DLL loader tests coincide with logger write, but attribution is unresolved
Two sandboxes recorded processes invoking named functions in the same DLL, and one report also recorded a write of `0` to the Circular Kernel Context Logger’s `Status` value. The write identifies a possible logging-interference lead, but the report does not identify its writer or show whether logging changed.
DLL sandbox traffic links four hosts to API-shaped indicators
A DLL analysis recorded TCP traffic to four IP addresses that also appear in newly listed, API-shaped network indicators. In that same sandbox report, rundll32.exe was invoked against TmopphDns.dll, with ctfmon.exe appearing beneath it in the process tree. The overlap raises a concrete question: does the file explain how those apparent API endpoints were used?
upWire analysis shows attempts to delete two named firewall rules
Two Windows process-creation events record commands to delete firewall rules named upWire and wire. Both invoke netsh.exe through cmd.exe, and both record the new process running at High integrity. The immediate question is not simply whether a firewall command ran, but what removing those particular rules would change: was this software maintaining its own network settings, or interfering with a host’s protection?
Registration calls wrote COM values despite a separate DLL error
Three COM class registrations were set to point to funoictl.dll on a sandbox desktop. In the same sandbox report, a separate invocation of that DLL produced a Windows error-reporting process. Did the component fail to do anything useful, or had it already made a consequential change? The evidence supports a more specific answer: the DLL’s registration-related invocations produced concrete registry writes, while a different invocation encountered an error.
C&CMembersNov 6, 2026, 01:37 (UTC+9)Matching TLS services across networks do not establish shared attack control
Two IP addresses in different autonomous systems expose the same HTTPS certificate and the same JARM service fingerprint. The pairing of 101.198.2.228 and 101.91.111.170 raises a useful question: does that match identify common attack infrastructure, or a shared service presentation? The records supplied to CTX Threat Intelligence support the narrower finding. They connect the addresses through specific TLS characteristics, rather than merely through geography or a telecommunications provider.
#TLScertificates#JARMfingerprints#HTTPSservices#Autonomoussystems#Sharedhosting#Server-nameindication#InfrastructureanalysisIOCf1 · i12 · d0 · u0MITRE29
APTMembersNov 6, 2026, 01:36 (UTC+9)Missing pages still reveal a recurring destination for a Windows executable
A Windows executable’s sandbox reports repeatedly recorded requests to area.wthelpdesk.com, using changing directory names and .htm filenames. Yet the responses differed sharply: one report showed missing pages, another redirects mixed with HTML responses, and a third a successful HTTP response with a cookie. What, exactly, was this host doing for the file? The evidence assembled by CTX Threat Intelligence establishes a recurring network destination, not a demonstrated command channel.
#Windowsexecutable#Sandboxanalysis#HTTPrequests#DNSresolution#WebcacheartifactsActorsRed Apollo · PotassiumIOCf1 · i0 · d1 · u7MITRE8RegionsMYIndustriesGovernment
FILEMembersNov 5, 2026, 09:40 (UTC+9)Recurring POST requests met redirects, including a domain-sale page
A Windows executable’s sandbox record contains POST requests to /b3/order.php on two hosts. One returned redirects to the same path; the other directed the client to a domain-sale page. In the same Lastline report, AdobeAcrobat entries appeared under Windows startup registry keys. The combination raises a more useful question than whether the domains are suspicious: what did the executable try to establish locally, and what service actually answered its outbound requests?
#Windowsexecutable#Startupregistrykeys#Persistence#HTTPPOSTrequests#HTTPredirects#SandboxanalysisActorsRATicateIOCf1 · i0 · d7 · u0MITRE24RegionsMYIndustriesGovernment
C&CMembersNov 5, 2026, 09:39 (UTC+9)Same-hash executable ran as svchost.exe and gained a logon launch setting
A file recorded as C:\121972984215590\svchost.exe had the same SHA-256 as the executable under examination, appeared beneath that sample in a sandbox process tree, and was named in a registry setting for launch at logon. The combination changes the meaning of the familiar filename: this was not simply a reference to a Windows service host, but the examined executable’s content operating under that name. The same analysis also recorded an HTTP request to 185.215.113.10.
