APTMembersJun 6, 2026, 03:06 (UTC+9)Expired C2 Domain Closes Loop on Red Apollo KMSPico Adware Campaign
A single domain registered in October 2017 — idyllicdownload.com, acquired through Silver Domain Names LLC and abandoned within a year — has emerged as the confirmed network checkin endpoint for a pair of NSIS-packaged OutBrowse adware installers that masquerade as the KMSPico Windows activation crack. The domain's addition to the indicator catalog closes the delivery-to-C2 loop on a campaign attributed to Red Apollo, the China-aligned threat actor also tracked under the aliases APT10,…
#RedApollo#APT10#OutBrowse#NSISinstaller#KMSPicolure#Germanmanufacturing#C2infrastructure#adwarecampaignActorsRed Apollo · PotassiumIOCf6 · i0 · d1 · u2MITRE38RegionsDEIndustriesManufacturing
C&CMembersJun 6, 2026, 00:07 (UTC+9)One DigiCert Certificate Binds 18 Malicious Ludashi Components Through 2027
Eighteen Windows PE files — a mix of executables and DLLs spanning a full PC utility lifecycle, from disk defragmentation to a lockscreen manager to an uninstaller — are circulating under the Ludashi (鲁大师) software brand, every one of them bearing an identical, currently-valid DigiCert Trusted G4 code-signing certificate issued to the Chengdu-registered entity 成都奇鲁科技有限公司 (Chengdu Qilu Technology Co. Ltd.).
#ChengduQiluTechnology#Ludashi#Chinad#adware#code-signingabuse#fast-fluxDNS#TLSimpersonation#ChinaIOCf66 · i5 · d2 · u4MITRE19
APTMembersJun 5, 2026, 23:19 (UTC+9)Fake ChatGPT Installer Hides Proxy SDK Classified as PBot Stealer
When a user downloads what appears to be a Windows client for ChatGPT from chatgpt-windows.top — a domain registered on 2025-06-03 and already flagging 13 of 91 engines on VirusTotal — they receive something considerably more complex than a VPN application. CTX Team's analysis of this campaign reveals a layered abuse chain in which trojanized VPN installers branded as WireVPN and VPNMaster silently co-install a Dotfuscator-obfuscated .NET component signed by Bright Data Ltd that two independent…
#PBotstealer#WireVPN#VPNMaster#BrightDataSDK#expiredEVcertificates#residentialproxyabuse#softwarebundlingsupplychain#AI-lurephishingActorsSpace Pirates · WebwormIOCf51 · i33 · d76 · u14MITRE20
FILEPublicJun 5, 2026, 12:39 (UTC+9)Emotet C2 Uses Auto-Rotating Certs and Zero-Detection Japan Node
A 143-kilobyte Word document disguised as a Windows system file sits at the entry point of a campaign targeting Canadian telecommunications organisations — but the more operationally significant story lies in what happens after that document executes. The command-and-control infrastructure behind this Emotet-attributed operation combines automated 89-day Let's Encrypt wildcard certificate rotation across operator-controlled domains with a fully undetected hosting node on SAKURA Internet's…
#Emotet#TA542#C2infrastructure#Let'sEncryptcertificateabuse#Canadiantelecommunications#SAKURAInternet#WordPresspathmimicry#phishingdocumentActorsEmotet Group · TA542IOCf3 · i1 · d2 · u3RegionsCAIndustriesTelecommunications
FILEMembersJun 5, 2026, 08:40 (UTC+9)XWorm RAT Campaign Stacks Four Evasion Layers Across 57 Countries
A ZIP archive disguised as a routine purchase-order document is the entry point for one of the more methodically constructed XWorm RAT delivery chains CTX Team has documented in recent months. The campaign — active since at least mid-May 2026 and reaching victims across 57 countries and 15 industry verticals — does not rely on any single clever trick.
#XWorm#RAT#purchaseorderlure#compile-after-delivery#sandboxevasion#LatinAmerica#financialservices#manufacturingIOCf11 · i1 · d1 · u3MITRE50RegionsAE · AT · AU · BDIndustriesArts & Entertainment · Automotive · Construction
C&CMembersJun 5, 2026, 08:24 (UTC+9)Signed-Adware Campaign Adds PubNubRAT and New C2 Backend
Since CTX Team's earlier coverage of this campaign's UnionPay-fingerprinted TLS infrastructure, the operation has expanded in two structurally significant directions: a wholly new, function-partitioned command-and-control backend has been provisioned under the domain tjbxldkj.cn, and eight fresh IP addresses bound by a shared Sectigo wildcard certificate have joined the delivery layer — all absent from the prior reporting.
