FILEPublicJun 18, 2026, 20:29 (UTC+9)AgentTesla Stealer Activates Three-Year-Old Tanzanian Domain in Single Day
On the morning of 2 June 2026, two events occurred in close enough succession to rule out coincidence. At 12:23:47 UTC, a 90-day wildcard TLS certificate was issued by Let's Encrypt — issuer CN=YR1, serial 5fe3baf35c3534571f8e352115b86a4e57b — covering every possible subdomain of hhautoinvestment.co.tz, a Tanzanian-registered domain that had sat dormant since its registration on 24 August 2023.
#AgentTesla#credentialharvesting#processhollowing#FTPexfiltration#ageddomaininfrastructure#manufacturing#healthcare#TanzaniaccTLDIOCf3 · i0 · d1 · u1MITRE47RegionsAE · DE · DK · JPIndustriesArts & Entertainment · Automotive · Business Associations
C&CMembersJun 18, 2026, 20:06 (UTC+9)Phorpiex Clipbanker Uses Six Greek-Letter C2 Endpoints to Steal Crypto
A 103-kilobyte Windows executable named wescgsvcs.exe — crafted to blend visually with legitimate Windows service binaries — has been quietly draining cryptocurrency wallets through one of the more methodical evasion stacks CTX Team has documented in this family class. The binary, confirmed as a Phorpiex/Fragtor trojan with a clipbanker payload, beacons to a single command-and-control server at 185.215.113.84 that exposes exactly six HTTP endpoints named in Greek alphabetical order: alpha,…
#Phorpiex#Fragtor#clipbanker#cryptocurrencytheft#command-and-controlinfrastructure#sandboxevasion#timestomping#clipboardhijackingIOCf4 · i1 · d0 · u7MITRE31
APTMembersJun 18, 2026, 15:58 (UTC+9)Forged 72-Hour Certificates Hid WarzoneRAT From All 76 AV Engines
Seven Windows executables and DLLs, all signed under the name of a legitimate German digital-publishing company, arrived on VirusTotal on 23 May 2026 with a combined static detection score of zero across 76 engines. The files presented themselves as components of "t-online Browser 7," a real product distributed by Ströer Digital Publishing GmbH — complete with version strings, Mozilla Public License 2.0 copyright notices, and Authenticode signatures rooted in Microsoft's own…
#APT28#WarzoneRAT#Winos4.0#Skip-2.0#code-signingabuse#energysector#GermanyFranceLuxembourg#AuthenticodeActorsAPT28 · StrontiumIOCf55 · i0 · d0 · u0MITRE55RegionsDE · FR · LUIndustriesEnergy · Technology · Telecommunications
APTMembersJun 18, 2026, 04:04 (UTC+9)NullMixer Bundle Drops Five Malware Families via Discord Fake Installer
A single Windows executable masquerading as a software setup wizard unpacks at least five distinct malware families the moment a user double-clicks it — RedlineStealer, ClipBanker, SmokeLoader, StealBit, and Upatre arriving as a coordinated bundle rather than a sequential chain. That delivery model, confirmed by the Malpedia YARA rule win_nullmixer_auto firing on two large installer files and by unanimous sandbox verdicts naming four families simultaneously, is the operationally distinctive…
#APT28#NullMixer#RedlineStealer#SmokeLoader#ClipBanker#DiscordCDNabuse#Bolivia#fakeinstallerActorsAPT28 · StrontiumIOCf18 · i3 · d4 · u10RegionsBO
APTMembersJun 17, 2026, 23:57 (UTC+9)DHL-Lure RAR Delivers MassLogger to Construction Firms Across Four Countries
A 946-kilobyte RAR archive named DHL_AWB#6078538091.rar has been circulating since mid-May 2026 as the opening move in a credential-harvesting campaign targeting construction-sector organisations across Germany, India, Malaysia, and Turkey. The archive is not simply a container — it is itself the first evasion layer, carrying explicit debugger-detection and long-sleep logic that caused one major automated analysis platform to return a clean verdict at 96% confidence while a second correctly…
#APT29#MassLogger#Formbook#credentialharvesting#constructionsector#sandboxevasion#spear-phishing#processinjectionActorsAPT29 · MinidionisIOCf3 · i0 · d0 · u0MITRE23RegionsDE · IN · MY · TRIndustriesConstruction
C&CMembersJun 17, 2026, 20:27 (UTC+9)Phorpiex Rotates All Payloads Again as C2 Holds Firm for Ninth Wave
##Phorpiex Swaps Its Entire Payload Stack — Again — While C2 Holds Firm for a Ninth Consecutive Wave Since earlier coverage documented the Phorpiex/Trik operator's discipline of rotating binaries while leaving command-and-control infrastructure untouched, that pattern has completed another full cycle. All three payload files present in this snapshot are new arrivals; all three files from the prior snapshot have been retired.
