FILEMembersMay 31, 2026, 18:12 (UTC+9)Conduit-Signed Adware Dropper Achieved 6/54 Detections With Stomped Timestamps and C2 Victim Profiling
A 1.28 MB Windows executable signed with a then-valid Conduit Ltd. code-signing certificate achieved just 6 of 54 possible antivirus detections while concealing a compressed multi-payload bundle in a resource section registering entropy of 8.0 — the maximum possible for a randomly distributed byte stream. That single file, the entry point for a vigram-family adware campaign targeting technology-sector users in Spain, illustrates a layered evasion architecture that goes well beyond commodity…
#vigram#adware#code-signingabuse#browserhelperobject#PEtimestampstomping#Spain#technologysector#C2victimprofilingIOCf17 · i1 · d1 · u2MITRE22RegionsESIndustriesTechnology
C&CMembersMay 31, 2026, 18:00 (UTC+9)Ludashi Adware Operator Rotates to Third DigiCert Certificate Across Three Chinese Entities
Since CTX Team's earlier coverage of the Ludashi/LuDaShi adware ecosystem, 26 additional signed PE files and 97 IP addresses have surfaced, and the most operationally significant development is not the volume — it is what the new files reveal about how the operator manages its code-signing infrastructure. A third DigiCert G4 code-signing certificate, issued to a third distinct Chinese legal entity, has now appeared in the campaign, completing a picture of deliberate, institutionalized identity…
#Ludashi#code-signingabuse#certificaterotation#adware#Chinesethreatactor#C2infrastructure#DigiCert#defenseevasionActorsFIN6 · Skeleton SpiderIOCf47 · i97 · d0 · u0MITRE6
APTMembersMay 31, 2026, 17:42 (UTC+9)TA505 ServHelper C2 Expands: Three DGA Domains, One Operator Fingerprint
Four new command-and-control domains and eight associated URLs have surfaced in the ongoing ServHelper campaign tracked by CTX Team, extending a C2 infrastructure cluster whose internal consistency is striking in its operational discipline. The new additions — three algorithmically generated .xyz domains and a structurally isolated .cn outlier — carry fingerprints that converge on a single provisioning workflow: identical obfuscated WHOIS registrant tokens, uniform nameserver delegation through…
#TA505#ServHelper#C2infrastructure#DGAdomains#RDPWrap#Let'sEncryptabuse#certificatetransparency#WHOISobfuscationActorsTA505 · Hive0065IOCf16 · i1 · d4 · u8MITRE43
APTMembersMay 31, 2026, 17:24 (UTC+9)Salty Spider Hides Espionage Tool in Decade-Old Adware Bundle
A 2.3-megabyte Windows executable bearing "iMesh Inc" copyright metadata is circulating as what appears to be a routine peer-to-peer client installer — but the binary, tracked by CTX Team as iMeshV22.exe, bundles the Cydoor and SaveNow adware families inside a delivery chain that combines PEiD and Armadillo packing, active debugger detection, and a version-check beacon that registers each new victim with encoded telemetry.
#SaltySpider#Cydoor#SaveNow#adware#sandboxevasion#educationsector#France#trojanisedinstallerActorsSalty Spider · KuKuIOCf18 · i0 · d4 · u2MITRE43RegionsFR · GB · NCIndustriesEducation & Research
FILEPublicMay 31, 2026, 09:27 (UTC+9)Plesk Default Certificate Exposes All Eight LummaStealer C2 Domains
Eight command-and-control domains serving an active LummaStealer campaign share a single Let's Encrypt TLS certificate whose subject common name reads admiring-poincare.37-77-150-150.plesk.page — the auto-generated Plesk control-panel hostname for the raw IP address 37.77.150.150, hosted on Proton66 OOO (ASN 198953) in Russia.
#LummaStealer#Pleskcertificatefingerprint#Proton66OOO#LOLBinimpersonation#code-signingchaingrafting#technologysectortargeting#Spain#MexicoIOCf18 · i1 · d9 · u17MITRE25RegionsES · MXIndustriesTechnology
C&CMembersMay 31, 2026, 09:10 (UTC+9)Signed Bright Data SDK Delivers PBot Stealer via Three-Layer Evasion Stack
A 9.27-megabyte Windows executable, validly signed under a live DigiCert code-signing chain issued to Bright Data Ltd, is circulating as a trojanised update component placed directly inside Bright VPN and DriverHub installation directories — a delivery mechanism that exploits the grey-area status of commercial proxy-network software to suppress detection across the majority of the antivirus industry.
