FILEMembersJun 11, 2026, 06:43 (UTC+9)XRed RAT Hits Peru Gov With Frozen 2019 Builder, AnyDesk Lures
Three Windows executables masquerading as a Synaptics touchpad driver and AnyDesk remote-desktop installer are circulating against Peruvian government targets, carrying an XRed RAT payload whose compiled import table has not changed since at least June 2019. The same imphash — 332f7ce65ead0adfb3d35147033aabe9 — locks together samples whose first VirusTotal submissions span four years, from June 2019 through October 2023, and the campaign was still active as recently as May 2026.
#XRedRAT#DarkKomet#Peruviangovernment#FreeDNSC2#sandboxevasion#espionage#commodityRAT#LatinAmericaActorsCactus · Cactus Ransomware GroupIOCf14 · i1 · d0 · u0MITRE20RegionsPEIndustriesGovernment
FILEPublicJun 11, 2026, 02:57 (UTC+9)Trojanised KMSAuto Delivers SmokeLoader via Three-Layer Evasion Stack
A trojanised Windows activation tool distributed through a software-piracy hosting path has been confirmed as the delivery vehicle for SmokeLoader, with the full infection chain relying on a deliberately engineered evasion stack — AutoIT compilation, aPLib decompression, UPX runtime packing, and active sandbox-fingerprinting — that goes well beyond what commodity pirated-software distributors typically invest in concealment.
#SmokySpider#SmokeLoader#AutoIT#aPLib#UPXpacking#sandboxevasion#Mongolia#softwarepiracylureActorsSmoky SpiderIOCf3 · i0 · d0 · u0MITRE28RegionsMN
FILEMembersJun 11, 2026, 02:44 (UTC+9)Autodesk Licensing Agent Hijacked to Drop Coinminer via DLL Sideload
A trojanized crack package impersonating Autodesk's Network License Manager is exploiting the legitimate AdskLicensingAgent service to load attacker-controlled code — a DLL sideload [T1574.002] that turns a trusted enterprise software component into an unwitting execution vehicle. The lure is polished enough to have drawn 461 submissions from 417 unique sources since late March 2026, and the campaign's evasion layer is effective enough that one major automated sandbox rated the primary payload…
#DLLsideloading#coinminer#AutodeskNetworkLicenseManager#AS213010#Brazilcontainersandpackaging#T1574.002#sandboxevasion#ParentLock.exeIOCf13 · i2 · d2 · u0MITRE53RegionsBRIndustriesContainers & Packaging
FILEMembersJun 10, 2026, 23:07 (UTC+9)Validly Signed uTorrent Installer Hides Trojanized Adware Payload
A Windows installer carrying a fully valid BitTorrent Inc / DigiCert code-signing chain is circulating as a trojanized uTorrent Classic setup — flagged malicious by 22 of 76 antivirus engines even though every certificate check in the chain returns clean. The same build lineage produced an unsigned, PEiD-packed sibling that only 4 of 75 engines catch.
#uTorrentimpersonation#code-signingabuse#TLScertificatespoofing#adware#offercore#inoci#myqcloud.comCDNimpersonation#PUAdistributionIOCf26 · i6 · d2 · u0RegionsAE · AL · AR · ATIndustriesCommercial Services · Education & Research · Hospitality & Leisure
C&CMembersJun 10, 2026, 14:56 (UTC+9)Five Unrelated Domains Share One 89-Day Certificate Fingerprint
Five infrastructure nodes with no obvious business relationship to one another — the domains resolvent.net, bvwebdesign.nl, platynum.ch and sjd.se, plus the bare IP 135.125.247.10 — all carry a Let's Encrypt TLS certificate with an identical 89-day validity span, and all five were issued within a six-week window between April 22 and June 8, 2026.
#c2infrastructure#Let'sEncryptcertificateautomation#Netskyworm#domainreactivation#TLScertificatefingerprinting#resellerhostingabuse#threatintelligencefeed#SMTPmass-mailerIOCf11 · i7 · d5 · u0MITRE22RegionsNZ
C&CMembersJun 10, 2026, 13:03 (UTC+9)Phorpiex Swaps Three Payloads While C2 Infrastructure Holds Firm
Three new PE32 executables have entered the Phorpiex botnet's active file set while three prior payloads were simultaneously retired — a clean swap that leaves the campaign's command-and-control backbone untouched for the eighth consecutive observation window. The rotation is surgical: the two C2 IP addresses, the wildcard certificate architecture anchored to *.certsdom.com, and the staging URL pattern under tsrv2.top all persist unchanged, while the operator pushes fresh binaries through the…
#Phorpiex#emailworm#botnet#Pakistan#telecommunications#payloadrotation#C2infrastructure#sandboxevasionIOCf3 · i2 · d0 · u4MITRE33RegionsPKIndustriesTelecommunications
APTMembersJun 10, 2026, 10:17 (UTC+9)Emotet DLL Poses as Chinese AV, Beacons to Five-ASN C2 Pool
A 572-kilobyte Windows DLL is circulating across healthcare networks in Panama wearing the identity of a Chinese-language antivirus product — its PE version-info fields stamped with the product name "MJAntiVirus.EXE," an internal name of "MJAntiVirus," and a copyright string reading "版权所有 (C) 2009." The file is unsigned, packed with PEiD, and carries a .rsrc section registering entropy at 7.75. It is, by unanimous verdict of six independent sandboxes, Emotet.
