APTMembersSep 16, 2026, 22:43 (UTC+9)Downloader Stacks Three Evasion Tricks, Hides C2 in Alibaba DoH Traffic
A downloader carrying the threat label trojan.sfuzuan/convagent packs three separate anti-analysis tricks into a single unsigned Windows binary — a debugger check, a deliberate stall before execution, and a 32-to-64-bit mode transition known as HeavensGate — and then leans on Alibaba's own DNS-over-HTTPS infrastructure to resolve whatever it talks to next.
#trojan.sfuzuan#convagent#HeavensGate#DNS-over-HTTPS#GoldEvergreen#BusinessClub#DGAdomains#downloaderevasionActorsGold Evergreen · Business ClubIOCf5 · i0 · d7 · u2
APTMembersSep 14, 2026, 22:38 (UTC+9)TA505 Loader Hides Behind Six-Year-Old Mozambique Academic Domain
The most telling artifact in this cluster isn't a binary — it's a URL. rcf.co.mz/mytimeiswriten.exe sits on a domain registered on 2020-05-03 through Mozambique's academic CIUEM Registrar, a domain that still carries active mail routing and a valid SPF record naming its own hosting IP. Rather than spinning up a fresh, throwaway domain that would trip every newly-registered-domain heuristic on the market, whoever is running this operation appears to have repurposed six years of accumulated…
#TA505#Hive0065#rockloader#DuckDNS#Let'sEncryptcertificaterotation#Mozambiquedomainabuse#dynamicDNSC2#bulletproofhostingActorsTA505 · Hive0065IOCf55 · i2 · d1 · u2RegionsDE · ID · IE · ITIndustriesConstruction · Education & Research · Manufacturing
APTMembersSep 12, 2026, 22:27 (UTC+9)APT33-Linked Downloader Wears a Dead Code-Signing Chain
A trojan tracked as bsymem — publicly also known as Donoff — ships with an entire three-tier code-signing chain still attached to the binary: GlassWire, a legitimate desktop network-monitoring vendor, sitting underneath a Symantec Class 3 SHA256 Code Signing CA certificate and a root VeriSign certificate. VirusTotal's verdict on that chain is blunt — "the digital signature of the object did not verify" — and two of the three certificates in it are separately flagged as "not time valid." The…
#APT33#bsymem#Donoff#AutoITdownloader#codesigningabuse#customermgmt.net#sandboxevasion#masqueradingActorsAPT33 · MagnalliumIOCf3 · i0 · d1 · u1MITRE24RegionsCH · JOIndustriesGovernment · Support Services
APTMembersSep 11, 2026, 23:46 (UTC+9)Installer Hides Its Only Flagged File Among Ten Clean Decoys
Ten PNG and CSS files with an identical creation moment sit alongside a single packed Windows executable that carries every detection in the set — a pairing that reads less like a malware family and more like the internals of an ordinary software installer, repurposed. The image assets are unremarkable on inspection: a close button, a hover state, a grey button, a progress bar, a stylesheet named main.css. Individually they register 0/53 to 0/57 across antivirus engines.
#Snowglobe#AnimalFarm#Sig20#babarmalware#trojanizedinstaller#USretailsector#CloudFrontC2#packedexecutableActorsSnowglobe · Animal FarmIOCf18 · i0 · d2 · u0MITRE27RegionsUSIndustriesRetail
APTPublicSep 11, 2026, 22:38 (UTC+9)A Political Decoy Document Reopens a 2016 Word-Processor Flaw
A Korean-language document about inter-Korean political affairs is still being used to trigger a nine-year-old Hangul Word Processor flaw, and the payload it drops is evading a meaningful share of security engines nearly a decade after it was first compiled. The lure — a corrupted HWP container (29430240cb59a12fcde8e4153c0859c90d5a928503a1ca05433f08a7b3c50bf2) carrying an internal object path that resolves to a temp file named for a comparison of "2016 and 2017 South Korea-facing affairs" —…
#Group123#ScarCruft#APT37#ROKRAT#HWPexploit#CVE-2016-2569#SouthKorea#espionageActorsGroup123 · Venus 121IOCf2 · i1 · d0 · u0MITRE21RegionsCH · JOIndustriesSupport Services
APTMembersSep 9, 2026, 22:29 (UTC+9)Pirated Mortal Kombat Installer Feeds Debugger-Aware Loader Chain
Two unsigned Win32 installers dressed up as a pirated "Mortal Kombat 1" setup from the FitGirl repack scene are functioning as the entry point for a debugger-aware loader chain that ends with a second-stage payload fetched over plain HTTP. Both files carry identical product and copyright metadata — "Mortal Kombat 1" and "FitGirl" — and both use the meaningful name setup.exe, with one retaining the full internal path E:\Mortal_Kombat_1_--_fitgirl-repacks.site\setup.exe. Neither is code-signed.