#PubNubRAT#code-signingabuse#China-nexusthreatactor#cloudC2evasion#PCoptimizermalware#DigiCertcertificatemisuse#CDNdeliveryinfrastructure#sandboxevasionIOCf31 · i8 · d4 · u3MITRE23
C&CMembersJun 5, 2026, 08:07 (UTC+9)Stealc v2 Chromium Bypass Moves to Active Campaign in Vietnam
Three Windows executables circulating in a Vietnam-region campaign have been confirmed by sandbox analysis and six independent YARA rules as carrying Stealc v2's built-in bypass for Chromium app-bound encryption — a credential-protection mechanism Google introduced in 2024 specifically to block the kind of browser-password extraction that infostealer markets had relied on for years.
#Stealcv2#Amadey#clipboardhijacker#Chromiumapp-boundencryptionbypass#Vietnam#AS214351#credentialtheft#cryptocurrencytheftIOCf20 · i3 · d9 · u4MITRE31RegionsVN
APTMembersJun 5, 2026, 07:37 (UTC+9)Three Chinese Shell Firms, One DigiCert Chain, and a Kernel Driver in an Adware Campaign
Fourteen months of continuous payload production. Eleven distinct PE files — DLLs and installer EXEs alike — all bearing the same unrevoked leaf certificate issued to a single Beijing-registered technology company. A second Chinese entity in Chengdu holding its own valid DigiCert credential, and a third Chengdu firm with a third.
#SaltySpider#BYOVD#WinRing0#code-signingabuse#PUAadware#China#DigiCertcertificatechain#CDNfrontingActorsSalty Spider · KuKuIOCf37 · i12 · d3 · u3MITRE32
C&CMembersJun 4, 2026, 23:51 (UTC+9)Phorpiex Botnet Runs Six-Path C2 Panel With Tor Fallback to Target Mexico
A single IP address geolocated to the Seychelles is currently serving six sequentially numbered HTTPendpoints — /cc11, /cc22, /cc33, /cc44, /cc55, and /cc66 — alongside a Tor hidden-service fallback, forming the operational backbone of an active Phorpiex botnet campaign targeting Mexico. CTX Team first observed this infrastructure on 4 June 2026.
#Phorpiex#botnet#C2infrastructure#sandboxevasion#Torhiddenservice#Mexico#ransomware#time-basedevasionIOCf3 · i3 · d1 · u7MITRE36RegionsMX
C&CMembersJun 4, 2026, 23:40 (UTC+9)Ludashi Campaign Staged Eight C2 Subdomains Four Months Before First Payload
Since CTX Team's earlier coverage established the signed-binary tradecraft at the core of this operation, the picture of how those payloads reach victims has come into focus. The new signal is entirely network-side: eight xhyktech.com subdomains provisioned in a single registration batch on 2025-03-10, three of them now unified under a wildcard TLS certificate issued by the Chinese CA iTrust, Inc.
#Ludashi#ZXStoreX#xhyktech.com#adware#CDNfronting#codesigningabuse#Chinesethreatinfrastructure#pluginloaderIOCf13 · i3 · d8 · u9MITRE43
APTMembersJun 4, 2026, 23:26 (UTC+9)CapableWin Adware Suite Signed in Nine Minutes, Certificate Still Live
Seven Windows executables branded as "CapableWin" — a Chinese-language PC utility marketed as 全能电脑助手, or "All-in-One PC Assistant" — were compiled, versioned, and signed within a nine-minute window on the morning of 8 September 2025, all carrying a currently-valid GlobalSign code-signing certificate issued to Beijing entity 北京华网智讯软件有限公司 that remains unrevoked despite detection rates reaching 39 of 77 engines across the suite.
#MustangPanda#SoftCnApp#IcedID#code-signingabuse#CDNtrafficblending#Chineseadwareecosystem#PEoverlayconcealment#WindowsendpointActorsMustang Panda · HoneyMyteIOCf7 · i27 · d0 · u0
APTMembersJun 4, 2026, 23:13 (UTC+9)19 Trojanized IME Files Share One DigiCert Cert, Route C2 Through China's Largest CDN
##One Certificate, Nineteen Payloads: How a Wubi IME Trojan Hides Behind a Valid DigiCert Signature and China's Largest CDN Nineteen Windows executables — all masquerading as the 万能五笔输入法 (WanNeng Wubi IME) Chinese input-method suite and all carrying a single valid DigiCert code-signing certificate issued to Shanghai Oriental Webcasting Co. Ltd.
#SaltySpider#SoftCNApp#Burden#Fragtor#code-signingabuse#CDNinfrastructureblending#ChineseIMEmasquerade#ICMPreconnaissanceActorsSalty Spider · KuKuIOCf23 · i10 · d0 · u0MITRE10
APTMembersJun 4, 2026, 19:21 (UTC+9)APT28 Hides RAT Stack Inside Trojanised Deepfake AI Tool
A 43-megabyte Windows executable named Deep-Live-Cam-VFX.exe — convincingly dressed as a popular open-source deepfake application — has been circulating across at least nine independent submission sources, carrying inside it a PyInstaller-packed payload cluster that drops VenomRAT, a clipboard hijacker, and a browser credential stealer onto victim machines.
