C&CPublicJun 26, 2026, 17:36 (UTC+9)Upatre C2 Network Hides in Hungarian and Rural US ISP Space
A 74-kilobyte Windows executable disguised as a scanned business document sits at the centre of a command-and-control network that deliberately avoids the commercial hosting fabric most threat-intelligence feeds are tuned to watch. Both enriched relay nodes in this campaign occupy address space belonging to small, non-commercial internet service providers — one a Hungarian broadband operator in Budapest, the other a rural telephone cooperative in the American Midwest — while three additional C2…
#Upatre#C2infrastructure#spearphishingattachment#foodandbeverages#Italy#regionalISPabuse#downloadermalware#PE32stubIOCf3 · i2 · d0 · u5RegionsITIndustriesFood & Beverages
C&CMembersJun 26, 2026, 17:23 (UTC+9)1997-Timestamped Malware Resurfaces With 2025 C2 Infrastructure
A single unsigned Win32 executable, first submitted to VirusTotal in June 2015 and carrying a PE timestamp deliberately set to October 1997, is appearing alongside command-and-control infrastructure provisioned as recently as December 2025 — a temporal gap of more than a decade that sits at the heart of one of the more analytically interesting evasion puzzles CTX Team has examined this cycle. The payload targets consulting-sector organisations in the United States.
#consultingsector#PEtimestampmanipulation#sandboxevasion#C2infrastructure#indicatorremoval#packedmalware#UnitedStates#debuggerevasionIOCf3 · i2 · d0 · u5MITRE16RegionsUSIndustriesConsulting
APTMembersJun 26, 2026, 17:09 (UTC+9)Sims 4 Crack Installer Still Feeds Same CyberGate RAT
Two unsigned Windows executables masquerading as pirated copies of "The Sims 4" — both stamped with the identical PE build timestamp of 2025-03-13, both traced through directory paths reading `setup_TS4.exe and setup_TS4.tmp — sit at the center of a small but instructive campaign that pairs a piracy lure with a fully evasion-aware RAT/keylogger payload. What makes this cluster notable isn't its scale; it's the discipline.
#DustSquad#CyberGate#KeyloggerGeneric#Sims4crackinstaller#dynamicDNSC2#sandboxevasion#telecomsectortargeting#NSISdropperActorsDustSquad · APTC34IOCf10 · i0 · d1 · u1MITRE35RegionsCH · ES · KR · PLIndustriesTelecommunications
FILEMembersJun 26, 2026, 10:15 (UTC+9)A ZIP, a Batch Script, a Fake PDF Previewer: Inside a Staged Malware Chain
A cluster of 24 file indicators submitted between June 1 and June 24, 2026 traces a delivery pattern that looks less like a single tailored intrusion and more like an assembly line: an archive carrying one batch script, a MSIL loader wearing the metadata of a document-preview utility, and a separate stealer sample whose YARA hits span everything from ransomware command detection to crypto-wallet browser extension harvesting.
#AgentTesla#XWorm#commoditymalware#MSILloader#ZIParchivedelivery#browsercredentialtheft#sandboxevasion#builder-kitmalwareIOCf24 · i1 · d0 · u1MITRE38RegionsBR · EG · ES · GBIndustriesAutomotive · Consulting · Education & Research
C&CPublicJun 26, 2026, 09:35 (UTC+9)Cracked-Software Lure Bundles Three RAT Families From One Build Pipeline
A trojanised archive circulating under the name "Onimai 1.7.1" — presented to prospective victims as a cracked copy of a software application — packages three distinct remote-access trojan families into a single deployment bundle, all compiled from what the evidence indicates is a unified .NET build pipeline and routed through the playit.gg public tunnelling service to a self-signed command-and-control node registered in the Seychelles but geolocated in Germany.
#MrThunker#QuasarRAT#XWorm#VenomRAT#cracked-softwarelure#playit.ggtunnelling#FodyCosturapacking#commodityRATIOCf9 · i1 · d0 · u1
APTMembersJun 26, 2026, 09:21 (UTC+9)Cobalt Strike Loader Masks as Crash-Reporter, Hides Behind Default TLS Cert
A loader package built inside a single four-minute window in December 2024 bundles a Windows executable and two DLLs designed to look like ordinary Windows utility software — one impersonating a game-crash reporting library, the other borrowing the name of a print-spooler helper. Once unpacked, the components stall, check for a debugger, and wait for a human to interact with the machine before doing anything else, a staging sequence built specifically to survive automated malware sandboxes.
#CobaltStrike#Barium#Blackfly#PassCV#loadermalware#sandboxevasion#C2infrastructure#espionageActorsBarium · Wicked SpiderIOCf5 · i1 · d0 · u1MITRE32RegionsCHIndustriesSupport Services
FILEMembersJun 26, 2026, 02:43 (UTC+9)EV Certificate Held 13 Months Before Signing Four Malicious Payloads
Four Windows executables and an MSI installer, all bearing a valid Sectigo Extended Validation code-signing certificate issued to a company called "ORYON TECH LIMITED," began circulating through cracked-software distribution channels in April 2026 — but the certificate that makes them look legitimate to Windows SmartScreen and most endpoint defences was acquired more than a year before the first payload ever appeared.