#Phorpiex#Trik#payloadrotation#sandboxevasion#C2infrastructure#telecommunications#Kazakhstan#PakistanIOCf3 · i2 · d0 · u4MITRE35RegionsKZ · PKIndustriesTelecommunications
APTMembersJun 17, 2026, 20:00 (UTC+9)Salat Stealer Bypasses Chrome v127 Encryption in Capability Leap
A 12-megabyte unsigned Windows executable first observed on 2 May 2026 carries a capability set that goes well beyond what commodity stealers typically offer: a working Chromium app-bound encryption decrypter, a large embedded catalogue of cryptocurrency wallet browser-extension identifiers, and a command-and-control resolution path routed through Cloudflare's DNS-over-HTTPS service to defeat the DNS-layer monitoring that would otherwise expose its infrastructure.
#SalatStealer#Chromiumapp-boundencryptionbypass#DNS-over-HTTPSevasion#credentialtheft#cryptocurrencywalletharvesting#APT28#CloudflareCDNabuse#browsercredentialstoresActorsAPT28 · StrontiumIOCf1 · i2 · d3 · u2MITRE11
APTMembersJun 17, 2026, 13:49 (UTC+9)APT10's 2016 ChChes Implant Runs on C2 Renewed in 2025
A 283-kilobyte Windows executable compiled in November 2016 carries a code-signing certificate that expired more than a decade ago — yet the command-and-control domain it phones home to received a fresh TLS certificate as recently as September 2025. That tension between aged tooling and actively maintained infrastructure is the defining characteristic of a ChChes implant attributed to Red Apollo (APT10) that CTX Team has been tracking since December 2024.
#RedApollo#APT10#ChChes#OperationCloudHopper#code-signingabuse#C2infrastructure#sandboxevasion#espionageActorsRed Apollo · PotassiumIOCf1 · i0 · d1 · u5MITRE13
APTMembersJun 17, 2026, 13:31 (UTC+9)Scripted CKEditor Exploitation Endpoints Surface Across Two Campaign Domains
Four newly documented URLs targeting the CKEditor-for-WordPress plugin across two domains — kartacnictvi.cz and mokawafm.com — now explicitly expose the scripted initial-access mechanism behind a campaign CTX Team has been tracking in connection with a Lazarus Group CRAT implant. Each URL follows the same path structure — wp-content/plugins/ckeditor-for-wordpress/ckeditor/plugins/image/ — and carries a hex-timestamp query parameter: ts=6A4310F7_1897026C, ts=6A431118_12AB12AC,…
#LazarusGroup#CRAT#Nukesped#Zusy#WordPressCKEditor#Jordan#foodandbeverages#initialaccessActorsLazarus Group · Hastati GroupIOCf2 · i2 · d2 · u6MITRE19RegionsJOIndustriesFood & Beverages
FILEMembersJun 17, 2026, 11:08 (UTC+9)Dormant Snapchat Lure Domain Wakes After 13 Months to Serve LummaStealer
A domain registered in April 2025 under the guise of a Snapchat mod APK resource sat completely inactive for thirteen months before its operator flipped a switch in May 2026: a Let's Encrypt TLS certificate was issued, six numbered Windows executables appeared at predictable paths, and a social-engineering notes file went live alongside them.
#LummaStealer#VenomRAT#QuasarRAT#credentialtheft#cryptocurrencywalletharvesting#Canada#Telegramexfiltration#domainagingIOCf9 · i0 · d1 · u8MITRE41RegionsCA
FILEMembersJun 17, 2026, 10:36 (UTC+9)GuLoader Hits EU Healthcare via Danish Temp Folder and Forged 2013 Timestamp
A 673-kilobyte Windows executable with a Polish-language filename — Zamowienie_829522.bat, meaning "Order 829522" — is the entry point for one of the more technically deliberate GuLoader campaigns CTX Team has tracked against European healthcare targets. The file is a Nullsoft Installer self-extracting archive, flagged by 49 of 77 antivirus engines under the label trojan.makoob/nsis, and it arrives carrying a PE timestamp set to Christmas Day 2013 — a date approximately eleven years before the…
#GuLoader#NSISdropper#healthcaresector#Poland#Croatia#JPEGsteganography#cPanelC2infrastructure#ransomwareprecursorIOCf16 · i1 · d2 · u2MITRE19RegionsHR · PLIndustriesHealthcare
APTMembersJun 17, 2026, 10:08 (UTC+9)TA505 Fake Purchase Order Hides JS Payload 70 Engines Cannot See
A spear-phishing campaign attributed to TA505 is circulating a Varist-packed RAR archive named after a fake purchase order — but the real detection problem sits one extraction step deeper: the JavaScript payload inside evades 70 of 76 antivirus engines despite both sandboxes that processed it returning unambiguous malicious verdicts, and despite an Abuse.ch IDS rule already flagging its PureHVNC command-and-control certificate.
#TA505#PureHVNC#JavaScriptdropper#spear-phishing#procurementsector#sandboxevasion#Unicodeobfuscation#dormantdomainreactivationActorsTA505 · Hive0065IOCf2 · i0 · d1 · u2RegionsCY · DE · DK · FRIndustriesRetail · Support Services · Technology
APTMembersJun 17, 2026, 09:42 (UTC+9)XWorm V5.6 Deploys 18-Plugin Suite Behind Azure-Hosted C2 Fleet
A complete, operationally ready XWorm V5.6 toolkit — nineteen files in total, comprising a main RAT executable and eighteen purpose-built plugin DLLs compiled from a single build pipeline — has been observed in active deployment, with the plugin suite spanning hidden VNC access, keylogging, browser credential theft, ransomware, CMSTP-based UAC bypass, and Windows Defender suppression.
