First seen May 22, 2026 · Last seen May 24, 2026 · Analyst (Mock)
Public preview
IOC type, status and defensive guidance visible. Pro adds alert context, Pro+ adds exports and deeper relationships.
Context
Truncated mock hash of GhostTunnel DNS tunneling agent. Attribution to Cluster-7749 under review.
Defensive Guidance
Search for file with partial hash on network shares. Review recently deployed executables.
Tags
Safety Note
Truncated/redacted mock hash. Not a real tool hash.
Actions
Related Threat Feed Items
Deeper context available with Pro++
View plans →