#ORYONTECHLIMITED#Microleaves#Legionadware#LummaStealer#EVcertificateabuse#pay-per-install#sandboxevasion#RomaniaIOCf20 · i1 · d5 · u13MITRE29RegionsSRIndustriesRetail · Telecommunications
APTMembersJun 26, 2026, 01:23 (UTC+9)Decade-Old Keygen Trojan Anchors Multi-Stage Pakistan Espionage Chain
Since CTX Team's earlier coverage of this operation, six new files have surfaced that materially deepen the picture of how the Godzilla Loader and PonyStealer campaign targeting Pakistan actually functions — not just what it delivers, but how it gets there. The new components introduce a second build cluster absent from prior analysis: a batch-script orchestrator, an invalid-signed SOCKS5 proxy tool, a PEiD-packed .NET spreader, and a delivery archive built around a keygen lure that has been…
#GodzillaLoader#PonyStealer#Pakistanespionage#keygentrojan#SOCKS5proxy#credentialtheft#C2infrastructure#spreadermalwareIOCf17 · i0 · d5 · u9MITRE34RegionsPK
FILEMembersJun 25, 2026, 22:43 (UTC+9)Single Obfuscation Builder Links BAT Stager and MSIL Dropper in 19-Country Campaign
An 8-kilobyte DOS batch file and an 85-kilobyte .NET executable — separated by file type, detection rate, and apparent purpose — turn out to share a single obfuscation fingerprint that binds them into a deliberately engineered attack chain. The YARA rule SUSP_PS1_JAB_Pattern_Jun22_1, authored by Florian Roth of Nextron Systems and drawn from the Neo23x0 signature-base, co-fires on both components: the batch stager (SHA-256 02af6b5d…) and the MSIL dropper (SHA-256 d35dbfec…).
#MSILdropper#BATstager#PowerShelldownloader#Bitviseimpersonation#content-typespoofing#sandboxevasion#technologysector#multi-countrycampaignIOCf9 · i0 · d1 · u2MITRE30RegionsAT · BD · CA · CHIndustriesAgriculture · Education & Research · Media
APTMembersJun 25, 2026, 20:56 (UTC+9)EV Certificate Minted for One Campaign Powers Three-Layer Evasion Chain
Thirty-nine days. That is the total operational window separating the moment a Sectigo Extended Validation certificate was issued to an entity called QUANTIS LOGIK LTD and the moment the two PE32 installers it signed first appeared on VirusTotal. The certificate — serial number 00 86 51 B4 B7 A5 AF 08 DF 82 E5 FE 4E 5B 99 A8 18, thumbprint 1080D4CCFE6E5EE372CB3DB8686C37923A932AF5, issued 2026-04-22, used to sign both payloads on 2026-05-19, with the files submitted on 2026-06-01 — was not a…
#LummaStealer#OfferCore#EVcertificateabuse#CloudFrontdomain-fronting#sandboxevasion#LazarusGroup#telecomsector#code-signingabuseActorsLazarus Group · Hastati GroupIOCf2 · i0 · d1 · u0MITRE21RegionsCO · DE · EG · FRIndustriesAgriculture · Support Services · Telecommunications
FILEMembersJun 25, 2026, 18:28 (UTC+9)Salty Spider Hides Expiro in Adobe's Own Sandbox Temp Path
A 60-kilobyte GZIP archive, first submitted to VirusTotal on 22 March 2025, sits at the centre of an evasion architecture that has so far produced zero detections across 78 scanning engines. The file's distinguishing feature is not its contents — those remain opaque without a sandbox verdict — but where it lives: every observed submission path resolves to C:\Users\user\AppData\Local\Temp\acrocef_low\, the low-integrity process temp directory belonging to Adobe Acrobat's Chromium Embedded…
#SaltySpider#Expiro#AdobeAcrobatCEFsandbox#CDNcertificatemasquerade#AkamaiTLSspoofing#DigiRomaniaASN8708#enterpriseendpointevasion#fileinfectorActorsSalty Spider · KuKuIOCf55 · i1 · d0 · u0MITRE29
C&CPublicJun 25, 2026, 17:58 (UTC+9)Finance-Lure VBScript Spoofs CSV Type to Evade Static Scanners
Three new file variants have surfaced in an ongoing Formbook delivery campaign that CTX Team has been tracking since its prior coverage (earlier coverage), and the most significant change is not a new payload family or a fresh infrastructure node — it is a quiet manipulation of file-type metadata. The outer ZIP container drops a VBScript downloader whose file magic is reported as "CSV text" despite carrying a .vbs extension and an uncompressed size of nearly two megabytes, a type-confusion…
#Formbook#VBScript#file-typespoofing#financelure#commodityinfostealer#phishingattachment#C2infrastructure#accounts-payabletargetingIOCf3 · i0 · d1 · u2RegionsBD · BE · CA · CHIndustriesAerospace · Construction · Consulting
C&CMembersJun 25, 2026, 17:35 (UTC+9)One Ukrainian IP, Four One-Letter Payloads, Zero Sandbox Alarms
A 182-kilobyte Windows executable that 63 of 75 static antivirus engines flag as malicious walks through dynamic analysis without triggering a single sandbox alarm. That contradiction — near-universal static detection paired with a 99-confidence CLEAN verdict from Zenbox — sits at the centre of an active Phorpiex-and-GandCrab distribution operation whose entire observable infrastructure collapses to a single Ukrainian IP address, 92.63.197.106, operating under ASN 211736 (FOP Dmytro Nedilskyi).