#DBatLoader#DonutLoader#VoidArachne#SilverFox#piratedsoftwarelure#TLScertificatereuse#Russia-hostedinfrastructure#ingresstooltransferActorsVoid Arachne · Silver FoxIOCf9 · i5 · d2 · u1RegionsBR
APTMembersSep 7, 2026, 22:29 (UTC+9)Fake PDF Reader Ecosystem Runs on Two Valid Corporate Code Signatures
Two entirely separate, still-valid commercial code-signing chains are being used in parallel to push the same lure: consumer utility installers — PDF readers, zip tools, photo viewers — that dozens of antivirus engines flag as adware while sandboxes wave them through as clean. Thirteen samples carry a GlobalSign GCC R45 CodeSigning CA 2020 certificate issued to 沧州句号网络科技有限公司 (Cangzhou Juhao Network Technology Co., Ltd.), with detection ratios ranging from 18 to 46 out of roughly 77 engines.
#codesigningabuse#GlobalSigncertificate#DigiCertcertificate#adware#PUPdistribution#ChinaTelecomFujian#Qihoo360impersonation#fakePDFreaderActorsSalty Spider · KuKuIOCf18 · i5 · d0 · u0MITRE10
APTMembersSep 7, 2026, 06:39 (UTC+9)One TLS Certificate Ties Three Alibaba Cloud IPs to Fallback C2
The most concrete signal in this indicator set is not a payload — it is a certificate. Three IP addresses, 163.181.72.193, 163.181.72.200 and 163.181.72.201, all sitting inside the 163.181.72.0/23 block and geolocated to Thailand, present the identical TLS certificate serial 6696262f452fcf46b79266a8 with the identical wildcard subject *.certfallback.com.
#TA505#rockloader#AlibabaCloud#certificatepinning#Thailandinfrastructure#C2fallback#crackedsoftwarelures#TLSfingerprintingActorsTA505 · Hive0065IOCf2 · i5 · d2 · u0IndustriesHealthcare
APTMembersSep 5, 2026, 14:28 (UTC+9)A Shopify Wildcard Certificate Is Serving DarkSide's Command Channel
The freshest piece of this investigation is not the ransomware payload — it is the domain answering for it. baroquetees.com, registered on 2026-02-19 through TUCOWS.COM, CO., resolves to a single IP address, 23.227.38.71, behind Google Cloud DNS name servers (ns-cloud-a1 through ns-cloud-a4.googledomains.com). Its most recently observed TLS certificate, issued by Cloudflare TLS Issuing ECC CA 1, does not carry baroquetees.com in its subject or SAN fields at all.
#DarkSideransomware#GoldWaterfall#TLScertificatemismatch#Cloudflareinfrastructure#command-and-controldomain#Shopifywildcardcertificate#Romania#IDSsignaturedetectionActorsDarkside · Gold WaterfallIOCf1 · i0 · d1 · u2MITRE35RegionsRO
APTMembersSep 5, 2026, 06:28 (UTC+9)A 2019 Emotet Invoice Lure Resurfaces With Newly Certified Dormant Domains
A Word document dressed as a German electricity invoice and a Polish payment notice has resurfaced in telemetry alongside four domains whose registration dates read like a timeline of the internet itself — 1997, 2004, 2014, and 2026. Three of those domains sat dormant for a decade or more before anyone bothered to issue them a fresh TLS certificate; the fourth, registered this year, doesn't even carry its own certificate, borrowing a wildcard from a shared hosting platform instead.
#Emotet#TA542#MummySpider#malspam#domainreactivation#TLScertificateabuse#defenseevasion#invoicephishinglureActorsEmotet Group · TA542IOCf3 · i0 · d4 · u7RegionsDE
APTMembersSep 4, 2026, 14:35 (UTC+9)Pirated Windows Activator Hides Five-Stage Intrusion Kit
A "free" copy of KMSAuto — the activation utility that generations of users have downloaded to skirt Windows licensing — carries a code-signing certificate that the distributor minted for itself, a loader dressed as a Google Chrome updater, a userland rootkit, a coin-mining payload, and a fifteen-year-old kernel driver still on the LOLDrivers vulnerable-driver list. None of those five components is individually novel.
#KMSAuto#APT27#BYOVD#WinRing0#code-signingabuse#coinminer#rootkit#MalaysiagovernmentsectorActorsAPT27 · TEMP.HippoIOCf17 · i0 · d3 · u1MITRE58RegionsMYIndustriesGovernment
APTMembersSep 3, 2026, 22:28 (UTC+9)Decade-Old Flash Exploit Rides Along With Game-Trainer Loader
A Vietnamese-language "auto-trainer" toolkit for the online game Vo Lam Truyen Ky is quietly bundling something considerably nastier than a speed-hack: a packed loader called VulanPK.exe paired, byte for byte in the same build directory, with an exploit DLL that still carries the fingerprint of a 2015 Adobe Flash Player vulnerability.