#GamaredonGroup#XWorm#HiddenTearransomware#HVNC#CMSTPUACbypass#credentialharvesting#Azureinfrastructureabuse#UkraineActorsGamaredon Group · CTIGIOCf43 · i0 · d9 · u18MITRE37RegionsBD · DE · GB · IN
C&CMembersJun 17, 2026, 08:34 (UTC+9)Stealc v2 Bypasses Chrome 127 Encryption in Crypto-Theft Campaign
A financially motivated operator has deployed a multi-stage credential-theft campaign built around two Stealc v2 payloads that implement a post-Chrome-127 app-bound encryption key decryptor — a deliberate capability upgrade that allows the malware to extract browser-stored credentials from modern Chrome profiles that earlier Stealc variants and most competing infostealers cannot reach.
#Stealcv2#DiamotrixClipper#Chromiumapp-boundencryptionbypass#reflectiveDLLinjection#clipbanker#bulletproofhosting#cryptocurrencytheft#infostealerIOCf11 · i5 · d0 · u10MITRE51RegionsCA
C&CMembersJun 17, 2026, 08:03 (UTC+9)Sality Botnet Hides C2 Traffic in GIF Requests Across Italian and Polish Hosts
Twenty-four HTTP GET requests. Two geographically disparate web servers. One 5-kilobyte image file. On the surface, a routine web browser fetching a logo. Underneath, an active Sality botnet cluster routing encrypted bot check-ins through parameterised image requests to compromised shared-hosting accounts in Italy and Poland — a beaconing architecture that has been generating fresh C2 traffic into mid-2026 from a core payload first submitted to VirusTotal in July 2010.
#Sality#SaltySpider#C2infrastructure#sharedhostingabuse#GIFsteganography#USBpropagation#Bangladesh#TofseeActorsSalty Spider · KuKuIOCf24 · i2 · d2 · u24RegionsBD
FILEMembersJun 15, 2026, 11:35 (UTC+9)WinosStager Loader Hides Behind Chrome, Routes All C2 Through Tor
A 66,879-kilobyte Windows executable dressed as Google Chrome is circulating across chemicals, consulting, government, and manufacturing organisations in ten countries — and every byte of its command-and-control traffic flows exclusively through the Tor anonymity network to algorithmically generated .onion hidden services, leaving no clearnet address for network defenders to block, sinkhole, or pivot from.
#WinosStager#CleverSoar#TorC2#Chromeimpersonation#compile-on-host#manufacturing#government#Skip-2.0IOCf23 · i0 · d2 · u0MITRE51RegionsGU · IN · IT · MYIndustriesChemicals · Consulting · Government
FILEPublicJun 15, 2026, 11:19 (UTC+9)APT1 Freeware Lure Still Active 12 Years On, Live Cert Reveals
A 527-kilobyte Windows executable presents itself to the world as a routine archiving utility. Its internal product string reads "B1 Free Archiver Installer," its filename circulates as B1FreeArchiver_1.4.68.exe, and its copyright notice is dated 2013. None of that is what it is. Forty-three of 77 antivirus engines classify the binary as adware.catalina/downware — a trojanised installer that bundles unwanted payloads under a recognisable freeware brand — and three concurrent IDS rules confirm…
#CommentCrew#APT1#adware.catalina#freewaremasquerading#content-typespoofing#educationsector#SouthAsia#glassesmalwarefamilyActorsComment Crew · Byzantine CandorIOCf4 · i1 · d0 · u0MITRE25RegionsSAIndustriesEducation & Research
APTMembersJun 15, 2026, 10:27 (UTC+9)BlueBottle Hides Cryptominer in Fake FileZilla Update Targeting DRC
A typosquatted domain impersonating the FileZilla FTP client is serving a two-stage dropper-binder chain to targets in the Democratic Republic of Congo — an operation that pairs brand-impersonation lures with layered sandbox evasion baked into every executable stage, while beaconing to the hashvault.pro cryptomining pool over a CoinMiner JA3 TLS fingerprint.
