← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
Credit Tr1sa111- "Operation WordDrone" usernote: 22 clicks to clone
WHITE msudosos 2026-04-30 Modified: 2026-05-30
27
IOCs
MEDIUM VOLUME
taiwanwinwordcommandexample codedigiwinmicrosoft wordntdllhttphttpswebsocketaprilconceptprocdumpvirustotalinstallertargetaugustclientendpoint.dll main
MITRE ATT&CK & Malware Families
ATT&CK TECHNIQUES
MALWARE FAMILIES
Digiwin ClientEndPoint.dll Main
Indicators of Compromise (3 / 27 total)
All CVE FileHash-MD5 FileHash-SHA1 FileHash-SHA256 URL domain hostname IPv4
TYPEINDICATORDESCRIPTIONCREATED
hostname es-update.digiwin.com — 2026-04-30
hostname server.microsoftsvc.com — 2026-04-30
hostname time.vmwaresync.com — 2026-04-30
References (1)
↗ https://www.acronis.com/en-us/cyber-protection-center/posts/operation-worddrone-drone-manufacturers-are-being-targeted-in-taiwan/