#BlueBottle#Opera1er#CVE-2015-2387#game-trainermalware#Vietnam#MegaDNS#Taggantpacker#malvertisingActorsBlueBottle · Opera1erIOCf80 · i1 · d2 · u3MITRE35RegionsAT
APTMembersAug 31, 2026, 14:42 (UTC+9)Five DDNS Hostnames, One Backend, Tied to DarkHotel Downloader
Five command-and-control hostnames spread across four unrelated free dynamic-DNS providers — Zyns, Crabdance (used twice), ServeHTTP, and Mooo — all resolve to the identical backend panel path, `/bin/home/home.php and /bin/home/view.php, and all carry the same encoded parameter string, a2=1ae8bdddea716a1fa3c8492572357e80. That repetition is the news here: gigamiros.zyns.com, microzion.crabdance.com, mirosmial.crabdance.com, microgenuinsman.servehttp.com and nanobis.mooo.com look, on the…
#DarkHotel#garveep#dynamicDNSabuse#downloadermalware#espionage#HongKong#Japan#technologysectorActorsDarkHotel · Fallout TeamIOCf1 · i1 · d1 · u25MITRE8RegionsHK · JPIndustriesTechnology
APTMembersAug 29, 2026, 22:36 (UTC+9)A Builder Fingerprint Ties Three 'Different' Trojans to One Assembly Line
Three files carrying three unrelated threat labels — trojan.msil/jalapeno, trojan.msil/agenttesla and trojan.msil/zusy — turn out, on inspection of their import tables, to be the same product line. Each one carries the identical import hash f34d5f2d4577ed6d9ceec516c1f5a744, a fingerprint of the exact function-import list a .NET builder or crypter service stamps into every executable it produces.
#imphash#MSILtrojan#AgentTesla#GCleaner#pay-per-installloader#Cloudflareinfrastructure#commoditystealer#OperationBlackAtlasActorsOperation Black AtlasIOCf23 · i2 · d5 · u7MITRE51
APTMembersAug 28, 2026, 23:11 (UTC+9)Signed Bright Data Component Escalates From Trojan to Stealer
A binary called net_updater.exe, carrying a valid, unrevoked Authenticode chain issued to Bright Data Ltd through DigiCert's Trusted G4 code-signing program, has moved through three successive builds between September 2025 and June 2026 — and detection engines have not agreed on what to call it at any point along the way. The first build, submitted in September 2025 (ae182434d7a588ed1d73054394fca0d95d8ea8d1b2cdb51477351e7c1df0932d), drew the label trojan.luminati/brightdata from 21 of 76…
#BrightData#PBotstealer#codesigningabuse#adware#trojan#Cactusransomwaregroup#TLScertificatereuse#domaininfrastructureActorsCactus · Cactus Ransomware GroupIOCf14 · i14 · d20 · u4MITRE8IndustriesHealthcare · Telecommunications
APTMembersAug 28, 2026, 22:31 (UTC+9)Disposable Storefronts Share One DNS Backbone Behind GCleaner Loaders
Three domains dressed up as e-commerce storefronts — shhsift.click, kupzovo.shop, and vexdico.shop — resolve through the identical nameserver pair ns1.dyna-ns.net and ns2.dyna-ns.net, the Dynadot-operated DNS infrastructure that sits behind all three registrations. That is not three operators independently choosing the same registrar; it is the same DNS footprint appearing on domains with unrelated naming conventions and different final IP addresses (159.65.136.5, 66.228.41.52, and…
#GCleanerloader#InjectorNett#APT28misattribution#Dynadotinfrastructure#Let'sEncryptYE2#pay-per-install#commoditymalware#disposabledomainsActorsAPT28 · StrontiumIOCf15 · i1 · d5 · u9MITRE23
APTMembersAug 25, 2026, 22:29 (UTC+9)Fake Flash Installer Hides PlugX Loader With Timer-Based Sandbox Checks
A dropper calling itself install_flash_player.bin does something a real Adobe installer never does: it reads the CPU timer directly to work out whether it is being watched, checks for an attached debugger, and then simply waits — sometimes for long stretches — before it does anything else. Only after that stall completes does the Nullsoft-packaged installer (c56ac01b…) begin dropping its real payload.
#MustangPanda#PlugX#Korplug#CobaltStrike#sandboxevasion#NSISinstaller#Switzerland#supportservicessectorActorsMustang Panda · HoneyMyteIOCf3 · i0 · d2 · u81MITRE20RegionsCHIndustriesSupport Services
APTMembersAug 25, 2026, 14:37 (UTC+9)Four Chinese Shell Firms, One DigiCert Chain, One Hidden RAT
Twenty Chinese-language "PC optimizer" and wallpaper-app binaries in this catalog carry code-signing certificates from four different corporate entities — 成都奇鲁科技有限公司, 北京创想界科技有限公司, 成都盈畅时代文化传播有限公司, and 成都赤侠信息科技有限公司 — and every single one of those certificates chains to the identical issuing authority, "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1." That is not four vendors independently buying trust from the same certificate authority; the detection spread inside each cohort argues…
#codesigningabuse#certificaterotation#Ludashi#PolarWind#PubNubRAT#ChinaMobileAS56047#PUAadware#DigiCerttrustchainActorsFIN6 · Skeleton SpiderIOCf36 · i4 · d1 · u5MITRE28
APTMembersAug 23, 2026, 14:27 (UTC+9)One Static Token Ties Four Rotating DarkHotel C2 Domains Together
An unsigned 2.4MB Windows executable masquerading as an Adobe updater (catalogued as 672c82c1…d26b65ef, and referred to here as the Catch.exe downloader after its internal name) carries a full anti-analysis stack — virtualization and sandbox checks [T1497, T1497.002, T1497.003], debugger evasion [T1622], and code injection into another process's window memory [T1055.011] — before it ever reaches out to command infrastructure.
