APTMembersJul 31, 2026, 13:33 (UTC+9)Decade-Spanning Cert Cohort Exposes Cactus's Standing Provisioning Pipeline
Four domains that share nothing else — not a registrar, not a top-level domain, not even a decade of age — converge on the same certificate authority, the same 89-day validity window, and an issuance timeline packed into roughly two months. 5.tipsy.co.za has been registered since 2013; presidencycollege.in surfaced in 2024 and sat dormant until this year.
#Cactus#YR1certificatecohort#Gname.com#DigiCertG4signingchain#PBotstealer#domaingenerationalgorithm#phishingdomainreactivation#telecommunicationssectorActorsCactus · Cactus Ransomware GroupIOCf23 · i3 · d9 · u0IndustriesTelecommunications
APTMembersJul 31, 2026, 05:34 (UTC+9)A Revoked 2014 Certificate Still Signs the Same Adware Family
Four binaries tied to a Windows "PC optimization" installer chain — an EXE, its setup-extraction temp copy, and two helper DLLs — all carry the identical code-signing leaf certificate issued to "PC Utilities Software Limited," serial 00 CF 20 ED FB 9E 9D 56 F4 29 A4 4E 79 C3 46 58 05. That certificate expired in mid-2015 and its chain is now uniformly flagged as either time-invalid or explicitly revoked, yet the signature block is still stamped across every member of the set.
#code-signingcertificateabuse#OptimizerPro#SpeedingUpMyPC#adware/PUP#typosquatting#Snowglobe#Babar#AnimalFarmActorsSnowglobe · Animal FarmIOCf5 · i0 · d3 · u3MITRE44RegionsDE
APTMembersJul 30, 2026, 13:33 (UTC+9)Two Chengdu Shell Certificates Keep an Adware Pipeline Signed for Eight Months
Twelve Win32 binaries pulled from a single indicator set trace back to just two corporate code-signing identities — both registered in Chengdu, both chained to a valid DigiCert Trusted G4 root — and both still actively signing new builds of the same PC-optimizer adware lineage as of June 2026. Rather than a single malicious drop, what emerges is a release pipeline: eight files across two named signer cohorts, installed under at least seven different consumer utility brand names, moving through…
#Ludashiadware#Chinad#code-signingcertificateabuse#Chengdu#DigiCert#PUAdistribution#masquerading#TLScertificatereuseActorsFIN6 · Skeleton SpiderIOCf23 · i7 · d0 · u1MITRE11IndustriesWholesale
APTMembersJul 29, 2026, 14:14 (UTC+9)7-Zip Wrapper Hides Decade-Old KMS Activation Cracker
Four Windows hacktools submitted to detection engines between 2016 and 2019 all trace back to the same cracking-tool lineage — kmsauto, autokms, kmsactivator, hackkms — the commodity ecosystem that has quietly sustained pirated Windows and Office activation for the better part of a decade. The most newsworthy fact in this cluster isn't who built it.
#kmsauto#autokms#kmsactivator#hackkms#masquerading#anti-sandboxevasion#Ratiborus#piratedsoftwareActorsAPT27 · TEMP.HippoIOCf4 · i0 · d0 · u0MITRE16IndustriesAgriculture · Commercial Services · Education & Research
APTMembersJul 29, 2026, 13:35 (UTC+9)Nine-Megabyte SFX Archive Bundles Five Crimeware Families Under Lazarus Label
A 9.8MB self-extracting 7-Zip archive named 7zS.sfx.exe sits at the center of a file set nominally filed under the Lazarus Group label — but the malware riding inside it has nothing to do with bespoke espionage tooling. The archive, submitted alongside a matching overlay-carrying binary called setup_install.exe on 2022-06-05, carries seven named YARA hits, including Windows_API_Function, INDICATOR_EXE_Packed_ASPack, MALWARE_Win_DLInjector03, INDICATOR_EXE_Packed_VMProtect, AutoIT_Compiled, and…
#LazarusGroup#RedlineStealer#SmokeLoader#Socelars#Fabookie#SFXarchivedelivery#commoditycrimeware#credentialtheftActorsLazarus Group · Hastati GroupIOCf20 · i1 · d10 · u10MITRE8RegionsBR
APTMembersJul 29, 2026, 05:36 (UTC+9)Packing, Not Espionage, Explains 2017 'Barium' Adware Cluster
Nine files in this indicator set carry an identical F-PROT packer signature and land at 0/60 to 5/72 on VirusTotal — yet five unpacked DLLs bearing the exact same filenames score 38/77 to 55/77 against the same engine pool. That gap is the actual story here, not a novel exploit or a freshly built implant: it is packing [T1027], cleanly isolated as the mechanism doing the evasion work, while the underlying code stays identical.
#Fireball#Elexadware#PassCV#Barium#packingevasion#CloudFrontabuse#masquerading#commodityadwareActorsBarium · Wicked SpiderIOCf34 · i0 · d8 · u0MITRE44RegionsRO
APTMembersJul 28, 2026, 21:35 (UTC+9)KMS Crack Tool's Twin Binaries Hide Defender-Killer, Konni YARA Hits
Two Windows binaries branded as a routine Microsoft-activation "crack" — one compiled for 32-bit systems, one for 64-bit — share an identical structural hash, reuse the exact same code-signing certificate, and both carry a built-in routine to switch off Windows Defender. That alone would be a tidy defense-evasion case study.