#Phorpiex#GandCrab#sandboxevasion#single-IPinfrastructure#ransomwaredistribution#Ukraine#wormpropagation#dropperIOCf4 · i1 · d0 · u6MITRE38RegionsCN
FILEMembersJun 25, 2026, 14:18 (UTC+9)Gorgon Group Wraps Commodity Stealers in Four-Layer Evasion Stack
A GZIP archive bearing the filename "RFQ Number QUO19009852.exe" is the outermost layer of a credential-theft operation that CTX Team has been tracking against Windows endpoints. The file is unremarkable at first glance — a compressed archive mimicking a supplier quotation request, the kind of attachment that moves through purchasing inboxes without triggering much suspicion.
#GorgonGroup#ponystealer#predator_pain#PEiDpacking#spear-phishing#credentialtheft#anti-forensictimestamp#procurementlureActorsGorgon Group · SubaatIOCf7 · i0 · d0 · u0MITRE41
FILEMembersJun 25, 2026, 10:07 (UTC+9)LummaStealer Campaign Hides Nine C2 Domains Behind One Server
Nine command-and-control domains provisioned in a single week in December 2025 form the backbone of an active LummaStealer campaign targeting India — and the infrastructure's construction reveals an operator who planned for partial takedown from the outset. Eight of those domains share a single self-signed TLS certificate serial and, in seven cases, a single resolving IP address, meaning the elaborate domain pool amounts to DNS-level wallpaper over one physical server.
#LummaStealer#AutoItdropper#C2infrastructure#India#credentialtheft#self-signedTLS#malware-as-a-service#infrastructurecompartmentalisationIOCf10 · i0 · d9 · u17MITRE31RegionsIN
C&CPublicJun 25, 2026, 05:44 (UTC+9)Purchase-Order VBS Downloader Now Delivers XWorm, Not Formbook
A VBS script disguised with a CSV file signature — the same purchase-order-themed downloader CTX Team tracked in earlier coverage of this delivery chain — now sandboxes to a different terminal payload entirely. Where the prior reporting on this lineage centered on a Formbook loader, the newly submitted sample returns a 3/3 malicious consensus across CAPE Sandbox, Zenbox, and Yomi Hunter, with the sandbox layer explicitly naming the deployed family as XWorm, a commodity remote-access trojan.
#XWorm#Formbook#VBScriptdownloader#purchaseorderlure#basefile.click#KeyAuth#remoteaccesstrojan#phishingIOCf3 · i0 · d1 · u2RegionsAT · AU · BD · CAIndustriesCommercial Services · Education & Research · Government
C&CPublicJun 25, 2026, 01:55 (UTC+9)DCRat Campaign Hides C2 Traffic Behind Fake Google Analytics TLS Cert
A single attacker-controlled domain is currently staging a DCRat remote-access trojan behind a TLS certificate whose subject common name reads *.google-analytics.com — a deliberate impersonation of Google's telemetry infrastructure designed to make outbound C2 traffic appear, to any network sensor performing only certificate-level inspection, as routine analytics beaconing.
#ManicMenagerie#DCRat#TLScertificateimpersonation#Germany#bulletproofhosting#authenticodeevasion#C2infrastructure#packedmalwareActorsManic MenagerieIOCf1 · i1 · d1 · u2RegionsDE
APTPublicJun 24, 2026, 21:30 (UTC+9)TA505 Rockloader C2 Hits SE Asia Finance With Zero Detections
Three command-and-control domains registered within five weeks of each other, scoring zero detections across 91 antivirus engines, with WHOIS identity fields uniformly padded with the same 16-character hex string — this is the operational signature CTX Team has mapped to a TA505-attributed rockloader campaign currently targeting financial-services organisations in Cambodia and Singapore.