#APT28#VenomRAT#njRAT#LummaStealer#deepfakelure#VietnamC2infrastructure#credentialharvesting#cryptocurrencywallettheftActorsAPT28 · StrontiumIOCf9 · i0 · d3 · u3MITRE53RegionsNL · TR
C&CMembersJun 4, 2026, 11:37 (UTC+9)Shell Companies, Signed Malware, and a RAT Hidden in a PC Cleaner
Seventeen Windows binaries circulating across Chinese consumer software ecosystems carry valid DigiCert Trusted G4 Code Signing certificates — but the two Chengdu-registered entities that obtained those certificates appear to exist solely to launder signing trust onto malicious code. The scheme is not a one-off: CTX Team's analysis documents a deliberate rotation cycle spanning more than two years, with one entity procuring a replacement certificate within the same month its predecessor expired…
#PubNubRAT#code-signingabuse#Ludashiecosystem#shellcompanyinfrastructure#ChinaUnicombackbone#certificaterotation#supply-chaindelivery#sandboxevasionIOCf39 · i16 · d0 · u0MITRE17
FILEPublicJun 4, 2026, 07:55 (UTC+9)Gorgon Group's Remcos Campaign Hides Behind Three Evasion Layers and a Swiss No-Log VPN
A 131-kilobyte ZIP archive named "STATEMENT OF ACCOUNT - JULY'24.zip" is the entry point for a Remcos RAT campaign that layers three distinct anti-analysis mechanisms into its payload before beaconing to a Swiss no-log VPN node — a C2 address that was still receiving fresh TLS certificates as recently as May 2026, roughly six years after the initial payload cluster first appeared on VirusTotal.
#GorgonGroup#RemcosRAT#SmartAssemblyobfuscation#sandboxevasion#phishing#no-logVPNinfrastructure#financiallure#PEiDpackingActorsGorgon Group · SubaatIOCf6 · i1 · d0 · u1MITRE46
C&CMembersJun 4, 2026, 07:38 (UTC+9)Sality Botnet Still Active After 15 Years, Adds Zero-Detection Payload
Fourteen distinct HTTP beacon paths. Two C2 domains. A core sample that has been resubmitted to threat intelligence platforms continuously from July 2010 through October 2025. And, sitting at the edge of this campaign, a file submitted just days before this analysis — typed as JSON, carrying zero detections across 76 engines, with an alternate name pointing to a randomised executable path buried deep inside Program Files. The Sality polymorphic file-infector is not a relic.
#SaltySpider#Sality#Expiro#Tofsee#polymorphicfile-infector#USBautorun#Cameroon#C2infrastructureActorsSalty Spider · KuKuIOCf31 · i1 · d5 · u17RegionsCM
APTMembersJun 4, 2026, 07:09 (UTC+9)17-Year-Old Kernel Driver Powers 2026 Espionage Campaign Across Five Nations
A cryptominer, a clipboard hijacker, a reflective-loading stealer, and a Bring-Your-Own-Vulnerable-Driver instrument built from a kernel module first compiled in 2008 — this is the toolkit CTX Team has been tracking across targets in Brazil, India, Lithuania, Mexico, and Romania since late April 2026. The campaign's most operationally distinctive feature is not any single payload but the deliberate pairing of freshly compiled 2026-era commodity stealers with WinRing0x64.sys (sha256:…
#BYOVD#WinRing0x64#Vidarstealer#Salatstealer#clipboardhijacker#cryptominer#Lithuania#AezaGroupAS210644ActorsAPT28 · StrontiumIOCf22 · i2 · d0 · u4MITRE61RegionsBR · IN · LT · MX
C&CMembersJun 3, 2026, 23:52 (UTC+9)Stealc v2, ClipBanker, AgentB Hit Crypto Wallets via Single Rogue ASN
A financially motivated campaign active through May and June 2026 has deployed three functionally distinct malware families — Stealc v2, a ClipBanker, and an AgentB-family trojan — against the same command-and-control infrastructure, producing confirmed victim artefacts that include four encrypted Exodus cryptocurrency wallet files and a FileZilla FTP credential store.
#Stealcv2#ClipBanker#AgentB#cryptocurrencytheft#AS214351#importtableobfuscation#Exoduswallet#infostealerIOCf30 · i2 · d0 · u5MITRE43RegionsRS
FILEMembersJun 3, 2026, 20:26 (UTC+9)Gaming-Cheat Lures Deploy XWorm RAT and Monero Miner in Europe
##Gaming-Cheat Lures Deliver XWorm RAT and Monero Miner to European Windows Users A campaign targeting Windows users in Germany and Poland is exploiting the appetite for gaming-cheat utilities to deliver a dual-payload combination of XWorm remote-access trojan and XMRig Monero miner — a financially motivated operation that layers sandbox evasion, debugger detection, and PE timestamp manipulation to reduce the likelihood of activation in analyst environments.