#DarkHotel#dynamicDNS#C2infrastructure#downloadermalware#anti-analysistechniques#Japantelecomtargeting#codesigningevasion#APT-C-06ActorsDarkHotel · Fallout TeamIOCf1 · i0 · d1 · u19MITRE10RegionsJPIndustriesTelecommunications
APTMembersAug 22, 2026, 22:37 (UTC+9)Same-Second Certificate Reuse Exposes a Templated Provisioning Habit
A self-signed TLS certificate carrying serial number "1" was issued at 2025-09-03 05:55:01 — and only that exact second — on two domains that have nothing else in common on paper: bijibali.com, registered 2023-08-26, and inspiringgemsshop.com, registered 2026-02-11, roughly two and a half years apart. Both certificates share an identical thumbprint and the same placeholder issuer and subject line, "localhost." That is not a coincidence of timing; a certificate minted at one instant cannot…
#SaltySpider#Salityworm#XMRigcryptomining#certificatereuse#self-signedTLS#ProserviceLLCGeorgia#GIFmasquerade#USBautorunActorsSalty Spider · KuKuIOCf18 · i2 · d6 · u31MITRE15RegionsUSIndustriesRetail
APTMembersAug 22, 2026, 14:30 (UTC+9)Signed 'PC Cleaner' DLLs Flagged as PubNubRAT by Sandbox Engine
A system-optimizer bundle marketed under the WinOptimize brand carries two DLLs that a dedicated malware sandbox names as a remote-access trojan called "PubNubRAT" — even though both files are digitally signed and roughly two-thirds of static antivirus engines wave them through as ordinary adware. The privacy.dll component (82c06ae2…f0928) triggers a malicious verdict from the C2AE sandbox, which classifies it outright as a RAT and names PubNubRAT as the payload family; a second DLL from the…
#PubNubRAT#WinOptimize#Ludashiadware#code-signingabuse#ChinaMobileAS56047#sandboxevasion#TA428/ThunderCats#PUA-to-RATpivotActorsTA428 · ThunderCatsIOCf17 · i7 · d2 · u13MITRE24
APTMembersAug 21, 2026, 22:58 (UTC+9)Three Unrelated Trojans Hit in 48 Hours, One Fake Mail Server Behind Them
Between August 10 and August 11, 2026, three completely unrelated pieces of commodity malware surfaced in rapid succession — a JavaScript downloader carrying an Agent Tesla/Etecer label, a RAR-packaged ModiLoader dropper, and a heavily obfuscated JavaScript file tagged Luainj — none of them sharing an import hash, a code signer, or even a threat family name with the others.
#TA505#AgentTesla#ModiLoader#Luainj#trimnt.com#phishinglure#commoditymalware#C2infrastructureActorsTA505 · Hive0065IOCf5 · i1 · d1 · u0RegionsAU · CH · DE · ESIndustriesBusiness Associations · Chemicals · Education & Research
APTMembersAug 19, 2026, 14:40 (UTC+9)Lazarus-Tagged Feed's Only Real Evidence Is a MyDoom-Era Worm
A Windows binary classified as worm.mydoom/emailworm (fdeacb79…) — flagged by 66 of 76 engines and carrying the popular names "mydoom," "emailworm," and "amfu" — is the only file in this record that comes with any forensic detail at all. Of 33 catalogued file hashes tied to the package, 32 are bare values: no type, no size, no detection count, nothing.
#LazarusGroup#MyDoom#emailworm#malwareattribution#threatintelligencefeeds#CDNinfrastructure#falseattribution#dataqualityActorsLazarus Group · Hastati GroupIOCf33 · i10 · d11 · u0RegionsDE
APTMembersAug 19, 2026, 06:34 (UTC+9)One EV Certificate Signs Four Files, Fools Every Sandbox
Four separate binaries — a loader, an updater, a secondary installer, and an MSI payload — all carry the identical Sectigo EV code-signing chain issued to "ORYON TECH LIMITED," and that shared, currently valid certificate is functioning as an active evasion layer rather than a simple trust marker. Static antivirus engines are not fooled: 24 to 44 of roughly 75 to 76 engines flag each file as malicious.
#ORYONTECHLIMITED#EVcode-signingabuse#adwareinstallerchain#microleaves/legionPUPfamily#crackedsoftwarelure#sandboxevasion#domaininfrastructurereuse#pay-per-installActorsPatchwork · ChinastratsIOCf21 · i0 · d6 · u14MITRE49RegionsIN
APTMembersAug 17, 2026, 22:29 (UTC+9)Same Evasion Trick, Same Compiler Run, Tie Five Files Together
Three files in this cluster carry three different VirusTotal threat labels — a clipboard-hijacking banker, a generic dropper, and a DLL flagged for lateral spread — yet all three share the identical pair of behavioural tags: a check for whether a debugger is attached, and a routine that stalls for long periods before doing anything else. That repetition, sitting underneath payloads that otherwise look unrelated, is the more interesting story here than any single malware family.