#PBot#BrightDataSDK#code-signingabuse#Dotfuscatorobfuscation#CDNcertificatemasquerading#commercialservicessector#China-geolocatedinfrastructure#supplychaindeliveryIOCf41 · i17 · d2 · u0IndustriesCommercial Services
C&CMembersMay 31, 2026, 08:55 (UTC+9)Dual DigiCert Certs Keep Ludashi Adware Invisible for 15 Months
Sixteen Windows executables carrying valid, unrevoked DigiCert code-signing certificates issued to two distinct Chinese companies have been circulating as trojanized PC-optimization installers across a fifteen-month window — a sustained signed-binary abuse campaign that returns a clean verdict from every sandbox that examines it, even as detection ratios on the same files reach as high as 38 of 77 engines on VirusTotal.
#Ludashi#code-signingabuse#Authenticodeevasion#adware#ChinesePUA#whnuowo.cn#DigiCertcertificateabuse#CDN-frontedC2ActorsTA551 · ShathakIOCf32 · i23 · d5 · u2MITRE6
C&CMembersMay 31, 2026, 08:41 (UTC+9)Upatre C2 Cluster Exploits Freshly Allocated French IP and 16-Year-Old Domain
Since CTX Team's earlier coverage of this Upatre dropper campaign targeting US media-sector organisations, the infrastructure picture has sharpened considerably. The update adds no new file samples — the dropper payload itself remains unchanged — but surfaces one new C2 IP address, two new domains, and three confirmed URL-form beacon paths that together complete a hosting architecture the prior snapshot could only partially sketch.
#Upatre#Waski#C2infrastructure#USmediasector#domainre-weaponisation#OrangeAS5511#droppercampaign#Let'sEncryptabuseIOCf3 · i1 · d2 · u3MITRE17RegionsUSIndustriesMedia
APTPublicMay 31, 2026, 08:29 (UTC+9)Single DigiCert Certificate Ties 11 Trojanized Files Across Two 2345 Product Lines
Eleven Windows executables and DLLs, all bearing a currently valid DigiCert code-signing certificate issued to Shanghai 2345 Mobile Technology Co., Ltd., have been confirmed as part of an expanding trojanized software campaign that now spans two distinct 2345 product lines — the SafeCenter security suite and the HaoZip archiving utility — across two coordinated build events separated by twenty days.
#Shanghai2345MobileTechnology#code-signingabuse#DigiCertcertificate#SafeCenter#HaoZip#sandboxevasion#AlibabaCDN#Skip-2.0ActorsAPT28 · StrontiumIOCf17 · i43 · d1 · u2MITRE8
C&CMembersMay 31, 2026, 04:56 (UTC+9)Three-Layer Evasion Stack Targets Education Networks via Per-Victim Phishing URLs
Thirteen individualised phishing URLs, each carrying a distinct base64-encoded payload that fingerprints the victim's browser before deciding whether to proceed — that is the opening move of a campaign CTX Team has been tracking against the education and research sector, built on infrastructure that layers domain-generation algorithm tagging, fast-flux DNS across eight A-records at 60-second TTLs, and a CNAME redirect through a secondary unanalysed domain, all backed by freshly provisioned…
#spearphishing#fast-fluxDNS#browserfingerprinting#educationsector#C2infrastructure#domaingenerationalgorithm#redirectchain#credentialharvestingIOCf0 · i2 · d1 · u13MITRE10IndustriesEducation & Research
APTMembersMay 31, 2026, 04:42 (UTC+9)One DigiCert Certificate, 14 Malicious Binaries, 18 Months Unrevoked
A single unrevoked DigiCert code-signing certificate — issued to the Chinese entity 成都奇鲁科技有限公司 and carrying serial number 0D 07 8E 70 EA EE 48 FF EB 95 76 BD D4 00 BE 98, valid from May 21, 2024 through May 20, 2027 — has been used to sign 14 distinct malicious Windows binaries deployed across at least six consumer-facing product brands over an 18-month window.
#Ludashi#code-signingabuse#PUAadware#CDNfronting#TencentAPIGateway#telecommunications#China#SuperAppActorsFIN6 · Skeleton SpiderIOCf26 · i1 · d7 · u12MITRE10IndustriesTelecommunications
FILEMembersMay 30, 2026, 23:44 (UTC+9)Gold Evergreen's Vidar Variant Hits Indonesia With Six-Layer Evasion Stack
A 1.41-megabyte unsigned Win32 executable, packed to near-maximum entropy and fetched silently through an Internet Explorer cache path, is at the centre of a credential-theft operation targeting Windows users in Indonesia. The payload — confirmed as a Vidar stealer variant by three independent YARA rules and a Zenbox sandbox classification of MALWARE/STEALER/TROJAN/EVADER at 100% confidence — does not simply steal and exfiltrate.