#TA505#rockloader#command-and-controlinfrastructure#financialservices#Cambodia#Singapore#DGA#WHOISobfuscationActorsTA505 · Hive0065IOCf9 · i0 · d3 · u0MITRE32RegionsKH · SGIndustriesFinancial Services
C&CMembersJun 24, 2026, 13:54 (UTC+9)Upatre Downloader Returns With Anti-Analysis Stack Shielding FTP C2
Three Windows PE droppers surfaced in CTX Team's feed on June 24, 2026, carrying a threat label that many defenders might dismiss on sight: Upatre, a downloader family old enough to have been circulating when the Czech ISP subnet it now phones home to was first registered. That familiarity is precisely the risk. The current cluster — tracked as CTX4uky7ju34a — pairs the family's well-worn FTP-based payload retrieval with a layered anti-analysis stack that sequences time-based sandbox checks…
#Upatre#FTPC2#anti-analysisevasion#CzechRepublicinfrastructure#downloader#sandboxevasion#securitytooldisablement#post-executioncleanupIOCf3 · i1 · d0 · u4MITRE13
C&CMembersJun 24, 2026, 10:03 (UTC+9)One PHP Path, Four Servers, Ten Years: Inside an APT's C2 Framework
Four IP addresses. One identical endpoint. The string /upload/_dispatch.php — replicated without variation across a quartet of Russian-hosted servers — is the clearest fingerprint CTX Team has extracted from a campaign carrying espionage motivation and APT classification in the threat record. The infrastructure has been operationally maintained from at least mid-2016 through confirmed certificate activity in June 2026, a decade-long window that makes the uniformity of that PHP path all the more…
#APT#C2infrastructure#PHPframework#Turkeyespionage#masquerading#dynamicimportresolution#self-signedcertificate#OPSECfailureIOCf14 · i2 · d11 · u7RegionsTR
APTMembersJun 24, 2026, 01:23 (UTC+9)Fake YCleanner App Delivers LummaStealer After Four-Month Build Campaign
A Windows executable branded as a system-cleaning utility — product name "YCleanner," internal name YC.exe, version 1.3.2.5 — has been circulating as the delivery vehicle for a dual-purpose attack chain combining LummaStealer credential theft with XMRig cryptomining, targeting Romania. The campaign's most operationally distinctive feature is not the payload itself but the architecture surrounding it: an encrypted outer container that achieves a clean sweep of 0/77 antivirus detections at the…
#BlueBottle#LummaStealer#XMRig#Romania#credentialtheft#cryptomining#fakesoftwarelure#Opera1erActorsBlueBottle · Opera1erIOCf16 · i0 · d1 · u1RegionsRO
FILEMembersJun 23, 2026, 22:05 (UTC+9)WZTeam KMS Trojan Stacks Five Evasion Layers Behind 23-Year Cert
##A 23-Year Certificate and Five Stacked Evasion Layers: Inside the WZTeam KMS Trojan Chain Three UPX-packed Windows executables presenting as KMSAuto++ activation tools have been circulating with a self-issued code-signing certificate that carries a validity window stretching to the year 2039 — a deliberate, long-lived signing identity engineered to pass casual inspection at the moment a user decides whether to run a crack.
#WZTeam#KMSAuto#Koadic#PowerShelldownloader#code-signingabuse#Mexico#Philippines#defenseevasionActorsAPT27 · TEMP.HippoIOCf9 · i1 · d0 · u2RegionsMX · PH
C&CPublicJun 23, 2026, 17:22 (UTC+9)SWIFT-Lure ZIP Drops Formbook via 2 MB Sleep-Padded VBScript
A thirteen-kilobyte ZIP file named "Swift-015062026.zip" is circulating across at least 35 countries, carrying a single child file that expands to nearly two megabytes of VBScript — a deliberate size anomaly engineered to exhaust static scanners and outlast the time-boxed execution windows that automated sandboxes rely on. When a recipient opens the archive and runs the enclosed script, they are handing a Formbook infostealer a foothold on their machine, with credentials, keystrokes,…
#Formbook#VBScriptdropper#SWIFT-themedphishing#sandboxevasion#basefile.click#financialservices#infostealer#spear-phishingattachmentIOCf3 · i0 · d1 · u2RegionsAT · BA · BD · BEIndustriesAerospace · Construction · Consulting
C&CMembersJun 23, 2026, 09:22 (UTC+9)WoodyRAT C2 Expands With Ukrainian Node, Traefik Relay, and .biz Domain Pair
Since CTX Team's earlier coverage of this WoodyRAT-attributed infostealer campaign, the operator has not stood still. Fifteen new file indicators and five new domains have entered the observable set, but the most analytically significant additions are structural rather than volumetric: a Ukrainian-hosted C2 node (195.211.191.95, AS208949, Hbing Limited) that bridges into the existing German hosting cluster via a shared operator-generated wildcard certificate, two freshly registered .biz domains…
#WoodyRAT#infostealer#C2infrastructure#cryptocurrencywallettheft#Traefikreverseproxy#bulletproofhosting#Ukraine#TelegramexfiltrationIOCf42 · i4 · d5 · u7MITRE62
FILEMembersJun 23, 2026, 06:07 (UTC+9)Fake uTorrent Installers Pair Valid Code Signing With CDN Impersonation