#XWorm#XMRig#gaminglure#credentialtheft#cryptomining#Germany#Poland#sandboxevasionIOCf32 · i1 · d1 · u2MITRE17RegionsDE · PL
APTMembersJun 3, 2026, 19:10 (UTC+9)13 Trojanized Updates, Two Live Certs: Inside a Chinese CDN Signing Abuse Campaign
Thirteen malicious Windows executables bearing valid, unrevoked Authenticode signatures from two separate Chinese software vendors have been circulating inside the update pipelines of widely-installed consumer applications — a signed-binary abuse chain [T1553.002] that walks past Authenticode-based endpoint defences on every build produced across a six-month window.
#signedbinaryabuse#Authenticode#Chinadadware#Rhadamanthys#supplychaincompromise#Chineseconsumersoftware#CDNdelivery#Skip-2.0ActorsAPT28 · StrontiumIOCf28 · i26 · d2 · u6MITRE11
C&CMembersJun 3, 2026, 13:58 (UTC+9)1-of-76 Dropper Anchors Two-Year Microsoft Path Masquerade Campaign
A freshly compiled Windows executable detected by exactly one of 76 antivirus engines sits at the entry point of a multi-layered implant campaign that has been quietly refreshing its toolset for the better part of two years. The file calls itself SecurityHealthServiceSyncUpdate.exe, drops under C:\Program Files\Microsoft\Servicing\, and carries a PE compile timestamp of 2026-05-13 — one day before it first appeared on VirusTotal.
#SpringDragon#LotusBlossom#proxyware#trojanproxy#Microsoftpathmasquerade#Cloudflarefronting#APTespionage#WindowsimplantActorsSpring Dragon · Lotus BlossomIOCf6 · i7 · d3 · u0MITRE9
APTMembersJun 3, 2026, 12:23 (UTC+9)APT29 Deploys Four-Layer Browser Fingerprinting in Energy-Sector Spearphish
A spearphishing operation targeting energy-sector organisations has surfaced carrying an unusually disciplined anti-analysis architecture: two purpose-built domains deploying keyed URL access control, real-time browser fingerprinting via User-Agent Client Hints, per-victim randomized path generation, and a delivery-confirmation pixel beacon — four independent mechanisms operating in concert to profile victims, gate payload access, and frustrate automated detection, all before a single…
#APT29#CozyBear#spearphishing#browserfingerprinting#User-AgentClientHints#energysector#keyedURLaccesscontrol#campaigninfrastructureActorsAPT29 · MinidionisIOCf0 · i1 · d2 · u15MITRE4IndustriesEnergy
C&CMembersJun 3, 2026, 09:00 (UTC+9)TA505 Campaign Climbs Certificate Trust Ladder to Zero-Detection EV Binary
A single campaign distributing trojanized KMS activators and download-manager reset tools has assembled one of the more deliberately layered code-signing abuse chains CTX Team has documented in recent months: an expired Sectigo leaf certificate that still evades roughly 38 antivirus engines, a currently valid DigiCert chain carrying a MediaGet PUA, and — at the top of the trust ladder — a valid Extended Validation certificate issued to DeepL SE under GlobalSign's GCC R45 hierarchy, producing a…
#TA505#code-signingabuse#EVcertificate#KMSactivatorlure#ramnit#DLLsideloading#fast-fluxC2#credentialharvestingActorsTA505 · Hive0065IOCf10 · i3 · d2 · u0MITRE29
C&CMembersJun 3, 2026, 08:25 (UTC+9)Expired 2022 EV Timestamp Lets LockBit's IP Scanner Slip Past 74 of 76 AV Engines
A Varist-packed Windows executable weighing just over 20 megabytes is circulating via a spearphishing link at adbuho.shop/iqoja, presenting itself as the legitimate Famatech Corp. Advanced IP Scanner installer — and walking past 74 of 76 antivirus engines in the process. The secret to that near-total evasion is not a novel obfuscation technique or a freshly minted fraudulent certificate.
#LockBitGang#AdvancedIPScanner#code-signingabuse#living-off-the-land#Authenticodetimestamp#spearphishing#C2infrastructure#MediaFireCDNabuseActorsLockbit GangIOCf2 · i5 · d4 · u2MITRE4
C&CMembersJun 3, 2026, 04:26 (UTC+9)Fake Speed-Checker Masks a Decade-Long PUP Distribution Platform
Sixteen HTTPS requests. Two path templates. One hardcoded affiliate token. The architecture behind a shlayer-family PUP operation targeting energy-sector endpoints turns out to be less a piece of malware and more a managed distribution platform — one whose C2 infrastructure has been actively maintained into 2026 despite payload files that first appeared on VirusTotal in the summer of 2015.
#shlayer#PUPdistribution#C2infrastructure#affiliatetoken#self-signedcertificate#energysector#HTTPSmasquerade#update.buffernavpose.comIOCf2 · i0 · d1 · u16MITRE15IndustriesEnergy
APTMembersJun 3, 2026, 04:08 (UTC+9)Complete Mimikatz Toolkit Deployed in Telecom Credential Campaign
A fully intact Mimikatz 2.2.0.0 distribution — kernel driver, main executable, credential-interception DLL, PrintNightmare exploit module, and distribution archive, all ten components present across both x64 and x86 architectures — has been deployed alongside Impacket ntlmrelayx Python relay scripts and cross-platform Chisel tunnel binaries in a campaign targeting the telecommunications sector.