#APT28#ClipBanker#PowerLoader#sandboxevasion#anti-debugging#CloudFlareOriginCertificate#AS214351#commoditycrimewareActorsAPT28 · StrontiumIOCf54 · i3 · d4 · u4MITRE66RegionsJO · NL · RO · SA
APTMembersAug 16, 2026, 22:28 (UTC+9)Shared Self-Signed TLS Cert Links Bytedance, Zenlayer IPs to VPN Trojans
Four IP addresses that share nothing else in common are running the identical self-signed TLS certificate — two sitting inside Bytedance's US-registered network block, two inside Zenlayer's Philippines allocation on the other side of the Pacific. The certificate carries serial number 1acf3e37b37910d932ea64e6bb27615d6484c07d, with both issuer and subject fields recorded simply as "NONE," and it is valid from March 12, 2024 clear through March 10, 2034 — a ten-year span that is itself unusual for…
#UAC-0063#TAG-110#WireVPN#PBotstealer#BrightDataimpersonation#self-signedcertificate#code-signingabuse#VPNPUAActorsUAC-0063 · TAG-110IOCf36 · i4 · d1 · u0MITRE21
APTMembersAug 16, 2026, 14:29 (UTC+9)Fake VPN Installers Keep Shipping Under Revoked Signing Certificates
Two trojanized VPN and proxy installer families have kept circulating for months after the code-signing certificates behind them were marked revoked or no longer time-valid — a pattern that turns a routine trust-chain failure into an operational feature rather than a bug. One cluster, branded WireVPN, rides a GlobalSign EV certificate issued to WEILAI NETWORK TECHNOLOGY CO., LIMITED; the other, a fake VPN suite calling itself VPNMaster, rides a single DigiCert certificate issued to INNOVATIVE…
#WireVPN#VPNMaster#codesigningabuse#WEILAINETWORKTECHNOLOGY#INNOVATIVECONNECTINGPTE#PEGTECHINC#sandboxevasion#trojanizedVPNinstallersActorsAPT15 · ROYALAPTIOCf17 · i3 · d8 · u2MITRE8IndustriesFood & Beverages
APTMembersAug 15, 2026, 22:30 (UTC+9)Chinese Adware Chain Hides RAT Behind UnionPay-Spoofing TLS Certs
Ten of eleven IP addresses tied to a Chinese adware delivery cluster CTX Team has been mapping sit inside a single autonomous system — AS4837, CHINA UNICOM China169 Backbone — and seven of those ten present an identical .unionpayintl.com wildcard TLS certificate that has nothing to do with UnionPay International's actual payment infrastructure.
#ChinaUnicomAS4837#PubNubRAT#codesigningabuse#TLScertificateimpersonation#UnionPayspoofing#adwaresupplychain#LuDaShiPolarWind#FIN6misattributionActorsFIN6 · Skeleton SpiderIOCf45 · i11 · d3 · u0MITRE14
APTMembersAug 15, 2026, 06:31 (UTC+9)Pirated CCleaner Crack Stalls, Then Digs In For Persistence
A Windows executable disguised as an activation crack for pirated software spends its first minutes on a victim machine doing nothing that looks like an attack at all — reading the CPU timer, checking installed memory, polling the BIOS and USB bus, watching for a debugger. Only once those checks come back clean does it write itself somewhere that survives a reboot.
#AgentTesla#Negasteal#crackedsoftwarelure#anti-sandboxevasion#Cloudflareinfrastructure#pay-per-installloader#Patchwork#APT28ActorsPatchwork · ChinastratsIOCf6 · i0 · d4 · u15MITRE29RegionsAD · AU · BG · BSIndustriesConstruction · Education & Research · Government
APTMembersAug 14, 2026, 14:45 (UTC+9)Fake Payment-Receipt RAR Hides JS Downloader for AgentTesla
A Spanish-language RAR attachment titled "Detalles de los recibos de pago" — payment receipt details — carries a single embedded JavaScript file that a sandbox platform ultimately traces to AgentTesla-class credential theft. What makes this cluster worth a second look is not the lure itself, which is unremarkable, but the mismatch in how security engines treat its two stages: the RAR container is flagged by 13 of 76 engines, while the JavaScript it unpacks into is flagged by 31 of 76 — nearly…
#AgentTesla#ModiLoader#SLoad#TA505#Hive0065#phishing#credentialtheft#NamecheapinfrastructureActorsTA505 · Hive0065IOCf3 · i1 · d1 · u1RegionsAT · CY · DE · EGIndustriesAutomotive · Retail · Support Services
APTMembersAug 13, 2026, 00:05 (UTC+9)Shared Certificate Serial Ties Four Lookalike Domains to One Brazil IP
Four freshly registered domains — zelpx.garden, carogra.biz, tzpx.courses, and fightwa.biz — resolve through the identical authoritative nameserver pair ns1.dyna-ns.net and ns2.dyna-ns.net, despite having been registered across two separate windows nearly three months apart. That single fact, verifiable directly against the WHOIS and DNS records, is the strongest thread running through this indicator set, and it is considerably more solid than anything the accompanying file collection offers.