A cluster of Windows installers dressed up as the BitTorrent and uTorrent clients is circulating alongside a supporting network layer that borrows something rarely seen in commodity adware distribution: wildcard TLS certificates minted for someone else's brand. Three unrelated hosting providers — Digi Romania S.A. (AS8708, Romania), Advania Island ehf (AS50613, Iceland), and a Singapore-registered network called ACE (AS139341) — each present certificates whose subject lines point to major CDN…
#BitTorrent#uTorrent#code-signingcertificate#CDNimpersonation#wildcardTLScertificate#CloudFront#adware#bundlewareinstallerIOCf28 · i4 · d2 · u0MITRE46RegionsBR · CA · CG · CHIndustriesEducation & Research · Technology · Telecommunications
APTMembersJun 23, 2026, 00:58 (UTC+9)Trojanised Adobe Firefly Installer Runs Triple-Monetisation Kill Chain on Construction Firms
Pirated creative software has long been a reliable vector for commodity malware, but a campaign CTX Team has been tracking shows how far that distribution model has matured. Two oversized Windows executables — both named FireflyAI.exe, one weighing 45 MB and the other 53 MB — are circulating as trojanised installers for Adobe's Firefly AI tool, with one sample's embedded path string explicitly referencing "Firefly AI 25.0.0.2265 beta for Adobe Photoshop 24.7 (x64)." The lure has been active…
#PureLogs#WinRing0BYOVD#Nanopool#trojanisedinstaller#constructionsector#credentialtheft#crypto-mining#C2infrastructureActorsAPT28 · StrontiumIOCf21 · i4 · d5 · u4RegionsBR · DE · LUIndustriesConstruction
FILEMembersJun 22, 2026, 18:33 (UTC+9)Revoked 2005 Certificate Still Delivering LSA Credential Stealer in 2026
A Windows executable bearing a webHancer Corporation code-signing certificate — issued by ThawteCode Signing CA, valid only from August 2004 to September 2005, explicitly distrusted, time-invalid, and with revocation status listed as offline — was submitted to threat intelligence platforms as recently as March 6, 2026. That single observation frames everything that follows: a multi-component bundle combining two distinct mid-2000s adware product lines, a versioned auto-update delivery mechanism…
#LSAcredentialdumper#adware-trojanhybrid#revokedcode-signingcertificate#NewDotNet#webHancer#CEDP.Stealer#telecommunicationssector#sandboxevasionIOCf16 · i2 · d2 · u4MITRE43RegionsGB · MXIndustriesTelecommunications
FILEMembersJun 22, 2026, 18:17 (UTC+9)Meteorite Downloader Delivers Azorult and OskiStealer to Media Targets
A Varist-packed dropper self-identifying as "Meteorite Downloader v3.01" has been observed targeting media organisations in Canada, France, and the United States, delivering Azorult and OskiStealer credential-theft payloads through a layered evasion stack that combines timing-based sandbox defeat, three concurrent process-injection sub-techniques, and active suppression of security tooling.
#MeteoriteDownloader#Azorult#OskiStealer#Varistpacker#mediasector#processinjection#credentialtheft#multi-clusterinfrastructureIOCf3 · i0 · d11 · u3MITRE21RegionsCA · FR · USIndustriesMedia
C&CMembersJun 22, 2026, 17:26 (UTC+9)Nine-File Toolchain With Zero PE Imports Targets Six Countries via Dedicated AS
Nine Windows executables, zero PE imports between them, and a dedicated binary whose sole purpose is to kill endpoint defenses before the rest of the payload stack arrives — this is the operational profile of a campaign CTX Team has been tracking since late May 2026, one that pairs an unusually complete evasion architecture with a purpose-built autonomous system that its operator has been quietly expanding for the better part of a year.
#WoodyRAT#BazarLoader#Amadey#ClipBanker#EDRbypass#AS214351#credentialharvesting#reflectiveDLLinjectionIOCf26 · i3 · d5 · u6MITRE66RegionsDZ · ES · ID · IT
FILEMembersJun 21, 2026, 21:17 (UTC+9)Godzilla Loader Campaign Byte-Mutates Five Variants, Exfiltrates India Victim's Documents
Five nearly identical 9-kilobyte Windows executables are circulating as the primary delivery mechanism for a Godzilla Loader campaign whose most operationally revealing detail is not the malware itself — it is the five zero-detection text files sitting in the same dataset, each one a harvested document from a victim's own machine, packaged with a unique victim token and dual collection timestamps from July and August 2024.
#GodzillaLoader#FileGrabber#India#dataexfiltration#bytemutation#C2infrastructure#PE32loader#stealerIOCf12 · i0 · d5 · u6MITRE30RegionsIN
FILEMembersJun 21, 2026, 17:14 (UTC+9)EV-Signed Video Downloader Hides MSSQL Backdoor, Hits Zero AV Detections
Five Windows executables distributed under two consumer software brands — PPTube and iTubeGo YouTube Downloader Pro — arrived on VirusTotal between June 3 and June 6, 2026, each bearing a validly verified Sectigo Extended Validation code-signing certificate issued to an entity called "ByteHub Technology Inc." Every antivirus engine on the platform returned a clean verdict.