#Emotet#Dridex#TA542#healthcaresector#Panama#C2infrastructure#TLSfingerprinting#PEmasqueradingActorsEmotet Group · TA542IOCf1 · i5 · d0 · u9MITRE26RegionsPAIndustriesHealthcare
C&CMembersJun 10, 2026, 08:09 (UTC+9)A Five-Year-Old Phorpiex Dropper Still Wears a Windows Disguise
A Phorpiex dropper compiled on 31 October 2020 is still being flagged by anti-malware engines today, and it hasn't needed a rewrite to stay useful. The sample (tracked internally as 5d9b6c49a8c8…) presents itself under the names DriveMgr.exe and C:\2994616913505\svchost.exe — masquerading as ordinary Windows plumbing [T1036] rather than anything a user would think twice about.
#Phorpiex#ClipBanker#Botx#sandboxevasion#C2infrastructure#wildcardTLScertificate#cryptocurrencyclipboardhijacking#MexicogovernmentsectorIOCf3 · i1 · d2 · u11MITRE34RegionsMXIndustriesGovernment
FILEMembersJun 10, 2026, 07:34 (UTC+9)Allaple Worm Hijacks 20 German Business Servers as Silent C2 Relays
Twenty static IP addresses, all assigned to small German businesses on Deutsche Telekom AG's T-DSL Business service, all falling within the same RIPE-registered netblock — 217.86.128.0 through 217.86.255.255, designated DTAG-STATIC02 — form the operational backbone of an Allaple worm campaign that CTX Team has tracked from February through June 2026. None of the twenty endpoints carry a single malicious detection across 91 scanning engines on VirusTotal.
#Allaple#DeutscheTelekomAS3320#compromisedSMBinfrastructure#C2relaynetwork#sandboxevasion#wormpropagation#Germanbusinessservers#retailsectortargetingIOCf41 · i29 · d0 · u0MITRE25RegionsUSIndustriesRetail
C&CMembersJun 10, 2026, 06:49 (UTC+9)LummaStealer Adds Isolated .qpon Node and 20 Hashes as Proton66 Cluster Holds
Since CTX Team's earlier coverage of this LummaStealer campaign, the operator has added twenty new file hashes to the payload catalog and provisioned a structurally distinct second domain — recenjc.qpon — that sits entirely outside the tight infrastructure cohort binding the original eight command-and-control nodes. The earlier coverage documented a remarkably coherent C2 fabric: eight pseudo-random seven-character hostnames under the Soviet-era .su TLD, all batch-registered on a single day,…
#LummaStealer#Proton66#C2infrastructure#credentialtheft#Spain#bulletproofhosting#malware-as-a-service#TraefikmisconfigurationIOCf20 · i1 · d9 · u17MITRE38RegionsES
APTMembersJun 10, 2026, 06:38 (UTC+9)One Expired Microsoft Cert Ties Three Amadey Dropper Stages Together
Five Windows executables — two trojanised KMS software-activation tools, two dedicated AV-killing binaries, and a fully operational Amadey bot loader — form a tightly bound dropper chain whose most distinctive feature is not the payload at the end but the build discipline that assembles it. A single expired Microsoft Windows Publisher leaf certificate, serial 33 00 00 02 4B B2 23 0A 43 CD 03 63 62 00 00 00 00 02 4B, has been stamped across three distinct malware stages with an identical signing…
#Amadey#KillAV#PS2EXE#KMSlure#certificateabuse#piracydistribution#RussiaC2infrastructure#dropperchainIOCf9 · i1 · d0 · u3MITRE31RegionsZW
APTMembersJun 9, 2026, 23:05 (UTC+9)APT28-Linked Loader Fires Amadey Signatures Despite DCRat Tag
A single Win32 executable now under continued watch by CTX Team carries three contradictory identities at once: the feed classifies it under the DCRat family, VirusTotal's own engines settle on the threat label "trojan.abmrisk/common," and the network traffic it generates fires Snort signatures written specifically for Amadey.
#APT28#Amadey#DCRat#loadermalware#commandandcontrol#Pleskauto-certificate#OmegatechLTD#codesigningevasionActorsAPT28 · StrontiumIOCf2 · i1 · d0 · u1MITRE25RegionsBD · BF · BR · DZIndustriesTechnology
FILEMembersJun 9, 2026, 20:32 (UTC+9)TA505 Dropper Sleeps Past Sandboxes, Stages Rockloader in 24 Countries
A roughly one-megabyte JavaScript file — encoded in UTF-16 little-endian, packed by Varist, and bearing filenames that mimic business invoice PDFs — is circulating across engineering, healthcare, manufacturing, legal, technology, and telecom organisations in 24 countries, functioning as the first stage of a delivery chain that culminates in the download of a Windows executable attributed to the rockloader family.