#Dynadot#Hostinger#Let'sEncryptcertificatespoofing#domainmasquerading#APT28attribution#stealerlogs#Exoduswallet#BrazilhostinginfrastructureActorsAPT28 · StrontiumIOCf32 · i1 · d4 · u4MITRE34RegionsAR · CL · CM · EEIndustriesFood & Beverages
APTMembersAug 12, 2026, 06:37 (UTC+9)A 2020 Loader Stub Still Circulates in Fresh Detections Today
Twenty file indicators tied to Ramsay- and DarkHotel-labeled trojans converge on a single, unmodified compiled artifact: an import-table fingerprint of 34791a1ad0a42b816d48d1d1c182fe7d and a Rich PE header hash of d9068e3808ee41e8c6f32c9fd4e83a79, both frozen to a compile timestamp of 2020-03-04. That exact build keeps resurfacing under new detections as late as December 2025 — five years after it was compiled — wearing four different VirusTotal threat labels along the way.
#DarkHotel#Ramsaytrojan#UACMeUACbypass#reflectiveDLLinjection#imphashreuse#gamelauncherlure#SerbianresidentialIP#espionagemalwareActorsDarkHotel · Fallout TeamIOCf20 · i1 · d0 · u0MITRE11RegionsPHIndustriesTechnology
APTMembersAug 11, 2026, 14:28 (UTC+9)QuasarRAT Toolkit Recompiled for 13 Years Gains a Crypto Clipper
Four newly-flagged Windows binaries tied to a cluster the upstream feed labels LazyScripter share an unbroken thread: the same QuasarRAT-derived toolkit fingerprint, first compiled in 2011 and still shipping in September 2024, with a clipboard-hijacking wallet-swap module now bolted onto the frame. Rather than a fresh malware family, what CTX Team's review of the sample set shows is a chassis — Quasar's remote-access core, wrapped in RDP-wrapper persistence and Vermin/xRAT keylogging code —…
#LazyScripter#QuasarRAT#VenomRAT#xRAT#VerminKeylogger#cryptocurrencyclipper#portmap.iotunneling#RDPWrapperpersistenceActorsLazyScripterIOCf9 · i1 · d1 · u2MITRE30RegionsPT
APTMembersAug 11, 2026, 07:30 (UTC+9)One Certificate, Five Servers, Two ASNs: A Fallback C2 Fingerprint
Five IP addresses scattered across Indonesia, the Philippines, Vietnam, and Malaysia are all answering HTTPS requests with a certificate naming the same subject: *.certfallback.com. That alone would be a modest coincidence — shared wildcard certificates get resold and reused constantly in commodity hosting. What turns it into a diagnostic fingerprint is that four of those five hosts — 128.1.178.192 (Indonesia), 128.1.45.175 (Vietnam), 43.109.107.28 (Malaysia) and 155.102.33.22 (Malaysia) — are…
#certfallback.com#PureLogStealer#DustSquad#APT-C-34#offercorebundler#EVcodesigningabuse#SoutheastAsiainfrastructure#GlobalSigncertificatereuseActorsDustSquad · APTC34IOCf3 · i5 · d1 · u1MITRE5IndustriesTechnology
APTMembersAug 10, 2026, 06:35 (UTC+9)A Decade-Old Adware Builder Wearing an Espionage Label
Four JavaScript files sitting inside a record tagged "apts" and attributed to APT39 turn out, on inspection of their own build fingerprints, to be the same payload repackaged under at least six different Chrome extension identities — a mass-cloning technique straight out of the Crossrider adware playbook, not a nation-state implant.
#APT39#Chafer#Crossrider#adware#browserextensions#Chromeextensions#PUA#threatintelligenceattributionActorsAPT39 · ChaferIOCf20 · i0 · d1 · u3RegionsGB
APTMembersAug 9, 2026, 20:14 (UTC+9)Same Softonic Cert Signs a RustDesk Impostor and a Near-Clean Twin
A Win32 installer signed with the identical Softonic International SA code-signing certificate turns up in two forms with wildly different fortunes: one build draws 31 of 76 antivirus detections and ships under aliases that impersonate RustDesk and Lenovo Vantage, while its cert-mate scores a near-clean 4 of 76 and drew almost no submissions at all.
#RustDeskimpersonation#LenovoVantageimpersonation#Softoniccertificateabuse#code-signingcertificatereuse#adwarebundling#sandboxevasion#CloudFrontinfrastructure#SaltySpiderActorsSalty Spider · KuKuIOCf2 · i0 · d1 · u2MITRE21RegionsAR · BO · BR · CLIndustriesAgriculture · Construction · Education & Research
APTMembersAug 9, 2026, 10:45 (UTC+9)Old RemCom Hacktool Masks a Clean-Scoring WinSW Impostor
A remote-command-execution hacktool compiled on 2012-08-09 is still being resubmitted under randomized filenames as recently as July 2026, flagged by 46 of 75 engines and matched by three named YARA rules — and sitting in the same indicator set is a 16.8-megabyte binary posing as the open-source WinSW Windows Service Wrapper that clears every one of 77 antivirus engines outright.
#RemCom#WinSWimpersonation#lateralmovement#bulletproofhosting#Proton66#Flyservers#njRAT#CactusransomwaregroupActorsCactus · Cactus Ransomware GroupIOCf2 · i13 · d0 · u0MITRE20
APTMembersAug 9, 2026, 01:46 (UTC+9)A Disposable AWS Front and a CDN Wildcard Are the Real Story, Not the File
Two pieces of infrastructure — a beacon domain delegated through Amazon's own nameservers and a CDN-fronted IP wearing someone else's wildcard certificate — carry far more evidential weight in this record than the single file attached to it. The domain, wb.sleevesbarbing.com, resolves through eight rotating A-records behind AWS Route53 delegation and serves six URLs that all follow the identical templated path /mtn/130079/<32-character-hash>.<epoch-timestamp>.000.