#Skip-2.0#MSSQLbackdoor#EVcode-signingabuse#PyArmor#telecommunicationssector#GermanySwedenThailand#ByteHubTechnologyInc#piracy-channeldeliveryIOCf28 · i1 · d2 · u1MITRE8RegionsDE · SE · THIndustriesTelecommunications
C&CMembersJun 21, 2026, 16:41 (UTC+9)Phorpiex Botnet Adds Kernel Driver and Go Wallet Stealer in 2026 Upgrade
A Phorpiex botnet campaign active since early June 2026 has added two capabilities that sit well outside the family's historical playbook: a Bring-Your-Own-Vulnerable-Driver kernel component and a Go-runtime infostealer purpose-built to drain cryptocurrency wallet browser extensions. The combination — mass SMTP propagation, XOR-obfuscated PE droppers, XMRig cryptomining, kernel-driver abuse, and browser-extension credential harvesting, all consolidated on four command-and-control IPs inside a…
#Phorpiex#XMRig#BYOVD#WinRing0#Goinfostealer#cryptocurrencywalletharvesting#AS202412#SpainIOCf15 · i6 · d9 · u5MITRE36RegionsES · UZ
APTMembersJun 21, 2026, 16:13 (UTC+9)Emotet Hijacks Aged German Sites to Evade Detection in PNG Campaign
Four German-hosted websites — three of them registered between 2000 and 2009, all of them delegating DNS through the same Cronon/Strato nameserver infrastructure — are serving as the distribution backbone for an active Emotet campaign targeting the hospitality sector in Papua New Guinea. The cluster, observed by CTX Team between 14 and 21 June 2026, is analytically notable not for the malware it delivers but for the hosting architecture it exploits: rather than spinning up fresh…
#Emotet#TA542#CrononGmbH#rzone.de#hospitalitysector#PapuaNewGuinea#compromisedlegitimatedomains#PowerShelldownloaderActorsEmotet Group · TA542IOCf4 · i1 · d4 · u8RegionsPGIndustriesHospitality & Leisure
C&CMembersJun 21, 2026, 08:25 (UTC+9)37-Node Tox C2 Network Powers Resilient Browser Credential Stealer
A packed Windows credential stealer is communicating with its operators through five numbered Tox-protocol subdomains distributed across two operator-controlled domains — tox1.mf-net.eu through tox4.mf-net.eu and tox.libre.tw — backed by a relay network of 37 IP addresses spanning four distinct ASN cohorts that include FranTech Solutions (AS53667), iFog GmbH (AS34927), Hetzner Online GmbH (AS24940), and M247 Europe SRL (AS9009).
#BrowserStealerGeneric#Toxprotocol#credentialtheft#bulletproofhosting#DNS-over-HTTPSevasion#Let'sEncryptcertificateabuse#FranTechSolutions#WindowsmalwareIOCf1 · i37 · d3 · u5MITRE10
C&CMembersJun 21, 2026, 04:14 (UTC+9)17-Year-Old Kernel Driver Powers 2026 Monero Mining Campaign
A financially motivated campaign active during the week of June 19–20, 2026 is deploying XMRig 6.26.0 Monero miners behind a three-layer evasion stack that most commodity cryptomining operations never bother to assemble: a LOLDrivers-listed vulnerable kernel driver to undermine endpoint defences, a self-signed loader dressed up with a same-day certificate to slip past casual signature checks, and a game-themed NSIS dropper to carry the whole package past users who think they are installing a…
#XMRig#WinRing0x64.sys#BYOVD#Monerocryptomining#LOLDrivers#NSISdropper#maliciouskerneldriver#game-themedlureIOCf53 · i1 · d3 · u0MITRE36
APTMembersJun 21, 2026, 04:00 (UTC+9)Kimsuky Hides Trojan in Npcap Installer With Valid Nmap Certificate
A Nullsoft NSIS self-extracting installer bearing the filename npcap-1.88-oem-usnavy-testcopy-poexcu.exe — signed with a fully valid Nmap Software LLC code-signing certificate and scoring zero detections across 76 antivirus engines — represents one of the more deliberate evasion constructions CTX Team has documented in recent months.
#Kimsuky#GuLoader#Npcap#code-signingabuse#driver-storemasquerading#defencesector#sandboxevasion#AuthenticodeoverlayActorsKimsuky · Velvet ChollimaIOCf33 · i0 · d0 · u0MITRE44
FILEMembersJun 20, 2026, 16:47 (UTC+9)APT28 Cracked-Software Lure Rode 16-Month-Old C2 Infrastructure
A single Windows executable masquerading as five popular pirated applications reached 37 independent submission sources within twelve days of its first appearance — not because the operator rushed the deployment, but because the infrastructure waiting to receive it had been quietly assembled more than a year in advance. The C2 certificate was minted in January 2025. The domains were batch-registered in April 2026. The payload surfaced in June 2026.
#APT28#Trojan.Remus/Wingo#crackedsoftwarelure#stealertrojan#C2infrastructure#sandboxevasion#credentialharvesting#UkrainehostingActorsAPT28 · StrontiumIOCf1 · i1 · d2 · u2MITRE11RegionsBD · BR · CA · CLIndustriesFood & Beverages
FILEMembersJun 20, 2026, 16:33 (UTC+9)LHA Lure Drops PureLog Stealer and XWorm With 0/76 Persistence Layer
A 935-kilobyte ZIP archive named docPO-Q-2606010-ASN _ ZBSPR26-007.PDF(849KB).LHA is circulating as a spearphishing attachment across engineering firms, retail organisations, and telecommunications providers in Bosnia-Herzegovina, Colombia, the Czech Republic, Malaysia, and the United States. The filename is a layered deception: the .LHA extension appended after a fake PDF size annotation is engineered to make the archive read as a harmless purchase-order document to a distracted procurement or…
#PureLogStealer#XWorm#spearphishingattachment#double-extensionlure#.NETReactor#DDNScommand-and-control#engineeringandtelecomsectors#SetupComplete.cmdpersistenceIOCf23 · i3 · d1 · u2MITRE60RegionsBA · CO · CZ · MYIndustriesEngineering · Retail · Telecommunications
APTMembersJun 20, 2026, 16:10 (UTC+9)APT28 Hides Trojan in Pirated Software, Spreads via USB Across 22 Countries
A 2,967-kilobyte Windows executable dressed up as "FL Studio 2025 Full Version.exe" is circulating across manufacturing and telecom networks in 22 countries, carrying a layered evasion stack that defeated one of three automated sandboxes outright — and the certificate stapled to it was issued the same day the file first appeared on VirusTotal, minted by a service that signs anything you give it.