#GamaredonGroup#Konni#WinDivert#code-signingabuse#WindowsDefenderevasion#KMScracktools#UPXpacking#anti-sandboxtechniquesActorsGamaredon Group · CTIGIOCf4 · i0 · d3 · u0MITRE36RegionsAR · BR · CI · COIndustriesConstruction · Consulting · Government
APTMembersJul 28, 2026, 13:34 (UTC+9)Broken 'Not Time Valid' Certificates Still Signing VPN Trojans
Two unrelated commercial code-signing chains — one issued to WEILAI NETWORK TECHNOLOGY CO., LIMITED through GlobalSign's EV pipeline, the other to INNOVATIVE CONNECTING PTE. LIMITED through DigiCert — are each producing a small, active cluster of VPN- and proxy-branded trojans whose leaf certificates carry the identical defect: "This certificate or one of the certificates in the certificate chain is not time valid." Neither cluster has stopped signing because of it.
#code-signingabuse#WireVPN#VPNMaster#BrightData#PBotstealer#proxyware#certificatemisuse#TLSinfrastructureActorsCactus · Cactus Ransomware GroupIOCf48 · i16 · d36 · u8MITRE18
APTMembersJul 26, 2026, 21:34 (UTC+9)15-Year-Old Sality Virus Still Delivering Monero Miners Today
A file-infector that first appeared on antivirus radars in July 2010 is still being submitted for scanning in 2025 — and in the same indicator set, two unrelated cryptomining binaries are dressed up as core Windows processes, one as svcd.exe/vcuia.exe, the other as RuntimeBroker.exe. Nothing about the infrastructure behind this cohort is sophisticated: a single self-signed certificate labeled "localhost," minted in 2011 and still valid until 2038, is the only thread tying a Georgian IP to a…
#Sality#SaltySpider#XMRig#Moneromining#file-infectorworm#Tofsee#retailsector#processmasqueradingActorsSalty Spider · KuKuIOCf26 · i2 · d2 · u11MITRE57RegionsUSIndustriesRetail
APTMembersJul 26, 2026, 13:35 (UTC+9)Recycled Certificates Tie Russian Hosts to a Loader-to-Miner Chain
Two pairs of IP addresses, sitting on two unrelated Russian-registered autonomous systems, are presenting identical TLS certificate serial numbers — a detail that has nothing to do with coincidence and everything to do with shared infrastructure. On AS29182, operated by JSC IOT out of Moscow, addresses 62.109.31.142 and 37.230.117.113 both serve certificate serial 7b670437a77c69583d393d4c, issued by GlobalSign GCC R6 AlphaSSL CA 2025 for the wildcard subject *.imageban.ru — a legitimate-looking…
#VoidArachne#SilverFox#certificatereuse#MSILloader#cryptomining#CobaltStrike#vulnerabledriver#RussianhostinginfrastructureActorsVoid Arachne · Silver FoxIOCf26 · i5 · d3 · u4MITRE15RegionsBR
APTMembersJul 25, 2026, 13:38 (UTC+9)Same Signer, Split Verdict: EarnApp Installer Hides a Stealer
Three Windows installers branded as Bright Data's EarnApp bandwidth-sharing SDK carry an identical Bright Data Ltd/DigiCert code-signing chain — the same signer, the same certificate-authority path, the same product story. Yet one of the three, a build called net_updater32.exe, is classified by sandbox analysis as a STEALER named PBot, while its two signer-siblings return clean verdicts.
#APT28misattribution#EarnApp#BrightData#codesigningabuse#PBotstealer#DGAdomains#PUPdistribution#TLScertificatepivotingActorsAPT28 · StrontiumIOCf10 · i10 · d38 · u8MITRE7IndustriesCommercial Services
APTMembersJul 25, 2026, 05:36 (UTC+9)Fourth Shell-Company Signer Joins Chinese Adware Cert-Farming Pipeline
A Chinese code-signing operation that CTX Team has tracked as a persistent Ludashi/PolarWind adware-bundler pipeline has picked up a fourth disposable signing identity — and, alongside it, a packing technique the earlier builds never used. The signer, 武汉诺沃网络科技有限公司, obtained its certificate from DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 in January 2026 and used it to sign a 4,533 KB binary, instantview_service.exe, that first appeared with a 5/75 detection ratio — by far the…
#Ludashi#PolarWindadware#certificatefarming#DigiCertcodesigning#PubNubRAT#TA428misattribution#PUAbundler#China-basedinfrastructureActorsTA428 · ThunderCatsIOCf18 · i1 · d6 · u9IndustriesTelecommunications
APTMembersJul 24, 2026, 13:32 (UTC+9)Feed Mislabels Chinese Adware Bundle as Lazarus Group Intrusion
An indicator set flowing through commercial threat feeds under a severity rating of 100 and an 85 confidence score comes labeled, at the actor level, with one of the most storied names in offensive cyber operations: Lazarus Group. Cross-reference the actual artifacts against that label, however, and the picture that emerges is not an espionage intrusion set at all.