#BlueBottle#Opera1er#BitRAT#cryptomining#DemocraticRepublicofCongo#typosquatting#sandboxevasion#FileZillaimpersonationActorsBlueBottle · Opera1erIOCf4 · i1 · d1 · u2MITRE18RegionsCD
APTMembersJun 15, 2026, 10:15 (UTC+9)TA511 Bundle Deploys StealC v2 With Chrome Encryption Bypass via Single German AS
##A Four-Family Payload Bundle Targets Browser Credentials and Crypto Wallets From a Single German Hosting Fabric A coordinated malware campaign deploying Amadey, StealC v2, LummaC2, and ClipBanker as a unified payload bundle has concentrated every observed command-and-control endpoint inside a single autonomous system — AS214351, operated by Femo It Solutions Limited — a RIPE NCC-registered provider that came into existence in October 2024 and whose IP space spans just two /24 subnets…
#TA511#StealCv2#Amadey#ClipBanker#AS214351#Chromiumapp-boundencryptionbypass#credentialtheft#cryptocurrencyhijackingActorsTA511 · MAN1IOCf33 · i3 · d0 · u6RegionsCLIndustriesTechnology
C&CMembersJun 14, 2026, 22:59 (UTC+9)Emotet C2 Hides Behind WordPress Paths on Aged Compromised Domains
Two compromised websites — one a Turkish-language platform, the other a social media aggregator — are currently serving as active command-and-control relay nodes for an Emotet campaign cluster, with their WordPress administrative and content directories repurposed as beaconing endpoints. The infrastructure fingerprint CTX Team has documented is precise: dotasarim.com/wp-admin/Dyz and socialplaymedia.com/wp-content/Czj function as the actual C2 URLs, their paths indistinguishable at a glance…
#Emotet#Emotetepoch2#TA542#WordPressC2#command-and-controlinfrastructure#macro-enabledlure#TimewebASN9123#compromisedwebsitesActorsEmotet Group · TA542IOCf3 · i1 · d2 · u4
APTMembersJun 14, 2026, 22:29 (UTC+9)KMSpico Campaign Adds 9 Variants, Core Four-Layer Evasion Stack Unchanged
Nine new file indicators have surfaced in the Molerats-attributed KMSpico campaign since CTX Team's earlier coverage, expanding the known file set to 17 samples — yet not a single new network indicator has emerged alongside them. The delta is entirely on the file side, and the pattern shows an operator iterating the outer delivery shell while leaving the campaign's most distinctive technical architecture completely intact: a four-layer evasion stack built around a self-issued certificate…
#Molerats#KMSpico#Formbook#WinDivert#Dotfuscator#code-signingabuse#technologysector#MalaysiaActorsMolerats · Gaza CybergangIOCf17 · i0 · d0 · u0MITRE19RegionsMYIndustriesTechnology
FILEPublicJun 14, 2026, 19:07 (UTC+9)Trojanized Black Myth: Wukong Launcher Delivers Rancor Trojan to Thai Users
A 457-kilobyte Windows executable named "Launcher Black Myth Wukong.exe" is circulating in Thailand, masquerading as the Steam launcher for one of 2024's most widely played game titles — and carrying a Rancor-family trojan payload that 52 of 76 antivirus engines now flag as malicious while the Zenbox sandbox returns a clean verdict at 98% confidence. The gap between those two numbers is the story: the operators behind this campaign did not rely on a single evasion trick.
#Snowglobe#AnimalFarm#Rancor#Babar#Thailand#gaminglure#sandboxevasion#espionageActorsSnowglobe · Animal FarmIOCf3 · i0 · d1 · u0MITRE21RegionsTH
FILEPublicJun 14, 2026, 14:58 (UTC+9)Dual-Certificate PCHunter Stack Hits Finance and Telecom Across 14 Nations
A VMProtect-packed, DigiCert EV-signed executable and a Microsoft WHQL-cross-signed kernel driver — both components of the PCHunter Windows inspection utility, both carrying certificates that expired years ago but were valid at the moment of signing — are circulating in active operations against financial services, technology, and telecommunications organisations across fourteen countries.
#PCHunter#RoyalRansomware#WHQLdriverabuse#VMProtect#kernel-modedriver#financialservices#code-signingevasion#espionageActorsRoyal Ransomware · Team OneIOCf3 · i0 · d0 · u0MITRE25RegionsAT · CA · CL · CNIndustriesFinancial Services · Technology · Telecommunications
C&CPublicJun 14, 2026, 14:39 (UTC+9)Phorpiex Worm's Three-Layer Evasion Stack Keeps 20 AV Engines Blind
A 77-kilobyte Windows executable — small enough to be dismissed as a stub, old enough to have first appeared on VirusTotal in October 2020 — is still generating active C2-server feed hits as of mid-2026. The sample, carrying the threat label trojan.phorpiex/zard and the deceptively mundane meaningful name DriveMgr.exe, is not remarkable for its size or age alone.
#Phorpiex#Zard#worm#packedPE#C2infrastructure#TLSevasion#MEVSPACE#GuatemalaIOCf3 · i2 · d0 · u3MITRE34RegionsGT
APTMembersJun 14, 2026, 10:17 (UTC+9)APT27's Godzilla Loader Factory: 18 Cloned Binaries, One C2 Gate
Nineteen PE32 executables. One YARA rule. Six .ru domains. A single PHP gate path with a campaign identifier that never changes. What CTX Team's analysis of this cluster reveals is not a hastily assembled intrusion kit but the output of a production-grade payload generation pipeline — one where 18 structurally identical 9 KB binaries are stamped from a single build toolchain, each mutated just enough at the byte level to carry a distinct fuzzy hash while preserving an identical PE import table,…
#APT27#GodzillaLoader#PonyStealer#certificateabuse#C2infrastructure#Italy#payloadfactory#code-signingabuseActorsAPT27 · TEMP.HippoIOCf28 · i0 · d24 · u12MITRE9RegionsIT
APTMembersJun 14, 2026, 06:29 (UTC+9)One Fake Certificate Signs 13 Pirated Windows Activation Tools
Thirteen Windows binaries marketed under a dozen different brand names — AAct, KMSAuto Net, MSAct++, PIDKey Lite, KMSCleaner — all carry the identical self-issued code-signing certificate from an entity calling itself "WZTeam," serial E5 FA 25 47 0F 85 17 BF 41 52 87 01 4D AA 57 8C, thumbprint 87B3A6C360B37D6DB7F970DD1DC0009FBBD13BA0.