#APT28#trojan#USBspreader#piratedsoftwarelure#manufacturing#telecommunications#sandboxevasion#WMIexecutionActorsAPT28 · StrontiumIOCf1 · i1 · d3 · u3MITRE11RegionsAO · AR · AU · BOIndustriesManufacturing · Telecommunications
APTMembersJun 20, 2026, 15:58 (UTC+9)Snowglobe Adds Chrome-Extension Droppers, Leaves cheater.to Untouched
Six new file indicators have joined the record CTX Team has been building around a Cloudflare-fronted domain called cheater.to — and none of them are new domains or IPs. That distribution alone is the story. The most consequential pair in the batch are two files that VirusTotal types as "Google Chrome Extension" containers, complete with the magic string "Google Chrome extension, version 3, XZ compressed, CRC64" — yet whose internal file paths resolve to ordinary Windows executables:…
#Snowglobe#Babar#Vidarstealer#Salatstealer#masqueradingT1036#telecomespionage#cheater.to#CloudflareinfrastructureActorsSnowglobe · Animal FarmIOCf9 · i0 · d1 · u0MITRE43RegionsCZ · LT · SA · TRIndustriesTelecommunications
C&CMembersJun 20, 2026, 08:28 (UTC+9)Nine No-IP Subdomains, One Account: A .NET Trojan C2 Still Active in 2026
A single No-IP dynamic DNS account holds nine sequentially enumerated subdomains — incorrect.no-ip.biz through 8incorrect.no-ip.biz — each configured with 60-second TTL A records pointing to European residential IP addresses, each sharing the same nameserver cluster (NF1 through NF5.NO-IP.COM), and each ready to absorb C2 traffic the moment any sibling is blocked or sinkholed.
#trojan.barys#MSILtrojan#No-IPDDNS#C2infrastructure#dynamicDNSabuse#imphashclustering#EuropeanresidentialIPs#defenseevasionIOCf3 · i2 · d9 · u0MITRE37RegionsFR
C&CMembersJun 20, 2026, 04:26 (UTC+9)Cridex C2 Roster Ties Eight IPs to One Hardcoded URI Path
Eight IP addresses. Five autonomous systems. Four countries. One identical URI path burned into every beacon call. That is the architecture CTX Team documented when it mapped the command-and-control roster attached to a Cridex/Dreidel trojan sample that first appeared on VirusTotal in January 2013 but was re-observed as recently as June 2026.
#Cridex#Dreidel#C2infrastructure#hardcodedURI#compromisedserver#TLScertificateabuse#Canadahosting#PortugalIOCf2 · i4 · d0 · u16MITRE20
FILEMembersJun 19, 2026, 09:13 (UTC+9)Stealc v2 Adds Chrome Encryption Bypass in Two-Stage Stealer Pivot
Twelve new files and a single Spamhaus DROP-listed IP are the visible footprint of a credential-theft operation that has materially retooled since its earlier iteration. Where prior coverage documented a SmokeLoader-based lure with multiple C2 nodes, the campaign now deploys a sequenced SVCStealer loader and Stealc v2 payload — two unsigned 64-bit Windows executables that independently check in to the same raw IPv4 address, 62.60.226.159, hosted under AS214351 (Femo IT Solutions Limited,…
#Stealcv2#SVCStealer#infostealer#Chromeapp-boundencryptionbypass#Exoduswallet#Romania#bullet-proofhosting#two-stageloaderActorsAPT28 · StrontiumIOCf31 · i1 · d0 · u1MITRE42RegionsAU
FILEMembersJun 19, 2026, 08:48 (UTC+9)Gozi Banking Trojan Routes C2 Through Trio of Tor Onion Addresses
Three algorithmically generated Tor v3 hidden-service addresses — each a 56-character base32 string indistinguishable from random noise — are currently routing bot check-ins for an active Gozi banking-trojan campaign tracked by CTX Team as CTXv7povuldk2. The addresses were not registered through any conventional registrar, carry no TLS certificates that could be fingerprinted, and leave no DNS footprint that a sinkhole could intercept.
