# NorthQuinn Inc. — Threat Intelligence Report NQ-TIR-2026-001, version 1.1 (corrected October 2026)
# Title: Threat Actors in the Wild: A 10-Day Observational Study of Attacks Against an
#        Internet-Facing Honeypot with an Industrial Control System Persona
# Author: Angel Gonzalez Gines, NorthQuinn Inc.
# TLP: CLEAR
# Collection period: April 25 – May 5, 2026
# Reporting: 25 IP addresses from the original analysis were reported to AbuseIPDB on May 5, 2026.
# Supersedes the May 2026 IOC list. Beacon strings in that list were truncated and several
# beacon/server pairings were wrong; see the paper's Section 6.2 and Revision Note.
#
# "Payload server" = host from which payloads were downloaded. For peer-to-peer families such
# as Mozi these are often infected devices, so addresses may change and blocking may affect
# compromised consumer equipment.

# ── PAYLOAD SERVERS (original analysis, top 15) ─────────────────────────────
115.55.55.254:40797     # beacon LEAZRGQX (verified, Apr 28)
113.231.72.92:48836     # beacon IYVDGTTF (verified, Apr 28)
123.12.11.204:60425     # beacon not verified
202.1.26.13:36849       # beacon not verified
182.112.217.179:35292   # Mozi-family, UPX-packed MIPS; beacon not verified
125.44.43.28:49287      # beacon not verified
111.164.253.1:57439     # beacon not verified
61.53.124.139:45487     # beacon JSWEXWVT (verified, Apr 28)
36.70.229.69:39320      # Mozi-family, ARM; beacon not verified
119.183.130.225:34157   # beacon KIGAYKFK (verified, Apr 28)
77.247.88.87:52724      # beacon not verified
115.56.8.90:34200       # beacon not verified
113.228.146.205:7001    # beacon not verified
182.127.44.241:35304    # beacon not verified
196.189.197.131:45432   # beacon not verified

# ── ADDITIONAL PAYLOAD SERVERS (preserved April 28 command evidence; added in v1.1) ──
125.42.69.127:53599     # beacon MVOSZVYE
196.188.80.240:45921    # beacon UDHLUNUP
60.22.29.225:47076      # beacon EWAOSNHZ
113.239.244.238:54927   # beacon EWAOSNHZ
60.23.193.75:53299      # beacon EWAOSNHZ

# ── BEACON STRINGS (8 bytes; echoed in the victim's shell, verified Apr 28) ──
# LEAZRGQX  4c 45 41 5a 52 47 51 58
# IYVDGTTF  49 59 56 44 47 54 54 46
# KIGAYKFK  4b 49 47 41 59 4b 46 4b
# JSWEXWVT  4a 53 57 45 58 57 56 54
# MVOSZVYE  4d 56 4f 53 5a 56 59 45
# EWAOSNHZ  45 57 41 4f 53 4e 48 5a
# UDHLUNUP  55 44 48 4c 55 4e 55 50

# ── MALWARE HASHES (SHA256) ──────────────────────────────────────────────────
# ARM Mirai/Mozi variants (payload server 36.70.229.69)
12013662c71da69de977c04cd7021f13a70cf7bed4ca6c82acbc100464d4b0ef
acd0712ea85c759020b448cf8344b7cee72b646cbc8e96eb53507a83463ee340
# MIPS Mirai/Mozi variants, UPX-packed (payload server 182.112.217.179)
3c060e8c70da8634814e0d4560ca150e087cdbf62bcacf83dbf48559ca08bb89
4293c1d8574dc87c58360d6bac3daa182f64f7785c9d41da5e0741d2b1817fc7

# ── OUTLAW (mdrfckr) SSH BACKDOOR KEY ────────────────────────────────────────
# Publicly documented since at least 2023; not a new indicator. Still in use in 2026.
# RSA-2048, comment: mdrfckr
# SHA256:MkYY9qiVsFGBC5WkjoClCkwEFW5iSjcGQF7m4n4H7Cw
# MD5:13:47:1e:8f:5a:18:fc:8e:35:0a:51:cc:7d:b4:06:61
ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr

# ── HASSH FINGERPRINTS (shared client software; not attribution on their own) ──
# af8223ac9914f509afdadfaf5f7ee94e — client shared with Outlaw key-injection sessions (261 IPs)
# 03a80b21afa810682a776a7d42e5e6fb — credential 3245gs5662d34 cluster (108 IPs)
# 16443846184eafde36765c9bab2f4397 — Solana-themed credential cluster / Go SSH client (39 IPs)
# 4e066189c3bbeec38c99b1855113733a — fingerprint-only reconnaissance cluster (38 IPs)

# ── SHARED CREDENTIAL ────────────────────────────────────────────────────────
# 3245gs5662d34 — seen from 35+ source IPs across 18 countries; function not established