#APT27attributionmismatch#crack-toolecosystem#KMSAutoKMSpicoAAct#code-signingcertificateabuse#Formbookanti-hookYARA#WindowsDefenderbypass#piratedsoftwaresupplychain#hacktoolPUAclassificationActorsAPT27 · TEMP.HippoIOCf51 · i0 · d0 · u0MITRE37RegionsHR · IN · PL · SIIndustriesEducation & Research · Hospitality & Leisure
FILEMembersJun 14, 2026, 03:28 (UTC+9)Thailand Telco Trojan Hides Banking Payload Inside Fake IDM Crack
Somewhere between a piracy forum and a Thai telecom workstation, a 59-kilobyte executable named IDM_6.4x_Crack_v19.7.exe is doing something its would-be users never expected: running a layered evasion gauntlet that defeats at least one automated sandbox entirely before handing off to a 12-megabyte dropper that quietly installs a banking-capable payload, establishes registry persistence, and then erases itself from disk.
#xegumumune#bankingtrojan#Thailand#telecommunications#sandboxevasion#WMIexecution#piracylure#C2infrastructureIOCf20 · i1 · d1 · u0MITRE47RegionsTHIndustriesTelecommunications
C&CMembersJun 14, 2026, 02:57 (UTC+9)Two Ghost Payloads Blind Analysts as Emotet Relay Cluster Holds Steady
Since CTX Team's earlier coverage of this Emotet C2 cluster — documented in the prior article tracking the campaign's 89-day Let's Encrypt rotation pattern — two new file samples have entered the payload layer with zero VirusTotal enrichment: no file type, no detection ratio, no behavioural tags, no signer data. The infrastructure they connect to is unchanged and already fingerprinted. The payloads themselves are, at this moment, analytically invisible.
#Emotet#TA542#MummySpider#C2infrastructure#Let'sEncryptcertificaterotation#WordPressrelay#payloadcycling#RomaniaActorsEmotet Group · TA542IOCf3 · i1 · d3 · u4RegionsRO
C&CMembersJun 14, 2026, 02:41 (UTC+9)Emotet-Labeled Loader's TLS Handshake Trips Dridex IDS Rules
A Win32 loader DLL tracked in this cluster — 65 of 77 engines flag it, and Zenbox, VMRay, and C2AE all name it Emotet in a unanimous 3/3 sandbox verdict — trips two independent intrusion-detection rules built for an entirely different crimeware family. The DLL's outbound TLS handshake fires "ET JA3 Hash - [Abuse.ch] Possible Dridex" from Proofpoint's Emerging Threats Open ruleset and a second hit from Abuse.ch's SSLBL malicious JA3 fingerprint list, also tagged Dridex.
#Emotet#Dridex#JA3fingerprint#Excel4macromaldoc#loaderDLL#TA542#commodityhostinginfrastructure#sandbox-evasionActorsEmotet Group · TA542IOCf4 · i3 · d2 · u7RegionsRO
APTMembersJun 14, 2026, 02:27 (UTC+9)Dormant Domain Reactivated With Fresh Cert to Power Backdoor C2
A domain registered in December 2019 and left parked behind ad-network nameservers for more than six years quietly received a new, short-lived TLS certificate on September 1, 2025 — and within weeks was hosting a live-looking command-and-control subdomain. The domain, wthelpdesk.com, is the single richest piece of evidence in this record, and it tells a story less about a specific actor than about how patiently some operators are willing to season their infrastructure before switching it on.