#TA505#rockloader#JavaScriptdropper#sandboxevasion#spear-phishing#invoicelure#everycarebd.com#espionageActorsTA505 · Hive0065IOCf38 · i0 · d1 · u3RegionsAE · AT · AZ · BDIndustriesEngineering · Healthcare · Manufacturing
C&CMembersJun 9, 2026, 19:37 (UTC+9)Dual-TLD DGA Gives Kazakhstan Ransomware Campaign Sinkhole-Resistant C2
Eighteen command-and-control domains generated by a single deterministic algorithm — split evenly across .ru and .su top-level domains, each carrying an identical 15-character vowel-heavy label structure — form the backbone of a financially motivated ransomware-adjacent campaign targeting Kazakhstan. The architecture is deliberate: by producing parallel domain sets from a common seed, the operator has engineered a C2 layer where sinkholing the .ru cluster leaves the structurally identical .su…
#trojan.bitmin/razy#domaingenerationalgorithm#Kazakhstan#dual-TLDC2#UPXpacking#TLSmasquerade#removablemediapropagation#ransomwareIOCf3 · i2 · d18 · u20MITRE39RegionsKZ
FILEMembersJun 9, 2026, 16:21 (UTC+9)Old Baixaki Typosquat Cluster Resurfaces via Unrelated 2026 CDN Certificate
Three subdomains built around the name of Brazil's largest freeware portal, all registered on the same day in October 2012 through PDR Ltd. d/b/a PublicDomainRegistry.com, have re-entered current threat telemetry paired with an unrelated certificate observation on a commercial Brazilian CDN more than a decade later — a pairing that illustrates how stale infrastructure and fresh re-observation timestamps can be mistaken for a live campaign if analysts don't check the dates.
#dealply#Baixakityposquat#AzionTechnologies#GlobalSigncertificate#adware/PUPdistribution#Brazil#staleIOC#VirtualDJinstallerlureIOCf7 · i2 · d3 · u1MITRE33RegionsBRIndustriesConsulting
APTMembersJun 9, 2026, 11:38 (UTC+9)IPFS Gateway Joins APT28-Linked C2 Stack Spanning Three Autonomous Systems
Two new IP addresses have been added to the infrastructure footprint of a delivery campaign that has been circulating trojanised installers and adware components since at least September 2025 — and one of them points somewhere unusual. IP 209.94.90.1, now part of the campaign's network layer, sits within ASN 40680, the address space operated by Protocol Labs, the organisation behind the InterPlanetary File System.
#APT28#IPFSabuse#PremierOpinionadware#code-signingcertificateabuse#DLLsideloading#technologysectortargeting#bulletproofhosting#trojanisedinstallersActorsAPT28 · StrontiumIOCf4 · i3 · d4 · u0MITRE13IndustriesTechnology
FILEMembersJun 9, 2026, 08:22 (UTC+9)Fake 'Sanwhole' Cert Anchors Layered Crypto-Wallet Heist via Trojanised IDE
A trojanised installer impersonating the developer tool "Netpas DevStudio" has been circulating with a self-fabricated code-signing certificate — issued by and to a fictitious entity called "Sanwhole" — whose chain terminates in an untrusted root that no legitimate certificate authority ever vouched for. Three files in the bundle carry the same fraudulent signature, the same certificate serial (26 F4 9B CA 07 79 1C 96 48 EA 3D 5A EA 7F 69 37), and the same thumbprint…
#Cryptbot#EmotetGroup#code-signingabuse#cryptocurrencywallettheft#developertoollure#sandboxevasion#infostealer#DLLspoofingActorsEmotet Group · TA542IOCf30 · i0 · d1 · u2MITRE39RegionsCI
C&CMembersJun 9, 2026, 07:51 (UTC+9)Same Cert Cadence Links Phishing Site to Domain Farm
Three domains that have nothing else in common — a Spanish site already flagged for phishing, and two hosts sitting under a fifteen-year-old apex — were all issued Let's Encrypt certificates through the identical "YR2" intermediate, with identical 89-day validity windows opened within a nine-day span. lavers.es, which alphaMountain.ai categorizes as Phishing, picked up a YR2 certificate valid 2026-06-05 through 2026-09-03. treddle.nuronapp.com got one valid 2026-05-29 through 2026-08-27.
#Let'sEncryptcertificateabuse#domainfarming#wildcardSANexposure#PUAdownloader#revokedcode-signingcertificate#multi-ASNinfrastructure#phishing#trojanizedsoftwareupdaterIOCf2 · i5 · d7 · u0MITRE12IndustriesTelecommunications
APTMembersJun 9, 2026, 07:24 (UTC+9)Void Arachne Hides DBatLoader Inside Fake FitGirl Game Repack Targeting Brazil
Two unsigned PE32 executables — both carrying the version metadata "product: 007 First Light / copyright: FitGirl" — have been circulating through pirated-software distribution channels targeting Brazilian users, wrapped inside a structurally complete fake game repack that bundles a Play.bat launcher, a game cover image, a convincing uninstaller, and a counterfeit DirectX installer to defeat automated sandbox analysis.
