4	13.107.21.200	-	-	High
5	18.211.9.206	ec2-18-211-9-206.compute-1.amazonaws.com	-	Medium
6	20.36.253.92	-	-	High
7	23.3.13.153	a23-3-13-153.deploy.static.akamaitechnologies.com	-	High
8	23.3.13.154	a23-3-13-154.deploy.static.akamaitechnologies.com	-	High
9	23.5.230.228	a23-5-230-228.deploy.static.akamaitechnologies.com	-	High
10	23.54.213.99	a23-54-213-99.deploy.static.akamaitechnologies.com	-	High
11	23.94.43.90	23-94-43-90-host.colocrossing.com	-	High
12	23.217.148.78	a23-217-148-78.deploy.static.akamaitechnologies.com	-	High
13	23.222.79.194	a23-222-79-194.deploy.static.akamaitechnologies.com	-	High
14	23.222.79.232	a23-222-79-232.deploy.static.akamaitechnologies.com	-	High
15	27.121.68.109	dcgsx-cp009.server-cpanel.com	-	High
16	31.170.163.242	mx1.main-hosting.com	-	High
17	31.209.137.12	smtp.vivaldi.net	-	High
18	34.226.71.106	ec2-34-226-71-106.compute-1.amazonaws.com	-	Medium
19	34.232.187.93	ec2-34-232-187-93.compute-1.amazonaws.com	-	Medium
20	45.64.97.178	-	-	High
21	65.55.44.109	-	-	High
22	72.29.90.201	zeus.imd.la	-	High
23	...	...	...	...

There are 87 more IOC items available. Please use our online service to access the data.

References

The following list contains external sources which discuss the actor and the associated activities:

• https://blog.talosintelligence.com/2019/08/threat-roundup-0809-0816.html
• https://blog.talosintelligence.com/2019/12/threat-roundup-1213-1220.html
• https://blog.talosintelligence.com/2020/04/threat-roundup-0403-0410.html
• https://blog.talosintelligence.com/2020/06/threat-roundup-0619-0626.html
• https://blog.talosintelligence.com/2020/07/threat-roundup-0717-0724.html
• https://blog.talosintelligence.com/2020/08/threat-roundup-0807-0814.html
• https://blog.talosintelligence.com/2020/08/tru-0731-0807.html
• https://blog.talosintelligence.com/2021/02/threat-roundup-0205-0212.html
• https://blog.talosintelligence.com/2021/04/threat-roundup-0416-0423.html
• https://blog.talosintelligence.com/2021/07/threat-roundup-0702-0709.html
• https://blog.talosintelligence.com/2022/08/threat-roundup-0729-0805.html
• https://blog.talosintelligence.com/2022/08/threat-roundup-0819-0826.html
• https://blog.talosintelligence.com/threat-roundup-0106-0113/
• https://blog.talosintelligence.com/threat-roundup-0113-0120/
• https://blog.talosintelligence.com/threat-roundup-0120-0127/
• https://blog.talosintelligence.com/threat-roundup-0331-0407-2/
• https://www.anomali.com/blog/covid-19-themed-hawkeye-phishing-campaign-targets-healthcare-sector-dissection-of-the-maldoc-and-the-two-way-approach#When:14:00:00Z
• https://www.fortinet.com/blog/threat-research/hawkeye-malware-analysis.html

Literature

The following articles explain our unique predictive cyber threat intelligence:

• VulDB Cyber Threat Intelligence Documentation
• Cyber Threat Intelligence - Early Anticipation of Attacks

License

(c) 1997-2023 by vuldb.com. All data on this page is shared under the license CC BY-NC-SA 4.0. Questions? Check the FAQ, read the documentation or contact us!