#Phorpiex/Botx#svchost.exedisguise#Runkeypersistence#HTTPrequests#Defenderpolicywrite#securitynotificationchangesIOCf8 · i2 · d0 · u13MITRE32RegionsPK
APTMembersNov 5, 2026, 09:29 (UTC+9)Created SysWOW64 executable runs under services.exe at System integrity
An executable created under C:\Windows\SysWOW64 appears in a process-creation event with services.exe as its parent and System integrity. In sandbox reports for the submitted sample, requests also reach a resolver’s web interface to ask for TXT records beneath two .xyz domains. These observations raise a more useful question than whether the domains look suspicious: what does the executable actually establish on the host, and what information does it seek from DNS?
#SysWOW64execution#Service-contextexecution#DNSqueries#TXTrecords#Webresolver#SandboxanalysisActorsGold Evergreen · Business ClubIOCf5 · i1 · d7 · u2RegionsUS
FILEMembersNov 4, 2026, 17:36 (UTC+9)Excel launches an executable; a separate payload request lacks delivery proof
An Excel spreadsheet’s sandbox record contains a request for an executable at www.bagsrad.com and traffic to a different host’s configured TCP endpoint on port 5203. Are these two parts of one delivery-and-control sequence? The evidence establishes distinct roles for the destinations, but not every link between them. CTX Threat Intelligence’s records show Excel launching a local executable, a matching executable appearing under another name, and a logon launch setting pointing to that second…
#maliciousspreadsheet#executablerequest#processexecution#Runkeypersistence#Warzone-familyconfiguration#DNStraffic#TCPtrafficActorsMuddyWater · TEMP.ZagrosIOCf1 · i0 · d1 · u2RegionsAU · CH · DE · DKIndustriesBusiness Associations · Energy · Retail
C&CMembersNov 4, 2026, 17:36 (UTC+9)DNS links two domains to IPs; TLS fingerprints add service context
reihtec.com resolves to 174.138.186.11, and both carry the same recorded JARM TLS-service fingerprint. A second pair, kalteng.net and 45.126.43.3, shows the same combination of an exact DNS relationship and matching fingerprints. These are concrete connections—but do they identify malicious infrastructure, or simply the services behind the names?
#DNSrecords#TLSservices#JARMfingerprints#Hostinginfrastructure#Digitalcertificates#WindowsexecutableActorsPinchy Spider · SodinokibiIOCf2 · i9 · d13 · u9RegionsUS
FILEMembersNov 4, 2026, 02:12 (UTC+9)Executable imports reveal a shared DLL architecture, not verified execution
A Windows executable submitted as spoolsrv.exe names three unusually specific dependencies: coli-0.dll.coli_setID, trch-1.dll.Parameter_hasValue and tucl-1.dll.TcLog. A second executable, submitted as svschost.exe, requests the same DLLs alongside several others. Those names recur among the files profiled by CTX Threat Intelligence. The question is not simply whether the files have similar malware labels, but whether their internal references reveal a connected software design.
#Windowsexecutables#DLLimports#Modulartoolset#Softwarepacking#UPX#PEanalysisActorsRaspite · LeafminerIOCf47 · i0 · d1 · u2MITRE11RegionsUSIndustriesRetail
C&CMembersNov 4, 2026, 02:02 (UTC+9)Two Kryptex entry points converge on one address
Two Kryptex hostnames that appear to offer different entry points lead to the same recorded address. prl.kryptex.network and prl-eu.kryptex.network both resolve to 23.88.2.85, and their profiles contain the same TLS certificate and JARM service fingerprint. That overlap raises a practical question: does the wider collection describe separate servers, regional access points to a service, or a single connected attack infrastructure?
#Crypto-miningservices#DNSrecords#TLScertificates#Regionalendpoints#MiningscriptsIOCf37 · i5 · d9 · u0RegionsAR · BE · BH · BNIndustriesConstruction · Education & Research · Technology
- Articles published
- 742
- IOCs analysed
- 24,440
- Threat Actor
- 479
- MITRE techniques
- 211
- Targeted regions
- 162
- Targeted industries
- 32