#GoldEvergreen#Vidarstealer#Arkeistealer#sandboxevasion#cryptocurrencywalletharvesting#dual-channelC2#Indonesia#credentialtheftActorsGold Evergreen · Business ClubIOCf1 · i0 · d0 · u4MITRE11RegionsID
C&CMembersMay 30, 2026, 23:28 (UTC+9)Phorpiex Botnet Splits C2 Across Russian and AFRINIC Hosts to Resist Takedown
A single 14-kilobyte Windows executable — compact enough to fit in a single memory page — is beaconing outward to two command-and-control servers that have been deliberately placed in different corners of the internet's address space. One sits inside a subnet allocated to Prospero OOO, a St. Petersburg-registered provider operating under AS200593 through RIPE NCC, and carries a short-lived Let's Encrypt certificate for the domain "ledgersinsured.com" as its TLS cover.
#Phorpiex#botnetC2infrastructure#ProsperoOOO#AFRINIC#ransomware#Uzbekistan#TLScertificateabuse#wormpropagationIOCf1 · i2 · d0 · u8MITRE47RegionsUZ
FILEMembersMay 30, 2026, 21:27 (UTC+9)Patchwork Hides Kernel Driver and Crypto Miner in Pirated Game Crack
A 496-megabyte file masquerading as a Football Manager 2024 crack is the entry point for one of the more technically layered campaigns CTX Team has recently dissected — a multi-stage operation attributed to Patchwork that bundles a Bring-Your-Own-Vulnerable-Driver kernel exploit, a cryptocurrency miner dressed as a Windows system binary, and a persistent obfuscation pipeline, all delivered through the oldest social-engineering lure in the book: pirated software.
#Patchwork#BYOVD#WinRing0x64#XMRig#AutoIT#cryptocurrencymining#telecomsector#kernelexploitationActorsPatchwork · ChinastratsIOCf16 · i0 · d0 · u0MITRE41RegionsAU · BR · CM · ITIndustriesTelecommunications
FILEMembersMay 30, 2026, 21:15 (UTC+9)Fake Adobe Plugin Delivers Lumma Stealer and Cryptominer via Four-Layer Chain
A single typosquat domain — adobe-plugin.info — sits at the front of a payload chain that is considerably more engineered than its lure suggests. Behind the Adobe branding lies a structured, automated build pipeline producing at least four distinct malware components: a GCleaner MSIL trojan, a PEiD-packed dropper variant, a compact Nitol persistence stub, and a dual-purpose monetisation stage that runs Lumma stealer and a cryptominer simultaneously on the same compromised host.
#BlueBottle#Lummastealer#CoinMiner03#Nitol#GCleaner#typosquatting#creativeandmediasector#ZIPdropperActorsBlueBottle · Opera1erIOCf13 · i0 · d1 · u1RegionsUS
APTMembersMay 30, 2026, 20:24 (UTC+9)Sims 4 Crack Lure Delivers CyberGate RAT Across Nine Countries
Three Windows executables dressed as Sims 4 crack installers and updaters are circulating across nine countries, carrying a CyberGate/Rebhip remote access trojan beneath a multi-layer evasion stack that combines NSIS dropper wrapping, active sandbox product-ID detection, and XOR-obfuscated PE stubs — a tradecraft combination deliberately engineered to defeat automated analysis pipelines before a human analyst ever sees the payload.
#Snowglobe#CyberGate#Rebhip#NSISdropper#sandboxevasion#educationsector#telecommunications#DDNSinfrastructureActorsSnowglobe · Animal FarmIOCf10 · i0 · d1 · u1MITRE41RegionsBE · LT · PL · RSIndustriesEducation & Research · Telecommunications
FILEMembersMay 30, 2026, 17:21 (UTC+9)XWorm RAT Hides C2 Behind Three Evasion Gates in RFQ Phishing Wave
A pair of Windows executables disguised as purchase-order documents began circulating on 7 May 2026, carrying a commodity remote-access trojan wrapped in enough evasion machinery to slip past automated analysis pipelines and arrive on victim systems with its command-and-control address still largely unknown to the industry. The campaign — tracked by CTX Team under the identifier CTXk3fv3k5gux — delivers XWorm RAT via a ZIP archive whose sole contents are a batch script named to mimic a…
#XWorm#SpyEx#procurementphishing#sandboxevasion#ip-api.comhosting-providercheck#energysector#manufacturingsector#commodityRATIOCf4 · i1 · d0 · u1MITRE40RegionsAL · AU · BD · CAIndustriesEnergy · Manufacturing · Retail
FILEMembersMay 30, 2026, 11:53 (UTC+9)Signed LummaStealer Bundle Clears 76 AV Engines With DigiCert Certificate
Five Windows executables carrying a valid, unexpired Reason Cybersecurity Inc. code-signing certificate — all signed in a single session at 08:53 AM on May 26, 2026, under DigiCert Trusted G4 certificate serial 07 8A A6 13 E0 E5 D5 AB 31 96 67 B9 3D 2B 96 73 — have been circulating as the payload core of a LummaStealer distribution campaign that achieves zero detections across 76 antivirus engines. The delivery vehicle is a trojanised uTorrent installer signed by BitTorrent Inc.
