UAC-0099 MATCHBOIL/LONEPAGE IOC sweep (hashes, IPs, domains, URLs)

Arnold Chan@slaz

•updated yesterday•0•0•2

Sweeps endpoint telemetry for known UAC-0099 MATCHBOIL/LONEPAGE indicators: SHA256 hashes, C2 IPs, C2 domains (including subdomains), and payload/C2 URLs. Matches are limited to public outbound connections, Defender self-activity is excluded from file hits, and repeat hits are collapsed to one row per device and indicator. The lists are a subset of the 142 IOCs in the source report.