#VoidArachne#DBatLoader#Banload#Brazil#gamerepacklure#sandboxevasion#Russianhostinginfrastructure#initialaccesstrojanActorsVoid Arachne · Silver FoxIOCf17 · i4 · d2 · u0RegionsBR
FILEPublicJun 9, 2026, 04:10 (UTC+9)Football Manager 26 Crack Hides Two-Year-Old AutoIT Kill Chain
Since CTX Team's earlier coverage of this campaign, nine additional file indicators have surfaced, deepening the tooling picture around a multi-stage infection chain that pairs trojanized game installers with a layered evasion stack that has remained structurally intact across at least two years of active operation. The newest sample — a 20.6 MB executable named fm.exe carrying Unity Technologies copyright metadata and the embedded path C:\Games\Football Manager 26\fm.exe — represents the…
#Patchwork#APT-C-09#AutoIT#XMRig#BYOVD#WinRing0#cryptomining#LOLDriversActorsPatchwork · ChinastratsIOCf18 · i0 · d0 · u0MITRE45
C&CMembersJun 9, 2026, 03:58 (UTC+9)One GlobalSign Certificate Anchors 20 Malicious Files in Chinese Utility Trojan Campaign
A GlobalSign code-signing certificate issued to the Chinese entity 沧州句号网络科技有限公司 (Cangzhou Juhao Network Technology Co., Ltd.) has served as the operational backbone for at least 20 malicious Windows executables and DLLs spanning two distinct build waves — one in May 2025 and a second in September 2025 — all delivered through a Wangsu (ChinaNetCenter) CDN-fronted infrastructure that renders conventional IP-layer blocking effectively useless.
#SaltySpider#SoftCnApp#DeepData#code-signingabuse#CDNfronting#sandboxevasion#Chinese-languageWindowsusers#DLLsideloadingActorsSalty Spider · KuKuIOCf27 · i40 · d2 · u3
FILEMembersJun 9, 2026, 00:37 (UTC+9)Salty Spider Pairs 7-Year Loader With Fresh Phorpiex Worm to Hit Transport
##A Seven-Year Loader Meets a Zero-Day Worm: Salty Spider's Layered Evasion Campaign Targets Transportation A freshly compiled Phorpiex worm variant — PE timestamp matching its first submission date of 2026-02-09, zero prior detection history at the moment of deployment — is circulating alongside a seven-year-old MSIL/AgentB trojan that successfully convinces automated sandbox analysis it is harmless, even as 48 of 76 antivirus engines flag it as malicious. The pairing is not accidental.
#SaltySpider#Phorpiex#MSIL/AgentB#transportationsector#sandboxevasion#bulletproofhosting#USBsocialengineering#botnetC2ActorsSalty Spider · KuKuIOCf2 · i1 · d0 · u1MITRE25IndustriesTransportation
FILEMembersJun 9, 2026, 00:21 (UTC+9)Trojanized UltraSurf Proxy Rides Expired Cert Into 2026
A Win32 build of the UltraSurf/Ultrareach censorship-circumvention proxy — a tool millions have used to punch through national firewalls — is still circulating years after the code-signing certificate underpinning it expired. The leaf certificate, issued to "Ultrareach Internet Corp." and valid from June 9, 2021 to June 9, 2024, is now flagged by validators as "not time valid," yet the GlobalSign intermediate and root certificates above it in the chain remain valid through 2029 and 2030.
#UltraSurf#Ultrareach#Glupteba2#codesigningabuse#HurricaneElectricAS6939#self-signedcertificates#MuddyWater#SilentChollimaActorsMuddyWater · TEMP.ZagrosIOCf1 · i5 · d0 · u0MITRE18IndustriesEnergy
C&CMembersJun 8, 2026, 23:57 (UTC+9)Ludashi Adware Operator Pre-Positions Second DigiCert Certificate as Revocation Insurance
Eleven Windows PE files. Two distinct Chinese legal entities. A single DigiCert Trusted G4 code-signing root. And, as of this writing, every certificate still valid. The Ludashi adware campaign documented in earlier coverage has extended its operational footprint in ways that reveal deliberate, forward-looking infrastructure management rather than reactive patching.
#Ludashi#adware#code-signingabuse#certificaterotation#CDNinfrastructure#sandboxevasion#China#PolarWindActorsFIN6 · Skeleton SpiderIOCf31 · i60 · d0 · u1MITRE5
APTMembersJun 8, 2026, 23:36 (UTC+9)Signed FileZilla Installer Hides Adware Bundler Behind Valid Sectigo Chain
A file calling itself FileZilla_3.69.5_win32-setup.exe is circulating with a complete, currently-valid Sectigo code-signing chain — Tim Kosse through Sectigo Public Code Signing CA R36, Sectigo Public Code Signing Root R46, and the Sectigo (AAA) root — even as 12 of 75 antivirus engines classify it as adware.bundler/filezilla.