#RedApollo#APT10#ChChes#CloudHopper#domainparking#Let'sEncryptcertificateabuse#backdoormalware#XORobfuscationActorsRed Apollo · PotassiumIOCf1 · i0 · d1 · u5RegionsDE
APTMembersJun 14, 2026, 02:14 (UTC+9)Fake KMS Activators Share One Untrusted Signing Certificate
Two Windows executables masquerading as pirated-software tools — one branded "KMSAuto++.exe," the other disguised as an "Office 2013-2021 C2R Install Lite" installer — are circulating with an identical, untrusted code-signing certificate stamped by an entity calling itself WZTeam. The certificate, serial 8A C1 A3 10 13 49 C2 8A 4D 33 94 7C FC D0 76 62, terminates in a root that Windows does not trust, yet it appears verbatim across both binaries, alongside a shared VirusTotal family label of…
#KMSAuto#code-signingcertificateabuse#UPXpacking#PowerShelldownloader#piratedsoftwaredistribution#APT27#njRAT#maliciousdomaininfrastructureActorsAPT27 · TEMP.HippoIOCf16 · i0 · d2 · u2MITRE53RegionsTHIndustriesTelecommunications
C&CMembersJun 13, 2026, 14:47 (UTC+9)BazLoader, Amadey, and StealC V2 Chain Targets Algeria and Italy via Single German /24
A 170-kilobyte PE32 dropper first submitted to public scanning infrastructure on 12 June 2026 is the entry point for one of the more operationally compact espionage-oriented loader chains CTX Team has tracked this quarter. The binary — identified as BazLoader/egairtigado and observed in the wild as sprd2.exe — touches down in the user Temp directory, copies itself to C:\Windows\8amu8dw.exe, and immediately begins beaconing over raw IPv4 HTTP to a pair of hosts consolidated within the…
#BazLoader#Amadey#StealCV2#WoodyRAT#AS214351#credentialharvesting#Algeria#ItalyIOCf30 · i2 · d0 · u5MITRE62RegionsDZ · IT
C&CMembersJun 13, 2026, 14:32 (UTC+9)woody_rat Stealer Drains Exodus and ElectronCash Wallets via Telegram Log Market
##Wallet Vaults Cracked Open: How a woody_rat Infostealer Pipeline Drains Exodus and ElectronCash in a Single Pass A woody_rat operation tracked by CTX Team has been systematically dismantling the cryptocurrency holdings of technology-sector victims in Egypt and Hungary, harvesting the full wallet store of both Exodus and ElectronCash installations in a single automated sweep — then packaging the stolen files into dated log archives and routing them through a Telegram bot channel for downstream…
#woody_rat#infostealer#Exoduswallet#ElectronCash#Telegramlogmarket#cryptocurrencytheft#Egypt#HungaryIOCf68 · i2 · d0 · u3MITRE62RegionsEG · HUIndustriesTechnology
C&CPublicJun 13, 2026, 10:39 (UTC+9)Fake Android Toolkit Delivers Sandbox-Proof Python Spyware
A self-extracting RAR archive named "Android Win Tool v1.9.6" is circulating as a trojanized utility lure, staging a PyInstaller-packed Python trojan and a secondary unsigned PE payload that beacon to parameterized HTTPS endpoints across a purpose-built two-tier command-and-control infrastructure. The campaign — tracked by CTX Team under threat record CTXkz7eez4uc5 with severity 100 and confidence 85 — is distinguished not by any single technique but by the deliberate layering of evasion…
#PyInstallertrojan#sandboxevasion#espionage#C2infrastructure#SFXarchivelure#Androidtoolkitlure#Let'sEncryptautomation#spywareIOCf26 · i2 · d3 · u3
C&CPublicJun 13, 2026, 10:27 (UTC+9)Phorpiex Relay Cluster Exposed by Misplaced TLS Certificate on Spam Domain
Five mail-themed domains provisioned across two registrar accounts, a freshly compiled 18 KB loader carrying an XOR-obfuscated C2 address, and a TLS certificate whose subject field names a spam-trap tracking domain — together these artefacts paint a Phorpiex spam botnet operation whose infrastructure cohesion is unusually legible.
#Phorpiex#spambotnet#mailrelayinfrastructure#TLScertificateanomaly#XORobfuscation#domainregistration#C2servers#HondurasKyrgyzstanUnitedStatesIOCf4 · i4 · d54 · u1RegionsHN · KG · US
FILEMembersJun 13, 2026, 06:59 (UTC+9)17-Year-Old Kernel Driver Powers 2026 Credential-Theft Campaign Across 7 Countries
Since CTX Team's earlier coverage of a trojanized CorelDraw crack campaign targeting Brazil, two new file samples have surfaced that confirm the operator is not winding down — they are building out. The most recent addition carries a PE compilation timestamp of 2026-05-08 and was first submitted to VirusTotal just three days later, on May 11.
#InjectorNett#PureLogs#WinRing0x64BYOVD#LOLDrivers#cryptomining#credentialtheft#AS213010#NICENICinfrastructureIOCf7 · i2 · d3 · u4MITRE58RegionsAU · BD · BR · ESIndustriesConstruction · Hospitality & Leisure · Manufacturing
APTMembersJun 13, 2026, 02:32 (UTC+9)WHQL-Signed Kernel Driver With 2/76 Detections Opens Stealc v2 Kill Chain
A 34-kilobyte Windows kernel driver signed by the Microsoft Windows Hardware Compatibility Publisher — carrying a WHQL certificate chain that traces back to Microsoft's own root authority — is being deployed as the opening move in a five-stage financial-theft campaign that ultimately delivers Stealc v2 credential stealers capable of bypassing Chromium app-bound encryption and in-process clipboard hijackers targeting cryptocurrency wallet addresses.
#WizardSpider#Stealcv2#BYOVD#Amadey#clipboardhijacker#Chromiumapp-boundencryption#AS214351#kerneldriverabuseActorsWizard Spider · Grim SpiderIOCf11 · i3 · d1 · u5MITRE71RegionsAR · DE · IN · NG
FILEMembersJun 12, 2026, 22:44 (UTC+9)Sefnit C2 URI Unchanged for a Decade as Campaign Hits Thai Telecoms
A single line of HTTP traffic — gettasks.php?protocol=0&protoversion=201&o=0&p=C:%5CUsers%5Cadmin%5CAppData%5CLocal%5CTemp%5Cexplorer.exe&f=7296000 — appears identically across four command-and-control domains whose registration dates span more than a decade, from a domain created in July 2013 through to one registered in January 2024.
