← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
Resecurity | Qilin Ransomware and the Ghost Bulletproof Hosting Conglomerate
WHITE CyberHunter_NL 2025-10-21 Modified: 2025-11-20
26
IOCs
MEDIUM VOLUME
qilinhong kongchang wayrussialimitedasahioctoberbearhostbonham stranddatehongmazeaprilguardianundergroundexploitlockbitrusttrinitychaosroverslovakiaalexanderbianlianserviceransomwarewikileaksv2twitteraugustfreedomdragonforcemalwareamadeystealcprospero
Indicators of Compromise (26)
All CVE FileHash-MD5 URL domain email hostname
TYPEINDICATORDESCRIPTIONCREATED
CVE CVE-2025-61882 — 2025-10-21
FileHash-MD5 a11c4fa9584a4027a03895eb24df40ea — 2025-10-21
URL http://whois.eranet.com — 2025-10-21
URL http://www.eranet.com — 2025-10-21
URL https://decodecybercrime.com/bearhost-bolts-but-the-investigation-is-just-beginning/ — 2025-10-21
URL https://www.lemagit.fr/actualites/252496421/Ces-mysterieuses-entreprises-qui-se-font-attribuer-des-b... — 2025-10-21
domain catcompany.info — 2025-10-21
domain changway.hk — 2025-10-21
domain decodecybercrime.com — 2025-10-21
domain networkmaze.hk — 2025-10-21
domain support-decryptor.hk — 2025-10-21
email abuse@eranet.com — 2025-10-21
email abuse@nicenic.net — 2025-10-21
email admin@changway.hk — 2025-10-21
email info@starcrecium.com — 2025-10-21
email support@nicenic.net — 2025-10-21
hostname ns1.entrydns.net — 2025-10-21
hostname ns2.entrydns.net — 2025-10-21
hostname ns3.entrydns.net — 2025-10-21
hostname ns4.entrydns.net — 2025-10-21
hostname whois.eranet.com — 2025-10-21
hostname www.eranet.com — 2025-10-21
hostname www.lemagit.fr — 2025-10-21
email 88db011bbcb06078s@gmail.com — 2025-10-21
email bernard.webmail@gmail.com — 2025-10-21
email bernard.webmal@gmail.com — 2025-10-21
References (1)
↗ https://www.resecurity.com/blog/article/qilin-ransomware-and-the-ghost-bulletproof-hosting-conglomerate