#Mimikatz#Impacketntlmrelayx#Chisel#PrintNightmare#NTLMrelay#credentialharvesting#telecommunications#ActiveDirectoryActorsSandworm · QuedaghIOCf22 · i0 · d0 · u0MITRE12IndustriesTelecommunications
APTMembersJun 2, 2026, 16:01 (UTC+9)Valid BitTorrent Certificate Smuggles Trojan Past Endpoint Defences
A trojanised uTorrent Web installer bearing a currently-valid BitTorrent Inc code-signing certificate — serial 07 57 ED 74 D0 2A B0 00 FE AB 74 59 A3 34 CB 63, issued by DigiCert and valid through 2026-12-16 — is circulating as a dropper for a multi-stage payload chain that combines living-off-trusted-infrastructure staging, a repurposed censorship-circumvention tool, and a scripted certificate-rotation playbook on adjacent Hurricane Electric addresses.
#code-signingabuse#UltraSurf#HurricaneElectric#NSISInetc#living-off-trusted-infrastructure#Tortunnelling#certificaterotation#trojandropperActorsMuddyWater · TEMP.ZagrosIOCf4 · i3 · d0 · u0MITRE15
FILEPublicJun 2, 2026, 12:47 (UTC+9)Signed Netease Emulator Files Hide MSSQL Backdoor, Fool All 76 AV Engines
Two trojanized components of Netease's MuMuPlayer Android emulator — both carrying a currently valid DigiCert code-signing certificate issued to Netease Interactive Entertainment Pte. Ltd. — have been identified embedding Skip-2.0 MSSQL authentication-bypass hooks inside legitimately signed Windows executables, achieving complete evasion across all 76 antivirus engines while routing command-and-control traffic through infrastructure that impersonates Akamai CDN.
#SpringDragon#Skip-2.0#MuMuPlayer#code-signingabuse#MSSQLbackdoor#educationandresearchsector#Akamaiimpersonation#supplychaincompromiseActorsSpring Dragon · Lotus BlossomIOCf2 · i3 · d1 · u0IndustriesEducation & Research
C&CMembersJun 2, 2026, 08:31 (UTC+9)Prometei Botnet Runs Three Years on SSH Exploits, One C2 Still Live
A 303-kilobyte Windows executable has been circulating since at least February 2023, quietly fetched by hosts compromised through internet-facing SSH and Telnet services, dropped into a Dell-branded subdirectory under a deliberately misspelled filename, and phoning home to a two-tier command-and-control architecture that spans a now-sinkholed domain and an active fast-flux node still live as of June 2026.
#Prometei#OilRig#Cactusransomware#SSHexploitation#healthcare#telecommunications#botnet#command-and-controlinfrastructureActorsOilRig · APT34IOCf2 · i1 · d2 · u2MITRE9IndustriesHealthcare · Telecommunications
C&CMembersJun 2, 2026, 08:17 (UTC+9)13-Node C2 Pool Borrows UnionPay Wildcard TLS to Mask Ludashi Adware
Thirteen China-geolocated IP addresses, distributed across five distinct autonomous systems, are presenting a wildcard TLS certificate belonging to UnionPay International Co., Ltd. as their HTTPS identity — a trust-borrowing technique that gives campaign traffic the appearance of legitimate Chinese financial-sector communications.
#Ludashiecosystem#UnionPaycertificateabuse#code-signingevasion#C2infrastructure#ChinaISP#adware#TLStrustabuse#DigiCertActorsFIN6 · Skeleton SpiderIOCf58 · i14 · d1 · u0MITRE3IndustriesTelecommunications
FILEMembersJun 2, 2026, 02:27 (UTC+9)Kimsuky Hides Guloader Behind Fake 'Brittlewort' Code-Signing Identity
A 326-kilobyte Windows executable named Zamówienie_Nr.2605011793800182.exe — Polish for "Order No." with a plausible invoice string appended — arrived in analysis pipelines on 18 May 2026 carrying a code-signing certificate issued by an entity called "Brittlewort." The name appears nowhere in any public certificate authority registry. It is self-issued, self-signed, and anchored to no trusted root.
#Kimsuky#Guloader#code-signingabuse#spear-phishing#sandboxevasion#Poland#NSISdropper#PEtimestampforgeryActorsKimsuky · Velvet ChollimaIOCf9 · i0 · d0 · u0MITRE18RegionsAU · DE · PLIndustriesAgriculture · Arts & Entertainment · Commercial Services
FILEMembersJun 2, 2026, 02:13 (UTC+9)Two EV Certificates Power Dual-Brand VPN Malware Evading Sandboxes
Seven Windows executables masquerading as legitimate VPN software — split across two distinct product families, WireVPN and VPNMaster — are circulating with valid Extended Validation code-signing certificates from two separate corporate entities, producing clean sandbox verdicts even as antivirus engines flag them at rates between 10 and 35 out of 76.
