Skip to content

Public IOC feed / Supply chain

Supply chain

Indicators from malicious packages, trojanised dependencies and compromised updates.

87 high-confidence indicators from the last 30 days of security reporting. Free, refreshed hourly, no login, CC-BY.

Files

With an API key: /api/public/v1/iocs/feed?category=supply_chain. API reference

Newest indicators

Showing 87 of 87.

  • 03FD832B81DD54D2BF5F610A8FF27856 md5, 4 Nov

    Listed as malware hash. Source

  • 19E760EE849EB7C1F100F2B7010A763D md5, 4 Nov

    Listed as malware hash. Source

  • 1F3031167F94B166CC7B69376A01C124 md5, 4 Nov

    Listed as malware hash. Source

  • 2DD8681DCD218C88D1C78DFE939EC92B md5, 4 Nov

    Listed as malware hash. Source

  • 3B79D95F7F7B58C401A3BC79F94EBB52 md5, 4 Nov

    Listed as malware hash. Source

  • B1D344C9A1525373BE6A3980FA85A603 md5, 4 Nov

    Listed as malware hash. Source

  • E0A92209DD62DAE8460D934DC6B7DDD7 md5, 4 Nov

    Listed as malware hash. Source

  • 11A6DF1E15663AE89F59A9E598AE8987F42A632B sha1, 4 Nov

    Listed as malware hash. Source

  • 173DD4190740B96F6F733C801B6428ED4B52B607 sha1, 4 Nov

    Listed as malware hash. Source

  • 2CC0425A90A39AC4EEDADD59CAAAFAD5B50F8420 sha1, 4 Nov

    Listed as malware hash. Source

  • 3449A349B6C8045B16DF4F88D58C65C2BDF891BB sha1, 4 Nov

    Listed as malware hash. Source

  • 7AB7FFE4C233A4F2440F0FDEB2E117C788792281 sha1, 4 Nov

    Listed as malware hash. Source

  • A195810C41F401C4B48CB557CF8CE60C2D807025 sha1, 4 Nov

    Listed as malware hash. Source

  • B194A997C9A653134BDB1F2D0C3137DCDACB54D5 sha1, 4 Nov

    Listed as malware hash. Source

  • B370B674CE877B9C0A7708C7834AEB7EDA983564 sha1, 4 Nov

    Listed as malware hash. Source

  • C41B4E11E6A9E3B53DA1F92B213DE9F65A825C92 sha1, 4 Nov

    Listed as malware hash. Source

  • E90D2730F3354FF1ADF334B03C95EAC3207D47B9 sha1, 4 Nov

    Listed as malware hash. Source

  • 2B6CDAFDFE427A3DE1A94A8A2CA1F09FC4C8F90E4F59089FD9B35B73185ED01C sha256, 4 Nov

    Listed as malware hash. Source

  • 3BD3B300F3278520819A06D0CB1F0EADBF946DBBC11352538246FF075EB427F1 sha256, 4 Nov

    Listed as malware hash. Source

  • 5CBB64375636E83B5F17D6083633CECC02E2A5F4168CD7CCA5CDEE36CCCA9B38 sha256, 4 Nov

    Listed as malware hash. Source

  • 6634339B813E6105B5138DE6AB67B016B8DFBF49233C29DE9BAB3207E8B50D24 sha256, 4 Nov

    Listed as malware hash. Source

  • 6932a20ac61fd3f93d7cfee414f6f46834068ac7c9ca011b054a6a10dc56b3d1 sha256, 4 Nov

    Listed in a table of hashes as a malware sample. Source

  • 7462CE2595119C928CF516EC33148DC2A39DD9F71636A5C849C7ED93B7C5CA06 sha256, 4 Nov

    Listed as malware hash. Source

  • 795594AD5E6F2868CC4D8ED12DABF4F3999A1477C6B250527C5EDE9A98528FB9 sha256, 4 Nov

    Listed as malware hash. Source

  • A53D756F28457B1C4A239C91CDEC8ED7B7DA67A93E332E6DF9621CBEF8417474 sha256, 4 Nov

    Listed as malware hash. Source

  • D9DB5CBC193DDAF4C0A265804FDEF70C32451DAAF2974FA9ADF52CE1DEFAC5F7 sha256, 4 Nov

    Listed as malware hash. Source