#Sefnit#Graftor#CeeInject#telecommunicationsservices#Thailand#processmasquerading#registrardiversification#command-and-controlinfrastructureIOCf3 · i1 · d4 · u12MITRE26RegionsTHIndustriesTelecommunications
FILEMembersJun 12, 2026, 07:28 (UTC+9)'mixseven' Affiliate Deploys Six Malware Families via Single PPI Tag
A single pay-per-install affiliate operating under the publisher tag pub=mixseven has coordinated the simultaneous deployment of at least six distinct malware families — GCleaner, SmokeLoader, PrivateLoader, Socelars, Fabookie, RedLine Stealer, FFDroider, and Glupteba — through a layered loader chain whose network infrastructure was provisioned in a single automated session in September 2021.
#mixseven#pay-per-install#GCleaner#SmokeLoader#RedLineStealer#Glupteba#credentialharvesting#PPIaffiliatenetworkActorsSmoky Spider · BariumIOCf20 · i5 · d2 · u13MITRE64
APTMembersJun 12, 2026, 06:42 (UTC+9)Emotet OCX Loader Beacons to Four Continents via regsvr32 Proxy
A 64-bit Windows DLL masquerading as an OLE Control Extension file — delivered under the name hvxda.ocx and designed to run through regsvr32 rather than a conventional executable launcher — sits at the centre of an active Emotet deployment that has been beaconing to four geographically dispersed command-and-control servers across Malaysia, Ghana, Germany, and South Korea.
#Emotet#TA542#Dridex#regsvr32proxyexecution#multi-epochC2infrastructure#bankingtrojan#GeorgiaandQatartargeting#FeodoTrackerActorsEmotet Group · TA542IOCf1 · i4 · d0 · u7MITRE21RegionsGE · QA
FILEMembersJun 12, 2026, 03:25 (UTC+9)Trojanized CorelDraw Crack Hits Brazil With Four-Payload Attack Chain
A trojanized CorelDraw activation archive that has reached 887 unique submitters since March 2025 is deploying a layered attack chain against Brazil's construction, hospitality, media, and retail sectors — one that combines a PureLogs credential stealer, an embedded coin-miner, a three-stage hosts-file poisoning sequence, and a Bring Your Own Vulnerable Driver (BYOVD) component borrowed from a 2008-era kernel driver.
#PureLogs#BYOVD#WinRing0x64.sys#coin-miner#Brazil#piratedsoftwaredistribution#credentialtheft#AS213010IOCf17 · i2 · d3 · u4MITRE72RegionsBRIndustriesConstruction · Hospitality & Leisure · Media
FILEPublicJun 11, 2026, 23:43 (UTC+9)WarzoneRAT Invoice Lure Layers Anti-Analysis Stack Against Turkish Targets
A 2,695-kilobyte Windows executable, packaged under the filename Invoice.exe and built inside a commercial crypter environment, carries one of the more deliberately constructed anti-analysis stacks CTX Team has documented in a commodity remote-access trojan deployment: timing-based sandbox evasion, debugger detection, reflective code loading, process injection, UAC bypass, and an aggressive indicator-removal suite — all wrapped in a TLS-encrypted C2 channel that hides behind a hostname…
#GoldEvergreen#WarzoneRAT#AveMaria#Turkey#sandboxevasion#UACbypass#invoicephishing#C2infrastructureActorsGold Evergreen · Business ClubIOCf1 · i0 · d2 · u0MITRE21RegionsTR
FILEMembersJun 11, 2026, 19:41 (UTC+9)OceanLotus Hid Denis Backdoor Behind Forged Microsoft Identity and DNS Tunnel
Two Win32 executables compiled on the same December afternoon in 2015 represent something more instructive than their age might suggest: a precisely engineered deception stack in which every layer — binary identity, code-signing posture, execution behaviour, and network communications — was designed to pass as something legitimate. Both are Denis backdoor variants attributed to OceanLotus (also tracked as APT32, Canvas Cyclone, and Bismuth).
#OceanLotus#APT32#Denisbackdoor#DNStunnelling#code-signingforgery#sandboxevasion#binarymasquerading#SoutheastAsiaespionageActorsOceanLotus · APT32IOCf2 · i0 · d2 · u0MITRE12RegionsCN
C&CMembersJun 11, 2026, 19:10 (UTC+9)Twenty IPs, One Certificate: How a Phorpiex C2 Pool Mimics 2345.com
Eight of the twenty IP addresses flagged as command-and-control infrastructure for a financially motivated operation tracked under the phorpiex family sit inside a single China Telecom autonomous system, AS4811 — and five of those nodes present an identical TLS certificate, serial d3d9e9261c1c88d957e704d69617a469, whose subject reads *.2345.com.