#FileZilla#adwarebundler#code-signingabuse#Sectigocertificate#NSISinstaller#APT28#APT15#threatintelmisattributionActorsAPT28 · StrontiumIOCf1 · i4 · d1 · u1MITRE9IndustriesEducation & Research
APTMembersJun 8, 2026, 23:07 (UTC+9)Lazarus Group Hides LummaC2 Stealer Behind Signed Installer and AWS CDN
Four indicators. Two signed Windows executables. Two AWS CloudFront subdomains that score zero detections across 91 engines. In practice, a delivery architecture that defeats network-layer blocking, suppresses antivirus verdicts on the second-stage payload to 4 out of 77 engines, and defeats dynamic analysis entirely — all simultaneously, all through infrastructure that any enterprise legitimately uses every day.
#LazarusGroup#LummaC2#code-signingabuse#AWSCloudFront#sandboxevasion#financialservices#trojanizedinstaller#informationstealerActorsLazarus Group · Hastati GroupIOCf2 · i0 · d2 · u0MITRE21RegionsAE · BR · FR · LYIndustriesFinancial Services
FILEMembersJun 8, 2026, 19:41 (UTC+9)PayPal Lure Fronts Three-Family Malware Stack Tied to FortiGate C2
A trojanised credential-checker masquerading as a PayPal email validation tool has been serving as the entry point for a multi-stage payload operation that deploys at least three functionally distinct malware families — all wrapped in the same ConfuserEx Mod obfuscation layer — before routing command-and-control traffic to a single Russian IP address that presents a FortiGate appliance certificate.
#Amadey#Mofksys#ConfuserEx#reflectiveloader#credentialtheft#Russia#paymentplatforms#wormIOCf12 · i1 · d0 · u3MITRE36RegionsRO
FILEMembersJun 8, 2026, 15:58 (UTC+9)Decade-Old Bundler Trojan Drops Tor-Routed MinerGate on Chemicals Workstations
A 919-kilobyte UPX-compressed Windows executable masquerading as a routine software installer is functioning as the first stage of a two-component cryptomining chain that has been circulating since at least late 2016 and remains actively observed as of mid-2026. The dropper — internally branded "Carambis Installer" and carrying a ROSTPAY LTD.
#PinchySpider#MinerGate#Carambisbundler#cryptomining#chemicalssector#TorC2#Proton66OOO#UPXpackingActorsPinchy Spider · SodinokibiIOCf3 · i6 · d0 · u0IndustriesChemicals
C&CMembersJun 8, 2026, 15:26 (UTC+9)EV Certificate Issued to ORYON TECH LIMITED Signs Four Malicious Payloads in Single Batch
At 8:36 on the morning of 23 April 2026, an operator pressed the metaphorical button on a code-signing ceremony that bound four distinct malicious payloads to a single Extended Validation certificate — a credential class that Sectigo's issuance process requires to be anchored to a verified legal entity. The entity named on that certificate is ORYON TECH LIMITED.
#ORYONTECHLIMITED#Microleaves#Jatif#Legion#EVcertificateabuse#adware#Argentina#IndiaIOCf21 · i1 · d5 · u6MITRE13RegionsAR · IN
APTMembersJun 8, 2026, 15:09 (UTC+9)Salty Spider Abuses Live DigiCert Cert for 17 Months of Malicious Builds
Seven Windows executables and DLLs flagged as adware — spanning two distinct 2345 Software product lines — carry an identical, currently-valid DigiCert code-signing certificate issued to Shanghai 2345 Mobile Technology Co., Ltd., and the operator was still applying that same credential to fresh malicious builds as recently as April 7, 2026.
#SaltySpider#2345Software#code-signingabuse#adware#AlibabaCDN#China#T1553.002#softwaresupplychainActorsSalty Spider · KuKuIOCf15 · i16 · d2 · u2MITRE16
C&CMembersJun 8, 2026, 07:30 (UTC+9)Ludashi Campaign Adds Second Code-Signing Cert to Survive Revocation
##A Second Certificate, A Second Company: How the Ludashi Campaign Hardened Its Signing Infrastructure Since CTX Team's earlier coverage of the Ludashi adware and trojan campaign, twelve new file indicators, seven new IP addresses, and a new payload-delivery URL have surfaced — but the most operationally significant development is not the volume expansion.