#AWSRoute53delegation#CDNwildcardcertificate#AdvancedIPScanner#Famatechcodesigning#Edgenextinfrastructure#telecomsectortargeting#disposableC2domain#expiredcertificatechainActorsLockbit GangIOCf1 · i1 · d1 · u6MITRE4IndustriesTelecommunications
APTMembersAug 8, 2026, 23:04 (UTC+9)Windows Defender-Killer Tool Folded Into XRed RAT Dropper
A commodity tool built to switch off Windows Defender with one click has turned up inside the build of a remote-access-trojan dropper — not dropped alongside it, but sharing the same crowdsourced YARA signature. The standalone hacktool, tracked publicly as DefenderControl and carried in this set as 1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326, and a Synaptics-driver-themed dropper that sandboxing names as the XRed RAT,…
#GorgonGroup#Subaat#XRedRAT#DefenderControl#HongKongtechnologysector#dynamicDNSabuse#masqueradetechnique#espionageActorsGorgon Group · SubaatIOCf15 · i1 · d0 · u0MITRE29RegionsHKIndustriesTechnology
APTMembersAug 8, 2026, 19:30 (UTC+9)Valid Code Signatures Mask PBot Stealer in VPN/Proxy Installers
A Windows installer branded as Bright Data's residential-proxy SDK carries a complete, unbroken DigiCert code-signing chain — and still returns a sandbox verdict naming the PBot stealer classification. Across ten files reviewed by CTX Team, three separate code-signing identities — Bright Data Ltd, WEILAI NETWORK TECHNOLOGY CO., LIMITED, and INNOVATIVE CONNECTING PTE.
#PBotstealer#code-signingabuse#proxyware#BrightData/Luminati#WireVPN#VPNMaster#DigiCert#PUAActorsEmotet Group · TA542IOCf15 · i36 · d51 · u10MITRE22
APTMembersAug 7, 2026, 06:05 (UTC+9)Old Macro-to-PowerShell Emotet Chain Still Fools Every Sandbox
A macro-laced Word document circulating against United States education and research targets is producing a rare thing in modern detection telemetry: unanimous agreement. All three sandboxes that processed the sample — C2AE, ReaQta-Hive, and BitDam ATP — return a "malicious" verdict, and 43 of 75 antivirus engines flag the file outright.
#Emotet#TA542#macromalware#PowerShelldownloader#educationsector#masquerading#Let'sEncryptcertificates#loader-for-hireActorsEmotet Group · TA542IOCf3 · i1 · d2 · u5RegionsUSIndustriesEducation & Research
APTMembersAug 5, 2026, 22:04 (UTC+9)Wizard Spider Kit Adds Stealer-to-Downloader Handoff, C2 Unchanged
The kit CTX Team has tracked under this cluster just picked up a matched pair of new files, and they slot together like a delivery chain missing its middle link. A stealc-tagged dropper — carried under the path %APPDATA%\crkhost.exe and flagged malicious by 55 of 76 engines — and a downloader dressed as a Windows service process, taskhostw.exe (also seen as WinUpdateHelper.exe, 46/76 detections), both first appeared within a 24-hour window in early May and both share a single YARA signature:…
#WizardSpider#Stealc#credentialtheft#vulnerabledriverabuse#hostsfiletampering#certificateimpersonation#AS214351#commandandcontrolinfrastructureActorsWizard Spider · Grim SpiderIOCf5 · i3 · d0 · u6MITRE25RegionsJOIndustriesFood & Beverages
APTMembersAug 5, 2026, 05:34 (UTC+9)Fake YCleaner Hides PowerShell Fetch Loop Behind Spoofed AV Certificate
A "system cleaner" branded YCleaner wraps a multi-stage dropper chain that leans on a spoofed antivirus-vendor certificate and a single PowerShell-invoked downloader signature reused across three separate binaries — and stages its final payload inside a ZIP archive that, as of this writing, zero of 77 scanning engines flag as malicious. The domain feeding the chain, adobehelp.net, carries a nameserver record that contradicts its own WHOIS listing.