#LazarusGroupmisattribution#TheWorldadware#Qihoo360#trojan.adload#CDNinfrastructure#falsepositivethreatintel#torpig#ChinaActorsLazarus Group · Hastati GroupIOCf49 · i15 · d0 · u0RegionsCN · MY
APTMembersJul 24, 2026, 05:31 (UTC+9)HijackLoader Hides Behind Real Zalo Code-Signing Certificate
Three days before this cluster surfaced, a file calling itself Zalo.exe carried a fully valid VNG GROUP JSC code-signing certificate — the same signing identity that legitimate builds of Vietnam's dominant chat app use — and only 3 of 75 engines flagged it. CAPE Sandbox and the crowdsourced YARA rule HijackLoaderStub, firing twice on the sample, both independently identified it as HijackLoader, a loader family that has no business hiding behind a trusted Vietnamese software publisher's…
#HijackLoader#codesigningcertificateabuse#Zaloimpersonation#VNGGROUPJSC#TA551#Vietnam#FPTTelecom#certificateserialpivotActorsTA551 · ShathakIOCf6 · i2 · d2 · u9MITRE13
APTMembersJul 23, 2026, 21:33 (UTC+9)Old Emotet Macro Pairs With Barely-Flagged New Infrastructure
A Word document flagged trojan.w97m/emotet doesn't just drop a payload — it stalls first. Sandbox tags on the sample read like a checklist for frustrating automated analysis: auto-open, detect-debug-environment, long-sleeps, calls-wmi. Put together, they describe a VBA macro that fires the instant the document opens [T1204.002], then deliberately pauses and probes its environment for signs of virtualization or debugging before doing anything else [T1497].
#Emotet#TA542#macrodownloader#sandboxevasion#phishing#educationsector#Let'sEncryptcertificates#PowerShelldownloaderActorsEmotet Group · TA542IOCf3 · i1 · d2 · u5RegionsUSIndustriesEducation & Research
APTMembersJul 23, 2026, 05:36 (UTC+9)Snowglobe APT Hides C2 Behind Thai Medical Vendor's Subdomains
Five subdomains of a single Thai domain — meddup, files, donorcheck, labonline and api-notify, all trailing .bmscloud.in.th — resolve to one IP address, 171.103.78.30, and two of them, labonline and api-notify, present the literal same TLS certificate serial number, 514d02f527f0d4cf66ff4701d9104a1f622, for a *.bmscloud.in.th wildcard.
#Snowglobe#AnimalFarm#Sig20#APTespionage#healthcaresectortargeting#TLScertificateabuse#domainmasquerading#ThailandinfrastructureActorsSnowglobe · Animal FarmIOCf7 · i4 · d11 · u1MITRE15IndustriesGovernment · Healthcare · Telecommunications
APTMembersJul 21, 2026, 05:34 (UTC+9)Decade-Old Self-Signed Certificate Ties FIN7 Infrastructure Together
A self-signed TLS certificate stamped "localhost.localdomain" and valid for exactly one year beginning in October 2015 is still doing operational work more than a decade later. Three domains — diamonddollsfitness.com, mastering-the-art-of.com, and lf7blogpro.com — present the byte-identical certificate, serial cfddb89f9d1426ad, and all three resolve to the same IP address, 184.105.192.2.
#FIN7#certificatereuse#beaconinginfrastructure#phishinglure#Cloudflareabuse#command-and-control#sinkholeddomains#invoicemalwareActorsFIN7 · Gold NiagaraIOCf2 · i0 · d4 · u8MITRE21
APTMembersJul 18, 2026, 13:35 (UTC+9)Proxyware Family Resigned Four Times to Dodge Detection
A ninety-file cluster now under review shows a builder rebuilding and re-signing the same proxyware binary at least four times between July 2025 and March 2026, watching its own detection ratio slide from 22 out of 75 engines down to 8 out of 76 as each new build shipped. The four samples — carrying the meaningful name net_updater.exe and the internal product tag "Bright SDK" — share a single import-table hash, a4383347bad6319cb6d1cefa3c6272d8, and near-identical vhash fingerprints, yet each…
#BrightData#codesigningabuse#proxyware#PBotstealer#WireVpnPc#certificaterotation#VPNtrojan#attributionmismatchActorsCactus · Cactus Ransomware GroupIOCf89 · i14 · d36 · u8MITRE17
APTMembersJul 17, 2026, 05:32 (UTC+9)Valid NordVPN Certificate Masks Signed Dropper, Zero AV Hits
A single Win32 executable sits at the center of this campaign, and its most interesting property is not what it does but what it is trusted to do. The file carries a fully valid GlobalSign EV code-signing chain — "nordvpn s.a.," chained through GlobalSign GCC R45 EV CodeSigning CA 2020 up to GlobalSign Root CA - R3 — with a signing date of July 13, 2026 and a product string reading "NordVPN," version 8.7.2.0. Every certificate in that chain shows a "Valid" status.