#Ludashi#FIN6#code-signingabuse#adware#trojan#ChinaMobileAS9808#CDNfronting#DigiCertActorsFIN6 · Skeleton SpiderIOCf42 · i7 · d1 · u2MITRE13
C&CMembersJun 8, 2026, 07:18 (UTC+9)WoodyRAT Stealer Harvests Complete Exodus Wallet Secrets Across AS214351
Thirty-five new file indicators have joined the WoodyRAT-tagged campaign CTX Team first documented in earlier coverage, and almost none of them are malware. They are the stolen goods themselves — wallet seeds, two-factor secrets, session tokens, FTP credential stores, and instant-messenger account files pulled from victim machines and packaged into structured log bundles before being uploaded to a PHP panel sitting on a German IP address inside a single autonomous system registered less than…
#WoodyRAT#infostealer#Exoduswallet#Telegramsessiontheft#AS214351#cryptocurrencytheft#AlgeriaEthiopiaIndia#credentialharvestingIOCf52 · i3 · d0 · u5MITRE57RegionsDZ · ET · IN
APTMembersJun 7, 2026, 23:21 (UTC+9)DarkHotel's Decade-Old Nemim Trojan Still Evades Detection in 2026
A 56-kilobyte Windows executable first submitted to VirusTotal in February 2013 is still being resubmitted and tracked as an active threat as recently as March 2025 — and the infrastructure supporting it has grown fresher, not older. The implant at the centre of this campaign is Nemim, a multi-role trojan attributed by CTX Team to DarkHotel and directed at espionage targets in India.
#DarkHotel#Nemim#dynamic-DNS#India#espionage#sandboxevasion#commandandcontrol#APTActorsDarkHotel · Fallout TeamIOCf2 · i1 · d0 · u9MITRE28RegionsIN
APTMembersJun 7, 2026, 23:07 (UTC+9)BlueBottle's FileZilla Impersonation Campaign Hides XMRig Behind Zero-Detection ZIP
A PE32 dropper bearing a self-signed "FileZilla FTP Client" code-signing certificate — its validity start date of 2025-12-24 matching, to the day, the registration date of the campaign's C2 domain filezilla.cc — sits at the centre of a multi-stage XMRig cryptominer delivery chain that CTX Team has tracked from January through June 2026.
#BlueBottle#Opera1er#XMRig#cryptominer#DemocraticRepublicofCongo#code-signingabuse#encrypteddeliverycontainer#CloudflarefrontingActorsBlueBottle · Opera1erIOCf19 · i1 · d1 · u2MITRE29RegionsCD
C&CMembersJun 7, 2026, 20:10 (UTC+9)18 C2 Nodes Hide Behind Alibaba, Baidu, and 2345.com TLS Certs
Eighteen IP addresses flagged as command-and-control servers share an architectural feature that sets this campaign apart from conventional attacker-controlled hosting: every node in the set presents a TLS certificate belonging to a major Chinese internet platform — Alibaba CDN, Baidu, 2345.com, or Baidu DNS — making outbound C2 traffic structurally indistinguishable from routine HTTPS connections to some of China's highest-volume services.
#C2infrastructure#TLScertificateabuse#ChineseCDNblending#Chromeextensionmalware#sandboxevasion#ChinaUnicomAS4837#sslTrusCA#networkdetectionevasionIOCf50 · i18 · d0 · u0MITRE29
C&CMembersJun 7, 2026, 19:58 (UTC+9)Signed Adware Toolkit Targets Telecom With Two Live DigiCert Certs
Seventeen Windows executables and DLLs — spanning crash reporters, plugin managers, system tray utilities, and at least one component that a sandbox flagged as a remote-access trojan — are circulating under currently valid DigiCert Trusted G4 code-signing certificates issued to two Chinese corporate entities, with both certificates remaining valid until 2027.
#Ludashi#PubNubRAT#code-signingabuse#adware#sandboxevasion#telecommunications#DLLsideloading#ChinaActorsFIN6 · Skeleton SpiderIOCf40 · i5 · d12 · u33MITRE20IndustriesTelecommunications
C&CMembersJun 7, 2026, 19:39 (UTC+9)Gaming-Cheat Lure Hides Kernel-Level LummaStealer Campaign
A trojanized HWID-spoofer toolkit — distributed under gaming-cheat branding from at least three operator-controlled download endpoints — is delivering LummaStealer alongside a purpose-built kernel evasion stack that combines an expired EV-signed vulnerable driver with a test-certificate-signed spoofer component. The campaign's most recently observed artifact, a browser-store harvest file first seen on 2026-06-06, confirms active credential collection was underway within hours of CTX Team's…
#LummaStealer#BYOVD#WinDivert#kernelevasion#gamingcommunitytargeting#credentialtheft#HWIDspoofer#APT28unconfirmedActorsAPT28 · StrontiumIOCf17 · i5 · d3 · u6MITRE24
C&CMembersJun 7, 2026, 07:53 (UTC+9)CDN-Masquerade TLS Cluster and First C2 Domain Expand PubNubRAT Campaign
Thirteen IP addresses spanning six Chinese autonomous systems — China Unicom, China Telecom, China Mobile, and Jinhua Weian InfoTech among them — have been found presenting an identical Sectigo DV wildcard certificate for *.bytecdn.cn (serial 152bfd07c372d944c3ac6feff2e606bd), forming a geographically distributed reverse-proxy layer that cloaks command-and-control traffic behind the TLS identity of one of China's largest consumer internet CDN brands.
