TIER-3 THREAT INTELLIGENCE DESKLOCKBIT 3.0 · UNC3944 NEXUS
SOC & Threat Intelligence Analyst Workspace
| IOC Type | Indicator Value | Threat Attribution | Severity | Detection Telemetry | Action / Status | Copy |
|---|---|---|---|---|---|---|
| IP | 185.220.101.5 | FIN12 / LockBit 3.0 | CRITICAL (99) | Perimeter Palo Alto Egress | ACTIVE_BLOCK | |
| DOMAIN | c2-healthcheck.dynamic-dns.net | UNC3944 Affiliate | CRITICAL (95) | Core Infoblox DNS RPZ | SINKHOLED | |
| HASH_SHA256 | e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 | LockBit 3.0 Builder | HIGH (98) | CrowdStrike Falcon Sensor | ACTIVE_BLOCK | |
| BITCOIN_WALLET | bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh | LockBit Payment Cluster | HIGH (92) | Restore-My-Files.txt Note | MONITORING | |
| ONION_HOST | lockbitaptc2xnk7b5yvh7y5vxsq.onion | LockBit Dark Web Portal | CRITICAL (100) | Tor Onion Parser | MONITORING | |
| REGISTRY_KEY | HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\svchost_lock | LockBit Payload Persistence | HIGH (90) | Sysmon Event ID 13 | ACTIVE_BLOCK |