#code-signingabuse#GlobalSignEVcertificate#Proton66#NordVPNmasquerade#CommentCrew#APT1#CDNimpersonation#engineeringsectorespionageActorsComment Crew · Byzantine CandorIOCf1 · i4 · d1 · u6MITRE5IndustriesEngineering
APTMembersJul 15, 2026, 21:37 (UTC+9)KMSpico Crack Kit Adds Cryptominer, Clipper on Same Old Rail
The latest sweep of Salty Spider's long-running KMSpico/AutoKMS distribution cluster turned up 19 new file hashes and four new URL variants — and not a single new IP address or domain. That lopsided delta is itself the story: the operators behind this pirated-Windows-activation funnel have left their hosting fabric completely untouched while quietly expanding what the funnel actually delivers.
#SaltySpider#KMSpico#AutoKMS#XMRig#clippermalware#cryptojacking#ZettaHostingSolutions#softwarepiracyActorsSalty Spider · KuKuIOCf33 · i3 · d4 · u33MITRE12IndustriesHealthcare
APTMembersJul 15, 2026, 13:37 (UTC+9)Six-Year-Old Domain, Faked Autodiscover Cert Outshine Blank File Hashes
Three subdomains carved out of a Thai medical-software vendor's own domain zone, a Singapore-hosted IP wearing a certificate that borrows another hosting provider's name, and a six-year-old Chinese-registered domain freshly reissued with a GoDaddy certificate — together these form the only legible signal in a record that otherwise offers almost nothing.
#bmscloud.in.thcluster#A2Hostingcertificatemasquerade#xsbl.netdomainreuse#APT28#DonotTeam#APT15Ke3chang#healthcaresectortargeting#TLScertificateabuseActorsAPT28 · StrontiumIOCf16 · i3 · d4 · u0MITRE29IndustriesGovernment · Healthcare · Telecommunications
APTMembersJul 14, 2026, 22:23 (UTC+9)25-Year-Old Domain Shares Name Servers With Fresh Emotet Asset
Two domains registered nearly a quarter-century apart are pointed at an identical set of authoritative name servers — a provisioning fingerprint that says more about this campaign's operators than any single payload does. quasi-monkey.com, registered through Porkbun LLC on 2000-09-11 and sitting on the internet for more than 9,400 days, and andysresume.info, registered on 2025-02-03, both delegate to the same four Porkbun infrastructure hosts: curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com,…
#Emotet#TA542#nameserverdelegation#Let'sEncryptcertificateabuse#IBANphishinglure#macrodownloader#infrastructurefingerprinting#financesectortargetingActorsEmotet Group · TA542IOCf3 · i2 · d3 · u4RegionsDEIndustriesTechnology
APTMembersJul 14, 2026, 14:11 (UTC+9)17 IPs, Three Budget Hosts, No Hardened C2 Behind KMS Lure
The indicator set built around a pirated Windows-activation script doesn't resolve into a single hardened command post — it resolves into three separate landlords. Cross-referencing the 17 IP addresses tied to this record turns up three matched pairs, each pair sitting on the identical autonomous system: 195.3.220.103 and 109.205.211.94 both answer from AS201814, registered to MEVSPACE sp.
#APT40#Gozi#KMSactivatorlure#sandboxevasion#VPSinfrastructure#certificatemisconfiguration#trojan.powershell/abtrojan#threatattributionActorsAPT40 · MudcarpIOCf1 · i17 · d0 · u0MITRE4IndustriesTechnology
APTMembersJul 14, 2026, 13:34 (UTC+9)Two Adware Families Share One GlobalSign EV Cert Chain
Two commodity adware installers with nothing else in common — different file types, different packers, different threat labels, submitted sixteen months apart — chain to the exact same GlobalSign intermediate certificate. That single overlap, buried inside a feed-tagged "APT28" cluster, turns out to be the most concrete, independently verifiable signal in the entire dataset, and it has nothing to do with espionage tradecraft.
#APT28misattribution#adware#MediaArena#ByteMediaBrowserAssistant#EVcodesigningcertificate#GlobalSign#redirectgateinfrastructure#PUPmonetizationActorsAPT28 · StrontiumIOCf13 · i0 · d6 · u6MITRE24IndustriesNon-Profit
APTMembersJul 12, 2026, 21:35 (UTC+9)APT15-Linked Set Shows Three-Tier, Cert-Rotated Hosting Discipline
Four subdomains — meddup.bmscloud.in.th, api.notify.bmscloud.in.th, donorcheck.bmscloud.in.th, and moph-phr.bmscloud.in.th — all live inside the same legitimate-looking DNS zone, bmscloud.in.th, registered through the Thai registrar THNIC to Bangkok Medical Software Co., Ltd. Three of the four resolve to the identical IP, 171.103.78.30, and the cohort as a whole shares one registrar across all four names — the kind of single-administrative-point pattern that tells an analyst these are…
#APT15#Ke3chang#Mirage#healthcaretargeting#governmenttargeting#Thailand#TLSinfrastructure#certificaterotationActorsAPT15 · ROYALAPTIOCf9 · i3 · d10 · u1MITRE9IndustriesGovernment · Healthcare · Telecommunications
APTMembersJul 12, 2026, 13:35 (UTC+9)Seven Fake FIFA Job Portals Share One Registrar, One Certificate
Seven lookalike domains built around FIFA hiring and career themes — fifa-careerhub.com, fifa-hr.com, jobs-fifa.com, fifa-careerpath.com, fifa-hiring.com, fifa-careerportal.com, and fifahiring.com — sit behind a single automated registration pipeline. Six of the seven were registered through Name.com, Inc., resolve to the identical A-record 91.195.240.94, share all four name.com nameservers (ns1kpv, ns2kry, ns3jmt, ns4dmx), and were issued near-identical certificates from DigiCert's "Encryption…
#TA505#FIFArecruitmentphishing#VBScriptdownloader#domainfactory#OmegatechLTD#AS202412#DigiCertcertificateabuse#bulletproofhostingActorsTA505 · Hive0065IOCf48 · i5 · d8 · u2MITRE17
APTMembersJul 11, 2026, 22:06 (UTC+9)Old and New Certificates Both Fool Antivirus in Same Cluster
A 2012-era remote-access tool still clears the majority of antivirus engines on the strength of a VeriSign signature that has technically expired but still chains to a valid root — while, on the other end of the trust spectrum, a binary carrying a fully current DigiCert code-signing chain issued this March slips past most detection under a stealer classification.