#Gozi#ISFB#Torhiddenservices#DGA#bankingtrojan#C2infrastructure#compile-after-delivery#datadestructionIOCf24 · i0 · d3 · u1MITRE38
FILEMembersJun 19, 2026, 05:02 (UTC+9)Signed Adware Dropper Hits 39 Countries With 2/76 AV Detections
A trojanised BitComet installer bearing a commercially obtained Sectigo code-signing certificate is circulating across 39 countries, achieving a detection rate of just 2 out of 76 engines on its dropper component — not through novel exploitation or zero-day tradecraft, but through the deliberate layering of a valid certificate chain, sandbox-evasion instrumentation, and AWS CloudFront CDN abuse into what is, on the surface, a routine adware distribution campaign.
#DealPly#Offercore#code-signingabuse#sandboxevasion#adware#Chromeextensionpersistence#CDNabuse#educationsectorIOCf59 · i4 · d1 · u0MITRE48RegionsAL · BG · BR · BSIndustriesEducation & Research · Financial Services · Technology
C&CPublicJun 19, 2026, 04:26 (UTC+9)XWorm RAT Hides Behind Purchase-Order ZIP and Pre-Armed Wildcard Infrastructure
##Purchase-Order ZIP Conceals a Three-Stage XWorm Delivery Chain Built on Pre-Armed Wildcard Infrastructure A compact, eleven-kilobyte ZIP archive named PO-000172483.zip is the opening move in a campaign that unfolds across five deliberate stages — evasion-hardened VBS execution, a stealthy compile-after-delivery intermediate, and XWorm RAT C2 over a Turkish-geolocated IP whose hosting fabric was provisioned weeks before the first malicious file appeared on the internet.
#XWorm#VBSdownloader#compile-after-delivery#purchase-orderlure#wildcardTLSinfrastructure#manufacturing#WhiteLabelServices#multi-stagedeliverychainIOCf9 · i1 · d2 · u3RegionsAT · BD · BR · CHIndustriesAerospace · Agriculture · Automotive
APTMembersJun 19, 2026, 03:56 (UTC+9)Spring Dragon Hides GCleaner in VR Installer With 4-Year-Old Certificate
A Windows executable posing as an HTC VIVE Software installer has surfaced carrying a DigiCert code-signing certificate that expired in April 2021 — more than four years before the file appeared on any scanner — while beaconing to a trio of command-and-control domains registered, TLS-provisioned, and Cloudflare-proxied within a single 72-hour window.
#SpringDragon#GCleaner#wmi_ghost#code-signingcertificateabuse#sandboxevasion#CloudflareC2proxying#HTCVIVElure#pay-per-installloaderActorsSpring Dragon · Lotus BlossomIOCf1 · i0 · d3 · u6MITRE12
FILEPublicJun 19, 2026, 00:42 (UTC+9)YoroTrooper's AveMaria RAT Dropper Stacks Five Evasion Layers Before C2 Contact
Since CTX Team's earlier coverage of a WarzoneRAT cluster targeting Turkish organisations, two new file indicators have surfaced alongside the same Microsoft-themed infrastructure backbone — and the tradecraft picture they reveal is considerably more elaborate than a routine IOC refresh. The primary dropper, a 668-kilobyte Win32 PE32 executable catalogued under SHA-256 69415b18aeb7e75f4843313ed5c65e09b1a2a41d73af0ce7fed40e0f2cc2b0a0, stacks five discrete anti-analysis mechanisms before it ever…
#YoroTrooper#AveMariaRAT#WarzoneRAT#UACbypass#processinjection#sandboxevasion#CentralAsia#typosquatinfrastructureActorsYoroTrooperIOCf2 · i0 · d2 · u0MITRE21
FILEPublicJun 19, 2026, 00:24 (UTC+9)10KB SystemBC Dropper Evades Both Sandboxes in Saudi Telecom Attack
##A 10-Kilobyte Ghost: How a Zero-Import SystemBC Dropper Defeated Every Sandbox Targeting Saudi Telecom A single 10-kilobyte unsigned Windows executable — compact enough to fit inside a typical email attachment header — has been identified in a campaign against telecommunications infrastructure in Saudi Arabia, carrying a technical profile that exposes a deliberate gap in how most enterprise detection pipelines are built.
#DragonForce#SystemBC#Coroxy#sandboxevasion#telecommunications#SaudiArabia#bullet-proofhosting#proxy-RATActorsDragonForce · DragonForce MalaysiaIOCf1 · i1 · d0 · u0MITRE8RegionsSAIndustriesTelecommunications
APTPublicJun 18, 2026, 23:57 (UTC+9)Upatre Dropper Fires CryptoLocker Rules as Decade-Dormant Domain Wakes
A 27-kilobyte Windows executable named case_10022013.exe sits at the centre of a delivery chain that has been quietly circulating since at least October 2013 — and the most analytically striking detail is not its age but its identity crisis. The binary is classified by 66 of 77 antivirus engines as Upatre, the compact downloader long associated with the Gold Evergreen / Business Club criminal ecosystem.
#GoldEvergreen#BusinessClub#Upatre#CryptoLocker#ZBot#legal-lurephishing#long-dormantC2infrastructure#dual-familymalwareActorsGold Evergreen · Business ClubIOCf3 · i0 · d1 · u1MITRE9