#Barium#APT15#WireVPN#VPNMaster#EVcode-signingabuse#sandboxevasion#foodandbeveragessector#trojanisedVPNsoftwareActorsBarium · Wicked SpiderIOCf15 · i8 · d25 · u3MITRE20IndustriesFood & Beverages
C&CMembersJun 2, 2026, 01:59 (UTC+9)One Signing Session Armed a Full Adware Suite With a Valid DigiCert Cert
On the morning of August 30, 2023, someone with access to Shanghai 2345 Mobile Technology Co., Ltd.'s code-signing infrastructure sat down and signed nine Windows components in rapid succession — SafeUpdate.dll at 7:36 AM, Optimize.dll at 7:34 AM, Exam.dll at 7:33 AM, AvScan.dll at 7:32 AM, and five more within the same narrow window.
#SaltySpider#2345PCSafe#adware#code-signingabuse#AlibabaKunlunCDN#ad2345#Amadey#ChinaActorsSalty Spider · KuKuIOCf40 · i13 · d1 · u2MITRE2
APTMembersJun 2, 2026, 01:04 (UTC+9)Trojanized Antivirus Suite Hides C2 in Alibaba CDN for Three Years
Ten malicious Windows DLLs, all signed within a single four-minute window on the morning of 30 August 2023, are circulating as components of a trojanized Chinese-language antivirus suite — and the operators behind them have constructed a delivery chain so thoroughly wrapped in legitimate infrastructure that three of the most common first-line defences fail simultaneously. The certificate is real. The domain is six years old.
#code-signingabuse#CDNblending#adware#dropper#Chinese-languagesoftware#DigiCertcertificate#AlibabaKunlunCDN#anti-analysisevasionActorsAPT28 · StrontiumIOCf16 · i32 · d1 · u10MITRE12
FILEMembersJun 1, 2026, 22:08 (UTC+9)Fake VPN Trojans Keep Two Invalid EV Certs Alive as Hosts Vanish
Seven Windows binaries circulating as fake VPN and proxy utilities are still riding on the same two Extended Validation code-signing identities they carried the last time CTX Team looked at this cluster — even though 22 domains, six IPs and three URLs have vanished from the campaign's front-end footprint since then. The payload side hasn't moved an inch: every signed sample in both families carries a leaf certificate that VirusTotal's chain validator flags as "not time valid," and every one of…
#code-signingabuse#EVcertificatereuse#WireVpn#VPNMaster#trojan.jumper#PUP#netfilterdriver#proxymalwareActorsBarium · Wicked SpiderIOCf15 · i2 · d3 · u0MITRE20IndustriesFood & Beverages
APTMembersJun 1, 2026, 20:47 (UTC+9)Five-Year Cert Rotation Engine Keeps Chinese-Ecosystem Malware Signed
Nine Windows executables and DLLs masquerading as MultiWeChat, TabX Explorer, Ludashi system utilities, and WPS Office components have been circulating with valid DigiCert code-signing certificates — not because a single company's identity was stolen, but because whoever operates this campaign has maintained sustained access to DigiCert's G4 code-signing infrastructure through six distinct Chinese-registered legal entities across a span of nearly five years.
#APT28#certificaterotation#codesigningabuse#Ludashi#QJWMonkey#CDNfronting#Chinesesoftwareecosystem#DigiCertActorsAPT28 · StrontiumIOCf11 · i6 · d4 · u1MITRE10
FILEMembersJun 1, 2026, 18:25 (UTC+9)XWorm Campaign Adds Bulletproof C2 Node on Freshly Registered Hosting
A new command-and-control node anchored to Freakhosting Ltd — a hosting provider whose RIPE block was allocated only on 2025-10-21 and whose organisation was registered as recently as 2026-01-22 — has been added to an ongoing XWorm RAT campaign that CTX Team has been tracking across multiple snapshots. The IP, 143.20.134.59, sits in the 143.20.134.0/24 network on ASN 215703 and carried just 3 of 91 engine detections at the time of analysis, meaning it was effectively invisible to the…
#XWorm#DarkTortilla#PureLogStealer#bulletproofhosting#dynamicDNS#manufacturingsector#purchase-orderlure#C2infrastructureIOCf11 · i1 · d0 · u1MITRE33RegionsAT · AU · BS · CAIndustriesChemicals · Commercial Services · Construction
C&CMembersJun 1, 2026, 17:38 (UTC+9)One DigiCert Cert, 22 New Payloads: Inside a Chinese Adware Signing Pipeline
Since CTX Team's earlier coverage of this operation, twenty-two additional signed Windows executables and five new command-and-control IP addresses have surfaced under the same Chengdu-registered signing identity — all bearing a DigiCert code-signing certificate that remains valid until May 2027 and has not been revoked. The expansion confirms that the operator behind 成都奇鲁科技有限公司 (Chengdu Qilu Technology Co.