#code-signingabuse#FlawedAmmyy#PBotstealer#BrightData#SaltySpider#CDN-frontedC2#certificatetrust#T1553.002ActorsSalty Spider · KuKuIOCf26 · i3 · d8 · u0MITRE13IndustriesConstruction · Containers & Packaging · Education & Research
APTMembersJul 11, 2026, 05:33 (UTC+9)Expired Certificate, Still Trusted: A Bundler Wearing Four Disguises
A single Win32 binary circulating under the guise of at least four unrelated software titles — Resource Hacker, the XMEye video-surveillance client, the KeyTweak keyboard remapper, and the log viewer glogg — carries a code-signing chain that keeps presenting as "Signed" to Windows even though its own leaf certificate has expired.
#code-signingabuse#adwarebundler#sandboxevasion#APT28#APT15#crypto-faucetscam#Servers.comhosting#threatintelattributionActorsAPT28 · StrontiumIOCf12 · i3 · d4 · u2MITRE10IndustriesEnergy
APTMembersJul 10, 2026, 19:48 (UTC+9)World Cup Streaming Lures Tie Four Registrars to One Operator
Four landing pages captured in a single infrastructure snapshot all promise the same thing: a live stream of a 2026 FIFA World Cup match. The URLs — watchme.mom/9813/0/fifa/4, sportxlive.sbs/2562/0/soccer%20ss/19, nowstreams.top/player.php/iran-vs-new-zealand-fifa-world-cup-football, and foxtrend.click/event/wc-2026-iran-vs-new-zealand-m — sit on four domains registered through four different registrars, at four different points between February and May 2026.
#LazarusGroup#torpig#WorldCuplure#phishingdomains#Let'sEncryptcertificates#Cloudflarefronting#Namecheapsharedhosting#spearphishinglinkActorsLazarus Group · Hastati GroupIOCf0 · i2 · d5 · u4MITRE4IndustriesEducation & Research · Utilities
APTMembersJul 10, 2026, 19:27 (UTC+9)Expired and Valid Code-Signing Certificates Both Fuel VPN Malware
Three code-signing identities — WEILAI NETWORK TECHNOLOGY CO., LIMITED, Bright Data Ltd, and INNOVATIVE CONNECTING PTE. LIMITED — anchor a cluster of VPN and proxy installers now circulating with a shared defect: the certificates behind them have lapsed, and the binaries keep shipping anyway. The most striking case is a single leaf certificate (serial 03 A9 18 8A A5 10 C0 F8 34 34 26 BF), issued to WEILAI NETWORK TECHNOLOGY under a GlobalSign GCC R45 EV CodeSigning chain, that signs three…
#code-signingabuse#PBotstealer#BrightData#VPNtrojan#expiredcertificate#brandimpersonationdomains#supplychaintrustabuse#commoditymalwareActorsEvilnum · DeathStalkerIOCf21 · i22 · d45 · u3MITRE18
APTMembersJul 10, 2026, 08:36 (UTC+9)Fake UnionPay Certificate Ties Together Eighteen IPs on Nine Chinese Carriers
Fifteen of eighteen catalogued IP addresses, scattered across nine distinct Chinese network operators, present the exact same TLS certificate serial — b16a258a252d804ceb0eb5ba860f3e5 — for a subject that has nothing to do with any of them: *.unionpayintl.com, issued by DigiCert Basic OV G2 TLS CN RSA4096 SHA256 2022 CA1 and valid from September 30, 2025 to October 31, 2026.
#UnionPayimpersonation#code-signingabuse#ChineseCDNinfrastructure#adware/PUA#DigiCertcertificatemill#PubNubRAT#ChinaUnicomAS4837#threatattributionmismatchActorsFIN6 · Skeleton SpiderIOCf84 · i25 · d2 · u1MITRE29
APTMembersJul 10, 2026, 02:42 (UTC+9)Shared Import Table Ties Four AD Attack Tools to One Build Pipeline
A single .NET import-table fingerprint — imphash f34d5f2d4577ed6d9ceec516c1f5a744 — turns up on eight separate files carrying four different public tool identities: SharpHound, Certify, Rubeus, DefenderCheck, and an unlabeled dropper masquerading as RandomName.exe. None of these tools were written by the same author, and none share a codebase.