#YCleaner#PowerShelldownloader#fakesystemcleaner#BlueBottle#adobehelp.net#code-signingspoofing#encryptedarchiveevasion#MalaysiaActorsBlueBottle · Opera1erIOCf16 · i0 · d1 · u2MITRE29RegionsMY
APTMembersAug 4, 2026, 05:33 (UTC+9)Donot Team Ties Three Domain Clusters via 89-Day Cert Cadence
Five domains, three registrars, three continents' worth of WHOIS geography, and not a single shared owner on paper — yet every one of them carries an identical 89-day Let's Encrypt certificate validity window. That convergence, surfaced across a Thai medical-software vendor's subdomain fleet, an AWS Route53-fronted delivery node registered through a Panama privacy proxy, and a decade-old Japanese domain flagged for compromise, is the strongest signal in this indicator set — stronger, in fact,…
#DonotTeam#APTC35#SectorE02#certificateprovisioning#spearphishing#healthcaretargeting#AWSRoute53abuse#domainhijackingActorsAPTC35 · Donot TeamIOCf7 · i0 · d5 · u15MITRE18IndustriesGovernment · Healthcare · Telecommunications
APTMembersAug 3, 2026, 21:35 (UTC+9)A Builder Stub That Outlived Four Different Malware Labels
Cybercrime taxonomies love clean boundaries — XWorm here, Amadey there, a "msilheracles" trojan somewhere else. But a set of Windows binaries CTX Team has been tracking, tagged in upstream telemetry to APT28-associated activity, shows how thin those labels can be. Four samples that public detection engines classify as four unrelated families — a 2024 XWorm loader, a 2023 Amadey downloader, and two "QCoin"-branded .NET binaries dating back to December 2017 — all carry the exact same import-table…
#APT28#XWorm#Amadey#DarkKomet#XRed#imphashreuse#timestomping#masqueradingActorsAPT28 · StrontiumIOCf35 · i7 · d2 · u6MITRE100
APTMembersAug 3, 2026, 13:34 (UTC+9)Fake reCAPTCHA Lure Tied to Dedicated Host via Certificate Match
A domain calling itself verifyrecapcha.info is not, in fact, a CAPTCHA. It is a phishing front end that mimics the verification interstitial Google uses to separate humans from bots, and it has been flagged by 19 of 91 security engines — a detection band that puts it firmly in known-bad territory even before the infrastructure underneath it is examined.
#Tortilla#phishinginfrastructure#fakereCAPTCHA#TLScertificatepivot#Cloudflarefronting#resellerhosting#espionage#PDR/DirectiASNActorsTortillaIOCf0 · i4 · d2 · u1MITRE10IndustriesArts & Entertainment
APTMembersAug 2, 2026, 21:35 (UTC+9)VPN Trojan Cluster Adds 10 IPs, 6 Domains, No New Malware
The latest pass through this VPN-and-proxy-trojan operation surfaces ten additional IP addresses and six additional domains — and not a single new malicious binary. That lopsided delta is itself the story. While the signed installers that anchor this campaign have sat unchanged for months, the network layer underneath them keeps expanding, and the clearest evidence of that expansion is a single TLS certificate serial, 363a6b88ee219be351b40934, now confirmed live on four separate hosts spread…
#VPNtrojan#proxymalware#certificateabuse#WEILAINETWORKTECHNOLOGY#INNOVATIVECONNECTING#BrightData#China#PhilippinesActorsUAC-0063 · TAG-110IOCf35 · i21 · d15 · u4MITRE21IndustriesTechnology
APTMembersAug 2, 2026, 05:31 (UTC+9)Expired Certificates Keep Signing Trojanized VPN Installers
The most durable piece of tradecraft in this campaign isn't a novel loader or a clever injection technique — it's a pair of Authenticode certificates that have been technically invalid for months and are still being used to sign new builds. Two code-signing identities, WEILAI NETWORK TECHNOLOGY CO., LIMITED (chained through GlobalSign GCC R45 EV CodeSigning CA 2020) and INNOVATIVE CONNECTING PTE.
#code-signingabuse#certificatechainmanipulation#VPNtrojan#WEILAINETWORKTECHNOLOGY#INNOVATIVECONNECTING#Philippinetelecominfrastructure#TLScertificatereuse#supply-chaincompromiseActorsUAC-0063 · TAG-110IOCf74 · i13 · d13 · u3MITRE22IndustriesTechnology
APTMembersAug 1, 2026, 21:36 (UTC+9)Adware Operator Re-Signs Same Stale Build Across Two CAs
A twelve-file Authenticode cohort tied to a Windows browser product called "OneBrowser" shows something unusual for a piece of adware: the operator kept re-signing the same eight-month-old executable under a fresh certificate every time the previous one lapsed. The pattern surfaces in a batch of files carrying the identical certificate serial 0E F9 0B 20 6A 1B 07 82 E0 D0 FD 33 88 24 EC 42, issued under a GoGetSSL G4 CS RSA4096 chain rooted in DigiCert, with Authenticode signing dates falling…
#OneBrowseradware#codesigningabuse#Authenticodecertificatechurn#PUAdistribution#APT28misattribution#WorkProductInc#browserhijacking#threatinteltaggingActorsAPT28 · StrontiumIOCf18 · i0 · d2 · u44MITRE8IndustriesTelecommunications
APTMembersJul 31, 2026, 21:36 (UTC+9)Signed Chinese Input-Method Suite Hides IcedID-Flagged Loader
Four Windows binaries branded as 万能五笔输入法 — a legitimate Chinese Wubi input-method suite — carry an identical Extended Validation code-signing certificate, the same build timestamp, and, in two cases, a payload signature tied to the IcedID malware family, even though the sandboxes that examined them returned a clean verdict. The pairing of trusted EV signing with a static loader-kit fingerprint that slips past dynamic analysis is the sharpest signal in a nine-file, nine-IP cluster CTX Team has…
#APT27#IcedID#code-signingabuse#BYOVD#kerneldriver#CDNimpersonation#China#supplychaintrojanActorsAPT27 · TEMP.HippoIOCf9 · i9 · d0 · u0MITRE11