#LummaStealer#code-signingabuse#certificateevasion#uTorrentlure#CDNmasquerade#credentialtheft#scheduledtaskpersistence#DigiCertIOCf67 · i4 · d1 · u0MITRE49RegionsAE · AR · AT · AUIndustriesConsulting · Education & Research · Telecommunications
APTMembersMay 30, 2026, 10:44 (UTC+9)Chrome-Impersonating Mach-O Binaries Hit Government Macs With 0/76 AV Detections
Two universal Mach-O binaries impersonating Google Chrome — signed with a valid Apple Developer-issued certificate bearing the Google LLC identity, yet carrying a MissingPlist code-signing verdict that defeats Gatekeeper's full bundle validation — are circulating against government-sector macOS targets with zero detections across 76 antivirus engines.
#Cactus#MissingPlist#macOS#governmentsector#signedbinaryabuse#DNS-over-HTTPS#Chromeimpersonation#Mach-OActorsCactus · Cactus Ransomware GroupIOCf2 · i2 · d4 · u4MITRE5IndustriesGovernment
FILEMembersMay 30, 2026, 07:30 (UTC+9)Pay-Per-Install Campaign Adds CryptOne Dropper and Two C2 Domains in Nine Days
Since CTX Team's earlier coverage of this pay-per-install operation, the campaign has added ten new file indicators, stood up two freshly provisioned command-and-control domains within nine days of each other in May 2026, and introduced a raw-IP payload-delivery endpoint on a Netherlands-based host whose TLS certificate presents a deliberately misleading identity.
#pay-per-install#CryptOne#Microleavesadware#ORYONTECHLIMITED#OmegatechLTD#EVcertificateabuse#fakecrackedsoftware#NetherlandsC2infrastructureIOCf23 · i1 · d3 · u6MITRE31RegionsBR · EG · GB · PLIndustriesTechnology
C&CMembersMay 30, 2026, 07:04 (UTC+9)Trojanised VPN Installer Weaponises Two Legitimate Code-Signing Chains
A 14.5-megabyte NSIS self-extracting archive named WireVpn_v3.6.0.3-6872e76.exe has been circulating through a curated software-distribution channel labelled "TS Recommended Apps" — bearing a valid Extended Validation code-signing certificate from GlobalSign, issued to a Chinese-registered entity called WEILAI NETWORK TECHNOLOGY CO., LIMITED, and dropping kernel-level netfilter drivers alongside proxy and jumper binaries that collectively form an espionage-oriented command-and-control platform.