#SharpHound#Mimikatz#Rubeus#Certify#SafetyKatz#ActiveDirectory#credentialtheft#buildprovenanceActorsSandworm · QuedaghIOCf106 · i0 · d2 · u18MITRE22
APTMembersJul 9, 2026, 18:41 (UTC+9)Packed svchost.exe Dropper Reveals Tor C2 Inside Sparse APT Feed
A single UPX-packed binary sitting inside an otherwise thin indicator set shows a strikingly complete tradecraft arc — from disguised execution through anti-analysis packing to discovery and an anonymized command channel — even though the wider record around it barely holds together. The sample, a 7-megabyte Win32 executable that VirusTotal engines label trojan.dekimine, installs itself as %APPDATA%\pwo6\svchost.exe, borrowing the name of a core Windows process while stashing alternate copies…
#APT-C-35#DonotTeam#trojan.dekimine#UPXpacking#masquerading#TorC2#WMIdiscovery#AkamaicertificatemismatchActorsAPTC35 · Donot TeamIOCf58 · i3 · d0 · u1RegionsPL
APTMembersJul 9, 2026, 10:43 (UTC+9)JScript Downloader Checks Its Own IP Before Calling Home
An unsigned UTF-16 JScript file, submitted four times from three separate sources on the same day, spends its opening moments doing something most invoice-lure malware skips: it pauses, checks whether it is being watched, and looks up its own public IP address before doing anything else. That combination — deliberate sleep cycles tagged internally as "long-sleeps" and "idle," paired with an external-IP self-check against checkip.dyndns.org and reallyfreegeoip.org — is the most concrete and…
#Rockloader#TA505#JScriptdownloader#sandboxevasion#invoicelure#self-signedcertificate#VPSinfrastructure#SSLblocklistActorsTA505 · Hive0065IOCf2 · i1 · d0 · u2RegionsBD · DE · ES · FRIndustriesCommercial Services · Construction · Containers & Packaging
APTMembersJul 8, 2026, 11:18 (UTC+9)Fake Filmora Crack Installer Uses PPI-Style Builder Backend, Tied to APT28
A file calling itself "Wondershare Filmora.exe" — bundled inside a folder path reading "Wondershare Filmora v15.2.5.17803 (x64) Crack 2026 New" — is not a video editor. It is a Nullsoft Installer self-extracting archive that 37 of 75 antivirus engines flag as a trojan downloader, distributed through three Cloudflare-fronted .info domains that carry matching wildcard-SAN TLS certificates and, in one case, an on-demand builder endpoint that mints a fresh installer binary for every click.
#APT28#FancyBear#NSISinstaller#pay-per-install#crackedsoftwarelure#healthcaresector#Cloudflareinfrastructure#wildcardTLScertificateActorsAPT28 · StrontiumIOCf3 · i0 · d3 · u12MITRE23RegionsFR · GR · IT · LKIndustriesHealthcare
APTMembersJul 7, 2026, 10:44 (UTC+9)Sality-Linked Miner Cluster Shares Temp Staging, Not Build Code
Two XMRig-derived cryptomining binaries flagged in the same indicator set carry the identical classification tokens "malxmr" and "smcgr26" — yet their import-table hashes and vhash fingerprints have nothing in common, meaning they were never compiled from the same source tree. What does tie the cluster together is a staging habit: a config file, a miner executable, and an unidentified data blob all drop into randomized six-character hex subfolders inside %TEMP%, a loader convention that…
#SaltySpider#Sality#XMRig#cryptojacking#Romania#Akamaiimpersonation#processmasquerading#commoditymalwareActorsSalty Spider · KuKuIOCf6 · i2 · d1 · u1MITRE32RegionsUSIndustriesRetail
APTMembersJul 6, 2026, 18:48 (UTC+9)Stealer Hosting Cluster Grows: Two New IPs, Panels Span Two Providers
Two IP addresses — 196.251.107.104 and 196.251.107.130 — have just joined a five-node hosting cluster sitting on AS214351, registered to Femo IT Solutions Limited, a UK-listed shell address at 71-75 Shelton Street in London's Covent Garden. Both are new since CTX Team's earlier coverage of a StealC v2 campaign built around Chrome credential-store bypass tooling.
