Topic
Publication of IoCs and how quickly rotating adversary infrastructure erodes their value.
Hunt.io found that BraZetsu's servers had moved hosts months before Group-IB's August 31 report named them. Defenders who block only the published addresses are pointing at infrastructure the operators had already abandoned.
Reality
Microsoft says China-linked operators have used NeedyMantis since at least October 2025 to keep access to telecom, university and government-linked networks. It goes in after the break-in, so defenders have to hunt for it inside networks already breached.
Perspective Coverage
3 publishersReality
Microsoft Defender Experts says fake Kaspersky, Razer and Calibre download sites all funnel to one delivery host that rebuilds the installer per request, which leaves hash blocking almost nothing durable to match.
Reality
Unit 42 followed the copy-paste instructions on Aug. 5, 2026, and watched one Zsh command install AMOS twice over and package a lab Mac's wallet folders and cloud credentials into a single zip.
Reality
A Go decoy on port 22 logged 3,888 login attempts from 666 addresses in 22 hours, and the part worth copying is the resolver that turns a loader's URL template into an address you can actually block.
Reality