SKYCLOAK

Overview 18 indicators

No published description. This group is tracked by Maltrail from vendor reporting but is not named in MITRE ATT&CK, so there is no curated profile to show.

Principal sources 20 reports

Ranked by how many of this actor's indicators each report brought in.

• 8x.com/PrakkiSathwik/status/2016775145189429494
• 3mp.weixin.qq.com/s/nJpqvXCYV3ZdvNgYGrG4ow
• 1x.com/smica83/status/2023827560111763702
• 1x.com/t3ft3lb/status/2023910905134686227
• 1x.com/PrakkiSathwik/status/2023797472456569074
• 1virustotal.com/gui/file/5b2ca77a39fb4617e1a50797f519e8…
• 1x.com/PrakkiSathwik/status/2023437611780763851
• 1virustotal.com/gui/file/a43e2231b200b294b35dfb50fad446…

Timeline 18 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.

1. 2026-04-21 3 domainthis year

   mp.weixin.qq.com/s/nJpqvXCYV3ZdvNgYGrG4ow

   2zrek3mkl72d5b6evpkx2rz2glzrltiorgblpfb2ttg6lacwlsdk4iqd.onion

   imnlyhj4mtmtesqrvf7c4ma6dkxeyxw3ae53w6fuz42spndg7zpat6qd.onion

   nytiplwknkinobjaeb5tajjiglip3vtaccju6ta7d47u5u64ktrwhrqd.onion

   copy batch

2. 2026-02-18 1 domainthis year

   x.com/smica83/status/2023827560111763702 · x.com/t3ft3lb/status/2023910905134686227

   uliw3eyjz5gx7hup73jbnyeqrdlrzvzxxsbww2tewp3sbh2qtpbasad.onion

   copy batch

3. 2026-02-18 1 domainthis year

   x.com/PrakkiSathwik/status/2023797472456569074 · virustotal.com/gui/file/5b2ca77a39fb4617e1a50797f519e8…

   juliw3eyjz5gx7hup73jbnyeqrdlrzvzxxsbww2tewp3sbh2qtpbasad.onion

   copy batch

4. 2026-02-16 1 domainthis year

   x.com/PrakkiSathwik/status/2023437611780763851 · virustotal.com/gui/file/a43e2231b200b294b35dfb50fad446…

   iz4cthf7lios7igq7lvvlgg6xyn5eqowfue5wgsdlgdipueam7av32ad.onion

   copy batch

5. 2026-02-03 1 domain, 7 ipv4this year

   x.com/PrakkiSathwik/status/2016775145189429494

   domain	q35x354qfx43klbx5wd2iw7272wrrhcvgwqqbwut44yiui2hw7cz7fyd.onion
   ipv4	176.169.236.210:4431
   ipv4	188.116.26.254:23452
   ipv4	193.138.81.106:8443
   ipv4	74.208.183.104:8008
   ipv4	81.141.112.253:8080
   ipv4	91.208.206.67:9130
   ipv4	95.179.192.8:8080

   copy batch

6. 2026-01-30 1 domainthis year

   x.com/PrakkiSathwik/status/2017248214513320070 · virustotal.com/gui/file/a79b5162f9a49df3db4f001325938b…

   3xl6xhboulyuez6fuydyhj7pdvkshzn4ogsmgwbb3ukrkvgi6bcwvfyd.onion

   copy batch

7. 2026-01-29 1 domainthis year

   x.com/PrakkiSathwik/status/2016888291275264519 · virustotal.com/gui/file/1fbdb99357ace6d6db830c63850a6e…

   kvk46su7d2qi6g4n43syp4zbsf2rihnc6ztj77qtc2ojvewjqvqilnqd.onion

   copy batch

8. 2026-01-29 1 domainthis year

   x.com/PrakkiSathwik/status/2016888288414724367 · virustotal.com/gui/file/1359c044951e16438251483290799b…

   e3mnde5uyuxjoztup6t3m7nykbicexbzra76ucligwgsaez65w63y2ad.onion

   copy batch

9. 2026-01-02 or earlier 1 domainthis year

   x.com/smica83/status/1982342773626880217 · x.com/PrakkiSathwik/status/1984324320731283614 · seqrite.com/blog/operation-skycloak-tor-campaign-ta… · cyble.com/blog/weaponized-military-documents-deli… · virustotal.com/gui/file/99ec6437f74eec19e33c1a0b4ac882… · virustotal.com/gui/file/f44fa352c430d5f34462143daa7266…

   yuknkap4im65njr3tlprnpqwj4h7aal4hrn2tdieg75rpp6fx25hqbyd.onion

   copy batch

Further reading 20

• virustotal.com/gui/file/f44fa352c430d5f34462143daa7266…
• x.com/PrakkiSathwik/status/2023797472456569074
• virustotal.com/gui/file/1fbdb99357ace6d6db830c63850a6e…
• virustotal.com/gui/file/99ec6437f74eec19e33c1a0b4ac882…
• x.com/PrakkiSathwik/status/2016888291275264519
• x.com/t3ft3lb/status/2023910905134686227
• x.com/PrakkiSathwik/status/1984324320731283614
• cyble.com/blog/weaponized-military-documents-deli…
• virustotal.com/gui/file/1359c044951e16438251483290799b…
• virustotal.com/gui/file/a79b5162f9a49df3db4f001325938b…
• x.com/smica83/status/2023827560111763702
• x.com/PrakkiSathwik/status/2023437611780763851
• x.com/PrakkiSathwik/status/2016888288414724367
• x.com/PrakkiSathwik/status/2017248214513320070
• x.com/PrakkiSathwik/status/2016775145189429494
• virustotal.com/gui/file/a43e2231b200b294b35dfb50fad446…
• virustotal.com/gui/file/5b2ca77a39fb4617e1a50797f519e8…
• x.com/smica83/status/1982342773626880217
• mp.weixin.qq.com/s/nJpqvXCYV3ZdvNgYGrG4ow
• seqrite.com/blog/operation-skycloak-tor-campaign-ta…