#StealCv2#RedLineStealer#Amadey#Carberp#clipboardhijacker#bulletproofhosting#APT28attribution#TLScertificateabuseActorsAPT28 · StrontiumIOCf8 · i7 · d0 · u15MITRE28RegionsJO
APTMembersJul 1, 2026, 21:58 (UTC+9)TA505 Deploys Formbook via JS Dropper and Wildcard C2 in 35-Country Sweep
A seven-kilobyte RAR archive carrying a single JavaScript file — named to impersonate a routine trade document — is the opening move in an active credential-harvesting campaign that CTX Team has been tracking since early June 2026. The JavaScript dropper, weighing in at 71 KB and bearing the filename Swift_advise_40k$.js, invokes Windows Management Instrumentation for execution, deliberately stalls to outlast automated sandbox analysis, and then beacons over HTTPS to a disposable C2 domain…
#TA505#Formbook#JavaScriptdropper#WMIexecution#businessemailcompromise#wholesaleandmanufacturing#credentialharvesting#disposableC2infrastructureActorsTA505 · Hive0065IOCf3 · i0 · d1 · u2RegionsAE · AU · BG · CAIndustriesAgriculture · Government · Hospitality & Leisure
APTMembersJun 30, 2026, 19:33 (UTC+9)Kimsuky's Zero-Import 'svchow.dll' Evades Sandboxes in Espionage Campaign
A 112 KB Windows DLL carrying zero static imports — not a single function name visible in its import table — is circulating as "svchow.dll," a one-character typosquat of the legitimate svchost.dll, planted in the user-writable AppData\Local directory of compromised machines. The payload's combination of dynamic API resolution, debug-environment detection, and long-sleep delays split automated sandbox verdicts cleanly: one engine flagged it as malware, the other returned CLEAN.
#Kimsuky#DPRK#zero-importDLL#typosquatting#sandboxevasion#foodandbeverage#Jordan#espionageActorsKimsuky · Velvet ChollimaIOCf15 · i0 · d1 · u2MITRE26RegionsJOIndustriesFood & Beverages
APTMembersJun 30, 2026, 18:56 (UTC+9)StrongPity Cycles 44 New Files, Keeps Same C2 Domain
Forty-four new file hashes have joined the StrongPity/Patcher toolset tracked against Jordan's food and beverage sector since CTX Team's earlier look at this cluster — yet not one new domain, IP address, or URL appeared alongside them. Forty-three previously catalogued hashes dropped out of the same window. That lopsided arithmetic is the story here: a build pipeline generating and discarding binaries at volume while the delivery and tasking channel behind them sits completely still.
#StrongPity#Patchermalware#APT-C-41#Promethium#Jordan#foodandbeveragesector#command-and-controlinfrastructure#trojanizedinstallerActorsPromethium · StrongPityIOCf78 · i0 · d1 · u3MITRE30RegionsJOIndustriesFood & Beverages
APTPublicJun 29, 2026, 17:09 (UTC+9)TigerRAT's Five-Layer Anti-Analysis Stack Splits Sandbox Verdicts
A 304-kilobyte Windows executable carrying a PE compile timestamp of October 24, 1998 — a date that predates the x86-64 processor architecture the binary actually requires to run — encapsulates the operational philosophy behind the latest TigerRAT sample tied to Silent Chollima (Andariel). The falsified timestamp is not the most sophisticated trick in the sample's arsenal, but it is the most emblematic: every layer of this implant has been deliberately engineered to mislead, delay, or defeat…
#SilentChollima#Andariel#TigerRAT#custompacker#sandboxevasion#C2infrastructure#DPRKthreatactors#defenseandgovernmenttargetingActorsSilent Chollima · AndarielIOCf1 · i1 · d0 · u1MITRE7
APTMembersJun 28, 2026, 17:04 (UTC+9)Emotet's Canadian Campaign Hides Behind Three-Layer Evasion Stack
A 141-kilobyte Word document circulating in phishing email against Canadian targets carries more infrastructure engineering behind it than its modest file size suggests. The malicious document — an Emotet e2 epoch loader first submitted to VirusTotal on 15 October 2020 and still active in this campaign — sits at the front end of a three-layer hosting architecture that combines Cloudflare origin-masking, automated 89-day TLS certificate rotation, and a dedicated command-and-control node…
#Emotet#TA542#MummySpider#Wordmacrodropper#PowerShelldownloader#compromisedWordPressinfrastructure#Canada#CloudflareevasionActorsEmotet Group · TA542IOCf3 · i1 · d3 · u5RegionsCA
APTMembersJun 28, 2026, 16:53 (UTC+9)Decade-Old German Domains Reactivated as Emotet C2 Backbone Targeting Philippines
Six command-and-control domains now active in an Emotet campaign targeting the Philippines share a striking infrastructure characteristic: four of them were registered between 2005 and 2012 through a single German registrar, Cronon GmbH, and have been sitting dormant — or at least benign-facing — for years, accumulating the kind of domain-age legitimacy that reputation-based defences routinely reward with a pass.