#PubNubRAT#TLSmasquerade#C2infrastructure#codesigningabuse#China#PUA#reverseproxy#CDNimpersonationActorsFIN6 · Skeleton SpiderIOCf73 · i77 · d1 · u2MITRE10
APTMembersJun 7, 2026, 07:20 (UTC+9)Fake Synaptics Driver Rebuilt for Three Years, Now a Confirmed RAT
Three unsigned Win32 loaders — the oldest first appearing in December 2020, the newest surfacing in November 2023 — share one imphash, an identical PE section layout down to the byte, and a forged compile timestamp of 1992-06-19 that predates Windows 95. All three carry the same fake product string, "Synaptics Pointing Device Driver," version 1.0.0.4, and two of them drop to the identical path, C:\ProgramData\Synaptics\Synaptics.exe.
#Synapticsdrivermasquerade#DarkKomet#XRed#XWorm#imphashreuse#certificatefronting#dynamicDNSabuse#IndraPredatorySparrowActorsIndra · Predatory SparrowIOCf13 · i5 · d0 · u0RegionsEC
C&CMembersJun 7, 2026, 03:54 (UTC+9)APT27 Toolkit Ties Six Malware Families to One C2 Cluster
Nine Windows executables submitted to VirusTotal across a five-day window in late May and early June 2026 do not look, at first glance, like a coordinated campaign. The threat labels scatter across the taxonomy — a banker trojan here, a clipboard hijacker there, an EDR-bypass pair, a StealC loader, an Amadey dropper. The file sizes range from 42 KB to 868 KB. No shared code-signing certificate ties them together.
#APT27#StealCv2#Amadey#ClipBanker#reflectiveloading#EDRbypass#Algeria#bulletproofhostingActorsAPT27 · TEMP.HippoIOCf64 · i3 · d0 · u7RegionsDZ
C&CMembersJun 7, 2026, 03:39 (UTC+9)TA505 Hides Malware Behind 13-Year-Old Revoked Valve Certificate
A SilverFox dropper circulating since early June 2026 carries a Valve Corporation code-signing certificate that expired in November 2012 and has been explicitly revoked — yet its PE timestamp reads 2025-08-18, a 13-year anachronism that is the clearest single indicator of deliberate stolen-cert abuse in this campaign. That certificate is only the first layer of a defense-evasion stack that also includes a Bring Your Own Vulnerable Driver (BYOVD) technique using a legitimately signed WinDivert…
#TA505#LummaStealer#SalatStealer#Amadey#BYOVD#certificateabuse#gamingcommunitytargeting#TurkeyActorsTA505 · Hive0065IOCf16 · i5 · d2 · u7MITRE27
C&CMembersJun 6, 2026, 23:59 (UTC+9)One DigiCert Certificate, 17 Malicious Payloads, Three-Year Signing Window
In September 2024, someone registered a code-signing certificate with DigiCert under the name of a Beijing technology company — 北京创想界科技有限公司 — and within six weeks began using it to sign malicious software. By the time CTX Team catalogued the full file cohort, that single certificate, serial number 06 FE 57 2B A6 2E 8E C3 18 03 0F DC 9B AC A2 81, had been applied to 17 distinct PE32 executables and DLLs spanning two trojanized utility brands, a modular plugin architecture, and at least one…
#PubNubRAT#Ludashi#PolarWind#code-signingabuse#Chinesethreatactor#CDNinfrastructure#sandboxevasion#adwaredual-useActorsAPT28 · StrontiumIOCf42 · i65 · d0 · u0MITRE26
APTMembersJun 6, 2026, 23:10 (UTC+9)Ludashi Adware Ring Abused DigiCert Certs Across Five Shell Firms
Fifteen signed Windows executables. Five distinct Chinese company identities. One commercial certificate authority. A single cert serial binding nine of those payloads to a three-year production window that is still running. The operation CTX Team has been tracking targets the telecom sector and exploits a structural weakness that most enterprise endpoint stacks have not solved: when a binary carries a valid, trusted code-signing certificate, a significant fraction of the detection stack simply…
#Ludashi#DigiCertcertificateabuse#code-signingevasion#adware#TencentCloudinfrastructure#telecommunicationssector#overlayhashmutation#certificaterevocationfailureActorsGorgon Group · SubaatIOCf29 · i22 · d4 · u0MITRE10IndustriesTelecommunications
APTMembersJun 6, 2026, 19:24 (UTC+9)Expired and Revoked Certs Anchor Active Malware Delivery Chain
Three Windows executables are circulating through software download channels carrying code-signing certificates that, by any standard enforcement logic, should stop them cold. One bears a DigiCert leaf certificate for an entity called VOICEFIVE, INC that expired on 3 April 2026. The other carries a Certum Extended Validation certificate for "AN Soft" that has been explicitly revoked.