#Phorpiex#C2infrastructure#TLScertificatereuse#ChinaTelecomAS4811#2345.comspoofing#adware/PUAinstaller#sslTrusCA#financiallymotivatedthreatactorIOCf3 · i27 · d0 · u0MITRE20RegionsCN
FILEMembersJun 11, 2026, 16:10 (UTC+9)2345Pinyin IME Runs Six-Year Covert Delivery Pipeline Behind Ad-Injection Cover
A Chinese-language input method editor has been quietly running a multi-tier asset-delivery pipeline on victim hosts since at least 2018 — one whose technical fingerprints look considerably more sophisticated than the advertisement injection it ostensibly exists to perform. The 2345Pinyin IME client, distributed by Shanghai 2345 Network Technology Co., Ltd.
#2345NetworkTechnology#2345Pinyin#adware#PUA#HongKong#mediasector#CDNabuse#indicatorremovalIOCf44 · i5 · d0 · u0MITRE24RegionsHKIndustriesMedia
C&CMembersJun 11, 2026, 15:27 (UTC+9)Amadey Stealer Runs 67-IP C2 Pool Engineered to Outlast Blocklists
Sixty-seven IP addresses. One stealer binary. And an infrastructure architecture so deliberately fragmented that no single takedown pathway touches more than a fraction of it. That is the operational picture CTX Team has assembled around a currently active Amadey stealer deployment — a campaign whose most distinctive feature is not the malware itself but the tiered, multi-continent command-and-control fabric the operators have constructed around it.
#Amadey#stealer-as-a-service#C2infrastructure#KoreaTelecomAS4766#Let'sEncryptcertificaterotation#Brazilacademicnetwork#credentialharvesting#processinjectionIOCf1 · i67 · d0 · u2MITRE30
C&CMembersJun 11, 2026, 14:58 (UTC+9)MSIL/Bobik Dropper Stays Live as Mystery Second File Hints at New Payload
A 982-kilobyte unsigned .NET assembly — its PE timestamp deliberately forged to the year 2085 to confound timeline-based triage, its primary code section packed to an entropy of 7.64 — has been confirmed active as recently as 23 June 2026, deploying an XMRig-compatible cryptocurrency miner and PureLog credential stealer simultaneously to compromised endpoints across six industry verticals and 42 countries.
#MSIL/Bobik#PureLogStealer#XMRig#Contaboinfrastructure#credentialtheft#cryptocurrencymining#packed.NETdropper#multi-countrytargetingIOCf2 · i1 · d0 · u3MITRE37RegionsAR · AT · AU · BEIndustriesCommercial Services · Education & Research · Government
APTMembersJun 11, 2026, 14:40 (UTC+9)Same-Day Certificates Expose Scripted C2 Build-Out Behind Two Trojans
Three infrastructure nodes — the IPs 31.58.134.74 and 80.97.160.31, plus the freshly minted domain powershell-storage.vg — received Let's Encrypt certificates from the same "YE2" intermediate within a two-day window in June, each carrying an identical 89-day validity span. That kind of synchronized issuance is not how organically managed hosting behaves; it is what scripted infrastructure provisioning looks like when an operator wants a C2 front live and disposable within hours of registering…
#APT28#NICENIC#Let'sEncryptcertificates#DNSPod#C2infrastructure#codesigningabuse#installertrojans#domainregistrationclusterActorsAPT28 · StrontiumIOCf7 · i4 · d5 · u6RegionsID · MY · PL
APTPublicJun 11, 2026, 14:25 (UTC+9)Shell Crew's Zero-Detection C2 and Anti-Forensic Toolkit Hit Mexico Construction
Five hacktools attributed to Shell Crew — the Chinese state-aligned intrusion set also tracked as Deep Panda, APT26, Turbine Panda, and Checkered Typhoon — have been linked to an active espionage campaign targeting Mexico's construction sector, with a command-and-control node on China Unicom's commercial backbone that registered zero detections across 91 VirusTotal engines despite carrying a named-actor attribution.
#ShellCrew#DeepPanda#terracotta_vpn#Mexicoconstructionsector#ChinaUnicomAS-4837#anti-forensictradecraft#credentialdumping#C2infrastructureActorsShell Crew · WebMastersIOCf5 · i1 · d0 · u0MITRE28RegionsMXIndustriesConstruction
C&CMembersJun 11, 2026, 10:46 (UTC+9)Dutch VPS and Borrowed ISP Relays Power Ranapama Infostealer C2
A Let's Encrypt certificate minted on 29 January 2026 for the domain aceinco.com — valid for exactly 89 days, hosted on a LeaseWeb Netherlands VPS at 85.17.31.111 (AS60781) — is the clearest fingerprint of operator-controlled infrastructure in a 57-IP command-and-control network assembled around the ranapama infostealer. Everything else in the observable pool appears to be borrowed: compromised Korea Telecom broadband endpoints, hijacked subscriber lines on a Belarusian mobile carrier, and at…
#ranapama#infostealer#commandandcontrol#LeaseWeb#KoreaTelecom#SOHOroutercompromise#credentialharvesting#processinjectionIOCf1 · i57 · d0 · u0MITRE30