  • DC666E9C148BBCA5E21D8C9A97143575C075F53360F135E0191AED9E8278D396 sha256, 4 Nov

    Listed as malware hash. Source

  • verify.build-standards.org domain, 3 Nov

    Used as a command and validation domain for backdoored packages. Source

  • a6c7ef9b6d5277dada145361164ff79e1e6c6be1cd28f6739113c72ee30ea4cc sha256, 2 Nov

    Package fetched from operator Github, indicating attacker control Source

  • 19dbffec4e359a198daf4ffca1ab9165 md5, 29 Oct

    Listed as MD5 hash for a dropped file by threat actor Source

  • ef4ab22e565684424b4142b1294f1f4d md5, 29 Oct

    Listed as MD5 hash for X_TRADER installer leading to VEILEDSIGNAL backdoor Source

  • popcorntimeupd.xyz domain, 23 Oct

    Domain was unregistered and then used by attackers to exploit vulnerable software Source

  • d3fda1e6cf886fd530bf62e2d16c39ad23ed12a2c933fc211f1f4876ceaa033e sha256, 22 Oct

    Identified as a NuGet package carrying the encrypted loader Source

  • 07fabea33dfc2b127e865c03112dfc76936334b29028ec05cdd355af2385dc04 sha256, 21 Oct

    SHA-256 hash of a malicious file in the compromised package Source

  • 1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e sha256, 21 Oct

    SHA-256 hash of a malicious file in the compromised package Source

  • 35f2cec3a14bb297e08bfab56c1fc377432bc4071aaf71978fdff043a5d91e79 sha256, 21 Oct

    SHA-256 hash of a malicious file in the compromised package Source

  • 7294b90f868c5c38c99b83021c7ba46f9b439e95f8e32964c925c7d2563a03f7 sha256, 21 Oct

    SHA-256 hash of a malicious file in the compromised package Source

  • 03ac2a8b752605d1d7710979c17ff18b03dd978203ba23ba97fd8ce3d6f897ea sha256, 21 Oct

    SHA-256 hash of a malicious file in the compromised package Source

  • 56b74573eed6e4aafe4b50603dbe7853e0345f188c8e44a09f1098caf1f4bcdf sha256, 21 Oct

    SHA-256 hash of a malicious file in the compromised package Source

  • 7598727f209d717041db37f7dca271d3a7d328a279890e0e1d55375729aeb86d sha256, 21 Oct

    SHA-256 hash of a malicious file in the compromised package Source

  • 84dc8c82c0a4a4a62552ef826b49fcc86d1a5c4a5d0f2c06665723f93d129d7d sha256, 21 Oct

    SHA-256 hash of a malicious file in the compromised package Source

  • b6122440d0d9cb1eb1ade9933f49214da8c31288de7710c076c2680dfa528465 sha256, 21 Oct

    SHA-256 hash of a malicious file in the compromised package Source

  • 0aaf7ba346d41ef2f40390436738b001180d5a1c03aa093f121078a9969d9a1a sha256, 21 Oct

    SHA-256 hash of a malicious file in the compromised package Source

  • 12d4ccc5c6f8d35cf4f2cf233b7f3e418e863e657d81ff5f5fc9e210005b9484 sha256, 21 Oct

    SHA-256 hash of a malicious file in the compromised package Source

  • 1bbce8caa94f01c0aaa0b7ddae51553a8a32e1ce53d96d44fe583272aff7ad00 sha256, 21 Oct

    SHA-256 hash of a malicious file in the compromised package Source

  • 462d0c9f67ca522d9e0e4acd245e90b36ce0d5353604a66bb7c43a1ec4a6fcf7 sha256, 21 Oct

    SHA-256 hash of a malicious file in the compromised package Source

  • 668169d35b87bf51324080390b1b1c5ab12bd335cfe5f1a99e3689abd5e02ae6 sha256, 21 Oct