#FIN6#adware#code-signingabuse#LuDaShisideloading#China#DigiCertcertificate#tjbxldkj.cn#consumerendpointActorsFIN6 · Skeleton SpiderIOCf41 · i13 · d7 · u9MITRE9
APTMembersJun 1, 2026, 17:20 (UTC+9)Fifteen New Addresses Cluster Inside One China Mobile ASN
Seventeen IP indicators sit in this record, and fourteen of them are new to this pass. Almost all of them — fifteen of the seventeen — resolve inside a single autonomous system: AS9808, registered to China Mobile Communications Group Co., Ltd. That concentration is the most consequential fact in this update, eclipsing the signed-binary story that anchored earlier coverage of this cluster.
#SaltySpider#PubNubRAT#AS9808#ChinaMobilecarrierinfrastructure#wildcardTLScertificateabuse#signedadware#codesigningcertificate#CDNspoofingActorsSalty Spider · KuKuIOCf103 · i17 · d1 · u1MITRE17
FILEMembersJun 1, 2026, 12:10 (UTC+9)Four-Detection BAT Stager Opens Door to Czech Utilities via Bitbucket CDN
An 8-kilobyte DOS batch file that only four of 76 antivirus engines flag at submission time is the opening move in a campaign targeting Czech utilities infrastructure — and the low detection count is not an accident. The file, nott.bat, carries two YARA rule hits that expose its construction: SUSP_PS1_JAB_Pattern_Jun22_1, which detects UTF-16 and Base64-encoded PowerShell opening with a single-character variable, and Base64_Encoded_URL, which fires on embedded encoded URI strings.
#trojan.msil/jalapeno#Alien#CzechRepublic#utilitiessector#Bitbucketabuse#ZeroSSLC2#BATstager#PowerShelldownloaderIOCf15 · i2 · d0 · u0MITRE34RegionsCZIndustriesUtilities
APTMembersJun 1, 2026, 10:22 (UTC+9)Chengdu Operator Hides RAT Inside Adware Using Dual DigiCert Certs
Nineteen of twenty Windows executables and DLLs circulating under fake Chinese security-product brands — SafeSpace, ByteLocker, DataVault, LhpMaxProtect, LhpNetSentinel, and a half-dozen others — carry valid DigiCert Trusted G4 code-signing certificates issued to two Chengdu-registered entities, a signed-binary abuse strategy [T1553.002] that drives detection ratios as low as 12 of 76 engines on the largest payloads.
#PubNubRAT#Ludashi#code-signingabuse#certificateevasion#telecommunicationssector#Chengdu#adware-as-cover#C2infrastructureActorsFIN6 · Skeleton SpiderIOCf54 · i11 · d10 · u14MITRE10IndustriesTelecommunications
FILEMembersJun 1, 2026, 07:20 (UTC+9)Scully Spider's 14-File Catalog Reveals a Decade of Mandatory Packing
Fourteen executable files. Six malware families spanning nearly two decades of Windows-targeting tradecraft. No shared infrastructure, no code-signing certificates, no passive DNS to pivot on — and yet a single, unmistakable operational signature runs through every destructive payload in the set: before anything reaches a victim machine, it gets packed.
#ScullySpider#TA547#UPXpacking#reflectiveDLLloading#CryptoWall#Rokku#Zloader#defenseevasionActorsScully Spider · TA547IOCf14 · i0 · d0 · u0MITRE8
C&CMembersJun 1, 2026, 07:00 (UTC+9)Salty Spider Pivots to Valid WPS Certificate for Near-Invisible Telecom Implant
Six Windows executables circulating as VPN and proxy clients are carrying code-signing certificates from two Singapore-registered entities — INNOVATIVE CONNECTING PTE. LIMITED and WEILAI NETWORK TECHNOLOGY CO., LIMITED — whose DigiCert and GlobalSign EV credentials expired in April 2026 yet continue to present intact Authenticode chains that most endpoint controls will not challenge.
#SaltySpider#code-signingabuse#EVcertificate#VPNMaster#KingsoftWPSOffice#telecommunications#Asia-Pacific#trojanisedinstallerActorsSalty Spider · KuKuIOCf6 · i14 · d39 · u4MITRE13IndustriesTelecommunications
C&CMembersJun 1, 2026, 06:27 (UTC+9)Ludashi C2 Expands: Two .cn Clusters, Shared IPs, and a New Browser Injector
Nine new domains and 13 IP addresses have been added to the Ludashi campaign's observable footprint since CTX Team's earlier coverage, and the infrastructure picture they complete is more deliberate than the raw count suggests. Two parallel command-and-control domain families — whnuowo.cn and tjbxldkj.cn — are now fully mapped, their subdomains provisioned in coordinated batches under iTrust DV wildcard certificates, their config endpoints resolving to a single shared IP that stitches the two…
#Ludashi#FIN6#TA428#MasterBHO#PubNubRAT#browserhelperobject#commandandcontrol#ChinaActorsFIN6 · Skeleton SpiderIOCf31 · i13 · d9 · u6MITRE9
FILEPublicJun 1, 2026, 01:53 (UTC+9)FUZZBUNCH Toolkit Bundles EternalBlue and DarkPulsar in Single APT40 Package
Nineteen files. One deployable directory tree. A complete offensive capability spanning SMB exploitation, kernel-level persistence, Tor-routed command-and-control, and a Python orchestration layer — all assembled from components whose PE compile timestamps span more than a decade of development. The FUZZBUNCH/ShadowBrokers toolkit now attributed in CTX Team's tracking to APT40, with healthcare flagged as the targeted sector, is not a collection of loosely related tools.