#Emotet#TA542#Philippines#CrononGmbH#domainaging#C2infrastructure#macromalware#credentialharvestingActorsEmotet Group · TA542IOCf4 · i0 · d6 · u11RegionsPH
APTMembersJun 28, 2026, 01:25 (UTC+9)Shared Imphash Ties Four 'Different' Stealers to One Builder Stub
Four Windows executables carrying four unrelated antivirus labels — AgentTesla, Bobik, "Reline," and an unnamed loader named pctool.exe — turn out to share the same import-table fingerprint, imphash f34d5f2d4577ed6d9ceec516c1f5a744, and the same PEiD packer signature. That single build lineage is the most durable and reproducible signal in an 18-file, 6-domain cluster CTX Team has been tracking: a commodity builder-and-stub layer that antivirus vendors are classifying as though it produced four…
#RedlineStealer#AgentTesla#Bobik#Socelars#Fabookie#LazarusGroup#pay-per-installdistribution#imphashclusteringActorsLazarus Group · Hastati GroupIOCf18 · i3 · d6 · u17RegionsFR
APTPublicJun 27, 2026, 21:07 (UTC+9)Donot Team Hides Cryptominer Behind Tor C2 and Anti-VM Evasion
A single 7,149-kilobyte Windows executable — packed, obfuscated, and deliberately named to impersonate a core Windows process — encapsulates one of the more analytically provocative payload configurations CTX Team has observed in a recent APTC-35 dataset. The binary, classified as trojan.dekimine and bearing the meaningful installation path %APPDATA%\pwo6\svchost.exe, does not merely steal data or open a remote shell.
#APTC-35#DonotTeam#dekimine#cryptomining#TorC2#sandboxevasion#Poland#UPXpackingActorsAPTC35 · Donot TeamIOCf58 · i1 · d0 · u0MITRE29RegionsPL
APTMembersJun 27, 2026, 16:55 (UTC+9)Seven Hostnames, One Timestamp: Mapping the yazanboss Dynamic-DNS Block
Seven near-identical hostnames — 1yazanboss.no-ip.biz through 6yazanboss.no-ip.biz, plus a bare yazanboss.no-ip.biz — were all created at the exact same second, 2001-11-22T23:09:02Z, under a single Vitalwerks Internet Solutions, LLC / No-IP.com account, with matching admin and billing contacts listed out of Reno, Nevada on every WHOIS record.
#yazanboss#DynamicDNS#No-IP.com#Sality#SaltySpider#USB-autorun#polymorphicpacker#retailsectorActorsSalty Spider · KuKuIOCf6 · i0 · d7 · u0MITRE49RegionsUSIndustriesRetail
APTMembersJun 26, 2026, 20:56 (UTC+9)APT29's 2013 MiniDuke Implant Still Beaconing via Aftermarket Domain in 2026
Sixty-three of 76 antivirus engines correctly identify the 326-kilobyte Windows executable bearing SHA-256 05e4224d4dd4e5fbd381ed33edb5bf847fbc138fbe9f57cb7d1f8fc9fa9a382d as a MiniDuke Stage 3 trojan — yet one of only two sandboxes that processed it returned a 97-percent-confidence verdict of harmless. That split is not a data anomaly. It is the point.
#APT29#MiniDuke#HongKong#sandboxevasion#C2infrastructure#espionage#aftermarketdomain#dynamicanalysisevasionActorsAPT29 · MinidionisIOCf1 · i0 · d1 · u34MITRE12RegionsHK
APTMembersJun 26, 2026, 17:09 (UTC+9)Sims 4 Crack Installer Still Feeds Same CyberGate RAT
Two unsigned Windows executables masquerading as pirated copies of "The Sims 4" — both stamped with the identical PE build timestamp of 2025-03-13, both traced through directory paths reading `setup_TS4.exe and setup_TS4.tmp — sit at the center of a small but instructive campaign that pairs a piracy lure with a fully evasion-aware RAT/keylogger payload. What makes this cluster notable isn't its scale; it's the discipline.
#DustSquad#CyberGate#KeyloggerGeneric#Sims4crackinstaller#dynamicDNSC2#sandboxevasion#telecomsectortargeting#NSISdropperActorsDustSquad · APTC34IOCf10 · i0 · d1 · u1MITRE35RegionsCH · ES · KR · PLIndustriesTelecommunications
APTMembersJun 26, 2026, 09:21 (UTC+9)Cobalt Strike Loader Masks as Crash-Reporter, Hides Behind Default TLS Cert
A loader package built inside a single four-minute window in December 2024 bundles a Windows executable and two DLLs designed to look like ordinary Windows utility software — one impersonating a game-crash reporting library, the other borrowing the name of a print-spooler helper. Once unpacked, the components stall, check for a debugger, and wait for a human to interact with the machine before doing anything else, a staging sequence built specifically to survive automated malware sandboxes.
#CobaltStrike#Barium#Blackfly#PassCV#loadermalware#sandboxevasion#C2infrastructure#espionageActorsBarium · Wicked SpiderIOCf5 · i1 · d0 · u1MITRE32RegionsCHIndustriesSupport Services
APTMembersJun 26, 2026, 01:23 (UTC+9)Decade-Old Keygen Trojan Anchors Multi-Stage Pakistan Espionage Chain
Since CTX Team's earlier coverage of this operation, six new files have surfaced that materially deepen the picture of how the Godzilla Loader and PonyStealer campaign targeting Pakistan actually functions — not just what it delivers, but how it gets there. The new components introduce a second build cluster absent from prior analysis: a batch-script orchestrator, an invalid-signed SOCKS5 proxy tool, a PEiD-packed .NET spreader, and a delivery archive built around a keygen lure that has been…
#GodzillaLoader#PonyStealer#Pakistanespionage#keygentrojan#SOCKS5proxy#credentialtheft#C2infrastructure#spreadermalwareIOCf17 · i0 · d5 · u9MITRE34RegionsPK