    SHA-256 hash of a malicious file in the compromised package Source

  • 7f191632e7320705d154b85204f1ae546b543acbd7e8861229b76f5042b92bdb sha256, 21 Oct

    SHA-256 hash of a malicious file in the compromised package Source

  • c2e32d0ce2548aa662c18bf5001911a79fe5b30cf8357132275add02fdcde054 sha256, 21 Oct

    SHA-256 hash of a malicious file in the compromised package Source

  • 0f79989912572a24ba13baabb32b3fd084496271c51448d47b66fe1aedbf293c sha256, 20 Oct

    Listed as a SHA-256 hash of a malicious file in the context of a supply chain attack Source

  • 3833daffcaaaab27e4e0e0833240ffcb1df8df648f4ec0bc4a75c176e28933cb sha256, 20 Oct

    Listed as a SHA-256 hash of a malicious file in the context of a supply chain attack Source

  • 43df42fd79f6f81e530892b54634598770d6e496796a863c596e616bcb3fec70 sha256, 20 Oct

    Listed as a SHA-256 hash of a malicious file in the context of a supply chain attack Source

  • 5c2beb56e6d83a4b426565a1557791ef759316abcc4effb38dd627c90aeb80e0 sha256, 20 Oct

    Listed as a SHA-256 hash of a malicious file in the context of a supply chain attack Source

  • aomei.storage-data.com domain, 16 Oct

    Identified as a dedicated, vendor-themed domain used by the threat actor for payload delivery. Source

  • promotion.storage-data.com domain, 16 Oct

    Used by the threat actor to redirect downloads during tampering windows. Source

  • storage-data.com domain, 16 Oct

    Part of the dedicated domain infrastructure used by the threat actor. Source

  • 11e576df44e9c9eef72b9f5b699291bcdb200a19130778ec231e5b0987b913ad sha256, 19 Oct

    Listed as a malicious file hash for the CROSSROAD Loader. Source

  • 14b31918075e6130b9123158743db0a81e2d7bfcf6d39731ee7d9200a98cd591 sha256, 19 Oct

    Listed as a malicious file hash for NitroPromotion.exe. Source

  • 4b4d25b3501519476f9a62a88a781e4f446f669280eb5e98c6b96eb6d3743431 sha256, 19 Oct

    Listed as a malicious file hash for metadata.dat (ChaCha20 Payload). Source

  • 4c0a75e0f62ddc0bb350c224fe996f3b2ab08dcb0d288231c61ffe9406c7045b sha256, 19 Oct

    Listed as a malicious file hash for config.zip (Python Bytecode Archive). Source

  • 5837bc26a73cfb46ffd466cf889f03ce2f6a48f1f3fd42ec8be22189d51cab1e sha256, 19 Oct

    Listed as a malicious file hash for BlkScrDl.dll. Source

  • 6670ab3f0434a42f33416f8354150b1701e7615f3cfa2f1635e54f8df0f6eec7 sha256, 19 Oct

    Listed as a malicious file hash for upgrade-now.zip (May 20 CROSSROAD Archive). Source

  • 7b252be444dee2fb2a57043a823dc5b5e1fae970aea91ee2c8339aa70329969d sha256, 19 Oct

    Listed as a malicious file hash for abe.exe (Secondary Payload). Source

  • 8c8090aca8ddb1cf968d2b810457e0cfce97c03cd721f70d2eca7f37f2681fc4 sha256, 19 Oct

    Listed as a malicious file hash for Eztwain4.dll (ADAPTAGENT Helper DLL). Source

  • 8fbaa74b27dc1e89abfc694e834378746f0ad37a688098c5f8f511410157c8b8 sha256, 19 Oct

    Listed as a malicious file hash for RuntimeComponent.dll (Custom PocketPy Engine). Source

  • 9a58e8f49edf5644e5728f74cf36f560d3d486fa51db4db69d927963c7aca450 sha256, 19 Oct

    Listed as a malicious file hash for upgrade-now.exe (July 16 CROSSROAD Loader). Source

  • 9ed503c6a9a3a493fb859401e9ed469eed77ab9927341964d6dbfbfa6255aeba sha256, 19 Oct