#APT28#surtr#certificateabuse#code-signing#PremierOpinion#sandboxevasion#technologysector#supplychaindeliveryActorsAPT28 · StrontiumIOCf4 · i5 · d5 · u0MITRE7IndustriesTechnology
FILEPublicJun 6, 2026, 16:11 (UTC+9)Trojanised KMS Activators Carry Konni Espionage Implant, WinDivert Sniffer
Five trojanised Windows activation tools — distributed under the names KMSpico, KMSAuto, and AAct — carry an embedded user-mode packet-capture driver that has no legitimate place in any licensing utility. The YARA rule WinDivert_Driver fires on all five samples, and on one of them, AAct_x64.exe (sha256: db3aa782e297b2b5d9e2a1281ebb9afd416c82722c2d2a285ef94070e4cdd5d2), a second rule fires alongside it: win_konni_auto, a Malpedia-sourced signature that detects the Konni espionage implant family.
#GamaredonGroup#Konni#WinDivert#KMSpico#piracylure#defencesector#code-signingabuse#espionageActorsGamaredon Group · CTIGIOCf7 · i0 · d0 · u0MITRE6IndustriesDefense
FILEPublicJun 6, 2026, 16:00 (UTC+9)Trojanized Macro Tool Drops BroPass and RedlineStealer on Chilean Targets
A 32-kilobyte Windows executable masquerading as a macro encryption utility has become the delivery vehicle for one of the more technically deliberate credential-theft operations CTX Team has tracked against Chilean targets in recent memory. The outer wrapper — an NSIS installer named macro_encrypter.exe — drops at least two distinct stealer families onto victim machines while simultaneously executing a layered evasion stack that includes active sandbox detection, base64-encoded gzip payloads,…
#OperationSpalax#BroPass#RedlineStealer#NSISdropper#credentialtheft#Chile#sandboxevasion#code-signingabuseActorsOperation SpalaxIOCf3 · i0 · d0 · u1MITRE30RegionsCL
C&CMembersJun 6, 2026, 15:47 (UTC+9)Salty Spider Adds Second CDN Channel to Trojanized 2345PCSafe Delivery
Since CTX Team's earlier coverage of this campaign, the delivery infrastructure backing the trojanized 2345PCSafe (2345安全卫士) security suite has grown in a specific and operationally significant direction: a second CDN-fronted update endpoint, dl-up.2345cdn.com, is now confirmed active alongside the previously documented download.2345cdn.com, and 23 additional IP addresses have been mapped to the anycast pools behind both domains.
#SaltySpider#2345PCSafe#ad2345#chinad#supplychaincompromise#CDNabuse#codesigningabuse#mainlandChinaActorsSalty Spider · KuKuIOCf59 · i25 · d2 · u2MITRE2
C&CMembersJun 6, 2026, 11:58 (UTC+9)Three Certs, One Chain: Signed Adware Campaign Evades Revocation for 8 Months
Seventeen signed Windows executables, three DigiCert code-signing certificates, three distinct Chinese corporate identities, and an eight-month continuous production window: what CTX Team has catalogued in this campaign is not a single malicious installer but an industrialised signing infrastructure engineered to survive the most common defensive response to signed malware — certificate revocation.
#TA551#Ludashi#Chinad#code-signingabuse#certificaterotation#sandboxevasion#China-nexus#adware-trojanActorsTA551 · ShathakIOCf35 · i18 · d3 · u0MITRE3
C&CMembersJun 6, 2026, 11:40 (UTC+9)APT28 Hides PBot Stealer Inside Validly Signed Bright Data SDK Binary
A 12-megabyte Windows executable carrying a fully valid DigiCert code-signing certificate for "Bright Data Ltd" — a commercially distributed proxy and VPN software vendor — is circulating as the stealth layer of an espionage toolkit that CTX Team has attributed to APT28, the Russian state-aligned threat group also tracked under aliases including Fancy Bear, Forest Blizzard, and Sofacy.
#APT28#PBotstealer#BrightDataSDKabuse#code-signingchainexploitation#KMSactivationlure#C2certificaterotation#Dotfuscatorpacking#CloudflareproxyingActorsAPT28 · StrontiumIOCf4 · i2 · d7 · u1MITRE11
APTMembersJun 6, 2026, 11:07 (UTC+9)Three Shell Companies, One Pipeline: Chinese Signing Op Delivers PubNubRAT
Sixteen malicious Windows executables and DLLs are currently circulating under valid DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 certificates — each certificate issued to a distinct Chinese-registered legal entity, each carrying a three-year validity window, and each actively suppressing the dynamic analysis environments that defenders rely on to catch what static signatures miss. The operation is not a single rogue certificate.
#PubNubRAT#Ludashi#Chinad#code-signingabuse#China-nexus#DigiCert#AS4837#supplychaindeliveryActorsFIN6 · Skeleton SpiderIOCf40 · i5 · d3 · u1MITRE18