>samit_hota
Back to IOCs

Indicators of Compromise

32 INDICATORSG0082win.hermes

Hermes — Indicators of Compromise

Samit Hota·
#ioc#hermes

Overview

Indicators of compromise associated with Hermes. 32 indicators listed below, linked to the G0082 adversary profile.

Not exhaustive, and confidence varies. Always corroborate against your own telemetry before taking action.

TypeIndicatorFirst SeenConfidence
ip:port217.217.97.60:8787October 17, 2026100%
ip:port217.217.97.60:8080October 17, 2026100%
ip:port216.158.95.183:8787October 17, 2026100%
ip:port216.158.95.183:8080October 17, 2026100%
ip:port216.158.95.183:8093October 17, 2026100%
ip:port194.102.104.223:8093October 17, 2026100%
ip:port194.59.31.200:8080October 17, 2026100%
ip:port192.109.139.94:8787October 17, 2026100%
ip:port192.109.139.94:8080October 17, 2026100%
ip:port192.109.139.94:8093October 17, 2026100%
ip:port192.109.139.89:8093October 17, 2026100%
ip:port172.245.25.133:8787October 17, 2026100%
ip:port172.245.25.133:8080October 17, 2026100%
ip:port172.245.25.133:8093October 17, 2026100%
ip:port163.5.210.203:8080October 17, 2026100%
ip:port163.5.210.203:8093October 17, 2026100%
ip:port158.94.211.124:8787October 17, 2026100%
ip:port158.94.211.124:8080October 17, 2026100%
ip:port158.94.211.124:8093October 17, 2026100%
ip:port109.238.87.241:8787October 17, 2026100%
ip:port109.238.87.241:8080October 17, 2026100%
ip:port109.238.87.241:8093October 17, 2026100%
ip:port107.149.8.243:8787October 17, 2026100%
ip:port107.149.8.243:8080October 17, 2026100%
ip:port107.149.8.243:8093October 17, 2026100%
ip:port91.92.243.7:8093October 17, 2026100%
ip:port45.142.182.137:8093October 17, 2026100%
ip:port45.131.214.148:8093October 17, 2026100%
ip:port45.95.99.195:8787October 17, 2026100%
ip:port45.95.99.195:8080October 17, 2026100%
ip:port45.95.99.195:8093October 17, 2026100%
ip:port31.76.100.248:8093October 17, 2026100%

Related content

Adversary Profile

APT38: North Korea's Relentless Financial Cyber Offensive

IOCs

PSLogger — Indicators of Compromise

Security News

Hermes AI Agent Used to Automate Attack on Thai Ministry of Finance

IOCs

404 Keylogger — Indicators of Compromise

Seeing these indicators in your logs?

Let's figure out how far it's gotten.

Book an advisory call