    Listed as a malicious file hash for upgrade-now.zip (July 20 CROSSROAD Archive). Source

  • b360b6db0c2b668317edc1504a7c39ef047f0d925c8f113b521f6724c157ae21 sha256, 19 Oct

    Listed as a malicious file hash for upgrade-now.exe (July 20 CROSSROAD Loader). Source

  • d167bc898e856da8a4003cb4dfc7de55fea109eee3cd64fc8999710314109464 sha256, 19 Oct

    Listed as a malicious file hash for component.zip / en.zip (SHINYROAD Package). Source

  • 0dcc38fc90eca38810805bb03b9f6bb44945bbc0 sha1, 19 Oct

    Listed as a malicious Hugging Face model file. Source

  • 1733506c584dd6801accf7f58dc92a4a1285db1f sha1, 19 Oct

    Listed as a malicious Hugging Face model file. Source

  • 79601f536b1b351c695507bf37236139f42201b0 sha1, 19 Oct

    Listed as a malicious Hugging Face model file. Source

  • 85c898c5db096635a21a9e8b5be0a58648205b47 sha1, 19 Oct

    Listed as a malicious Hugging Face model file. Source

  • 65f0a95b24e30305146346cbc2452cfabadab9e1ca35053e1134b67c38919577 sha256, 15 Oct

    SHA-256 hash of a worm used in the attack Source

  • 7131e9cb1bdeb272ae7e26f2877087fd5da8716ef7c08e0fc0bf1359e278df8e sha256, 13 Oct

    Listed as a malware sample hash in a threat report. Source

  • 6175161f6fa075711e55b1f0db7d346357ce5593b1e3b48fc30cd85aaad81576 sha256, 13 Oct

    Listed as a malware sample hash in a threat report. Source

  • 026873b940176d103d45b41c9fba73f14cfcaca60e3117be81d2eadef85a4d17 sha256, 10 Oct

    Listed as a malicious Rust implant SHA-256 hash in a threat report Source

  • 29875e74f033c819c1acab58ef08bc35646aab5f4a2747ee0933ca41150d7099 sha256, 10 Oct

    Listed as a malicious Rust implant SHA-256 hash in a threat report Source

  • 6ebeb188f3cc3b647c4460c0b8e41b75d057747c662f4cd7912d77deaccfd2f2 sha256, 10 Oct

    Listed as a malicious Rust implant SHA-256 hash in a threat report Source

  • 9bd105ce732218f30719fd69d4555967b362d37f4f6aec04741c18aaa7411a73 sha256, 10 Oct

    Listed as a malicious Rust implant SHA-256 hash in a threat report Source

  • cbb3f830731fe2c9194f7fe5aa55479cffdae184039b0df078b1394209d7a49f sha256, 10 Oct

    Listed as a malicious Rust implant SHA-256 hash in a threat report Source

  • fb07743d139f72fca4616b01308f1f705f02fda72988027bc68e9316655eadda sha256, 10 Oct

    Listed as a malicious Rust implant SHA-256 hash in a threat report Source

  • 25a0735d0db7dc40e5d45ce42d9c106067e6a66e184d967cfecfab17c3bcb5ef sha256, 8 Oct

    SHA-256 hash of a malicious file used in the attack Source

  • b50a00900399ba99fb6ce1fc151519cb99d44320ef2a631f2237e1aea0ad6fec sha256, 8 Oct

    SHA-256 hash of a malicious file used in the attack Source

  • 0801b24d2708b3f6195c8156d3661c027d678f5be064906db4fefe74e1a74b17 sha256, 7 Oct

    Listed as a malware variant for Linux in a threat report. Source

  • 3f4445eaf22cf236b5aeff5a5c24bf6dbc4c25dc926239b8732b351b09698653 sha256, 7 Oct

    Listed as a malware variant for macOS in a threat report. Source

  • df67a118cacf68ffe5610e8acddbe38db9fb702b473c941f4ea0320943ef32ba sha256, 7 Oct

    Listed as a malware variant for Windows in a threat report. Source

Think one of these is wrong? Email [email protected].

Other categories