#APT40#EternalBlue#DarkPulsar#FUZZBUNCH#ShadowBrokers#healthcaresector#SMBexploitation#kernelbackdoorActorsAPT40 · MudcarpIOCf19 · i0 · d0 · u0IndustriesHealthcare
C&CMembersJun 1, 2026, 00:45 (UTC+9)Four Corporate Fronts, One Build Pipeline: 18-Month DigiCert Signing Spree
Fifteen signed Windows executables. Four registered Chinese companies. One DigiCert certificate authority chain threading through all of them. The campaign CTX Team has been tracking across an 18-month window does not rely on a single forged credential or a stolen certificate — it relies on something more durable: a systematic program of acquiring legitimate DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 certificates under distinct corporate identities, then rotating those identities…
#DigiCertcertificateabuse#Authenticodesigningrotation#PEoverlaytechnique#sandboxevasion#Ludashi#PubNubRAT#Chinesefrontcompanies#consumersoftwarebundlingIOCf86 · i8 · d1 · u1MITRE25
APTMembersMay 31, 2026, 23:52 (UTC+9)Void Arachne Splits DigiCert Abuse Across Three Firms to Outrun Revocation
Eight PE32 executables dressed as consumer disk cleaners and Android emulator components are circulating with valid DigiCert G4 code-signing certificates obtained under three distinct Chinese legal entities — a deliberate identity-fragmentation strategy that keeps each certificate clean while a shared packing toolchain quietly links the clusters behind the scenes.
#VoidArachne#SilverFox#DigiCertcode-signingabuse#PubNubRAT#certificatefragmentation#ChinaMobileinfrastructure#trojanisedutilitysoftware#C2camouflageActorsVoid Arachne · Silver FoxIOCf11 · i2 · d5 · u4MITRE4
FILEMembersMay 31, 2026, 21:00 (UTC+9)APT28 Deploys 11-Year-Old Signed Kernel Driver in Layered Credential-Theft Campaign
A financially themed ZIP archive named HSBC_PAYMENT_ADVICE0293845678.zip is circulating as the opening move in a layered attack chain that deploys a signed vulnerable kernel driver first seen in 2015 alongside a freshly compiled DLL sideloading payload and an AgentTesla infostealer equipped with active sandbox-evasion logic.
#APT28#AgentTesla#BYOVD#xkpsm.sys#DLLsideloading#financialsector#credentialtheft#kerneldriverabuseActorsAPT28 · StrontiumIOCf43 · i0 · d0 · u0MITRE27RegionsAE · AT · AU · BDIndustriesConstruction · Engineering · Financial Services
APTMembersMay 31, 2026, 19:32 (UTC+9)Valid DigiCert Cert Turns 2345 SafeCenter Update Channel Into Malware Pipeline
Seventeen Windows PE files masquerading as components of the 2345 SafeCenter security suite and HaoZip archiver are circulating with a currently-valid DigiCert code-signing certificate issued to Shanghai 2345 Mobile Technology Co., Ltd. — a credential that suppresses Windows SmartScreen warnings and causes automated sandbox platforms to return clean verdicts on samples that 25 to 38 static antivirus engines simultaneously flag as adware.
#SaltySpider#ad2345#Chinad#code-signingabuse#SQLServerauthenticationbypass#CDN-hostedpayloaddelivery#sandboxevasion#ChinaActorsAPT28 · StrontiumIOCf17 · i41 · d1 · u2MITRE8
FILEMembersMay 31, 2026, 18:27 (UTC+9)Trojanised BitComet Campaign Engineers 33-Engine Detection Gap via Shared Certificate
##A Certificate Hiding in Plain Sight: How a Trojanised BitComet Campaign Engineers Its Own Detection Gap Five Windows executables. Two code-signing identities. One AWS CloudFront subdomain. And a payload chain carefully tuned so that the component most likely to reach an endpoint registers a detection rate of just 2 out of 76 antivirus engines — while its outer wrapper, signed by the same certificate, flags on 35. That arithmetic is not an accident.
#DealPly#OfferCore#code-signingabuse#CDNfronting#sandboxevasion#adware#financialservices#CloudFrontIOCf58 · i4 · d1 · u0MITRE4RegionsAD · AE · AL · ARIndustriesArts & Entertainment · Education & Research · Financial Services