#WireVPN#PBot#WEILAINETWORKTECHNOLOGY#BrightDataSDK#code-signingabuse#netfilterkerneldriver#signedbinaryproxyexecution#credentialstealerActorsSprite Spider · Gold DupontIOCf27 · i27 · d94 · u12MITRE24
APTMembersMay 30, 2026, 06:22 (UTC+9)One Code-Signing Cert, 15 Malware Families, Valid Until 2027
A single DigiCert code-signing certificate issued to a Chinese commercial entity has been used to sign 15 distinct malicious PE32 executables spanning six threat families over a twelve-month window — and it remains valid through May 2027. The certificate, issued to 成都奇鲁科技有限公司 (serial 0D078E70EAEE48FFEB9576BDD400BE98, thumbprint EC5BB0C4BE5D6F7CD9D863D6585CF1F3EF58FDA0), has functioned as a persistent OS-level trust bypass [T1553.002] across the entire payload portfolio, enabling malicious…
#SaltySpider#Ludashi#Chinad#Doina#code-signingabuse#ChinesePUAecosystem#signedbinaryproxyexecution#certificaterevocationgapActorsGroup123 · Venus 121IOCf23 · i5 · d2 · u0MITRE16
FILEMembersMay 30, 2026, 01:34 (UTC+9)Frozen RAT Builder, Free DNS Alias Keep klovbot Active Since 2017
Sixteen Windows PE32 executables tied to the klovbot malware family are circulating against technology-sector targets in Moldova, and the most operationally revealing detail about the campaign is not the payload — it is the degree to which the operator has changed almost nothing since at least 2017. Three of those files carry enough metadata for deep analysis, and what that analysis surfaces is a tradecraft combination that has outlasted most of the defensive signatures written against it: an…
#klovbot#DarkKomet#XRed#dynamicDNS#Moldova#technologysector#sandboxevasion#USBspreaderIOCf16 · i1 · d0 · u0MITRE24RegionsMDIndustriesTechnology
C&CMembersMay 30, 2026, 00:50 (UTC+9)Sequential C2 Panel Paths Expose Seychelles-Registered Bulletproof Hosting Behind Spain Infostealer Campaign
Three new command-and-control IP addresses have surfaced in the latest observation window of a SmokeLoader and Rhadamanthys infostealer campaign targeting victims in Spain — and the way those addresses were provisioned tells a more precise story than the malware families themselves. Two of the IPs share a single autonomous system number, AS202412, registered to Omegatech LTD, a Seychelles-incorporated entity whose RIPE NCC address block allocations were created within a single month of each…
#SmokeLoader#Rhadamanthys#bulletproofhosting#credentialtheft#Spain#cryptocurrencywallettheft#C2infrastructure#infostealerActorsAPT28 · StrontiumIOCf34 · i3 · d0 · u4MITRE49RegionsES
APTMembersMay 30, 2026, 00:33 (UTC+9)SmokeLoader Campaign Adds Trojanized Card-Checker Lure, Third C2 Node
Since CTX Team's earlier coverage of this SmokeLoader-driven infostealer operation, seven new file indicators have surfaced alongside a full refresh of the campaign's three command-and-control IPs — and the most significant development is not the infrastructure update but what it reveals about how the operator is now getting onto victim machines.
#SmokeLoader#trojan.marsilia#APT39#infostealer#bulletproofhosting#Spain#cryptocurrencytheft#logmarketplaceActorsAPT39 · ChaferIOCf35 · i3 · d0 · u5MITRE48RegionsES
C&CMembersMay 29, 2026, 20:56 (UTC+9)Six-Year-Old Phorpiex Dropper Hits Kazakhstan on Fresh Romanian VPS
A 412-kilobyte Windows executable — unsigned, packed, and masquerading as a tape-toolbar utility from the year 2000 — has been actively beaconing to a freshly provisioned Romanian virtual private server since at least March 2026, deploying a three-capability payload stack against education and government targets in Kazakhstan.
#Phorpiex#ClipBanker#USBworm#Kazakhstan#educationsector#governmentsector#clipboardhijacking#commoditybotnetIOCf8 · i1 · d0 · u10MITRE36RegionsKZIndustriesEducation & Research · Government
APTMembersMay 29, 2026, 19:27 (UTC+9)Two Shell Companies, Two DigiCert Certs, One Ludashi Campaign
Twenty Windows executables and DLLs carrying currently-valid DigiCert code-signing certificates are circulating across telecom-sector endpoints, each one disguised as a routine Windows system utility — a PC cleaner, a BSOD repair tool, a browser protection suite — and each one backed by a C2 cluster that routes through China Unicom's backbone while presenting financial-services TLS cover.
#FIN6#TA428#lockergoga#ncctrojan#lummastealer#TelecommunicationsActorsFIN6 · Skeleton SpiderIOCf29 · i2 · d4 · u4MITRE6IndustriesTelecommunications
APTMembersMay 29, 2026, 18:20 (UTC+9)Revoked Certum Cert Evades 75 of 76 Engines in Ludashi Adware Pivot
Two freshly minted Windows executables, both signed by a previously unseen Chinese entity called 深圳市禹仁科技有限公司 and both carrying a Certum code-signing certificate that had already been revoked at the time of deployment, surfaced on VirusTotal on 23 May 2026 — just six days before CTX Team's analysis. One of the two files, a 346-kilobyte PE32 executable installed under C:\Program Files (x86)\ProZip\Bin\nhlj32.exe, was flagged by exactly one of 76 scanning engines.
#FIN6#SaltySpider#lockergoga#lummastealer#salityActorsFIN6 · Skeleton SpiderIOCf26 · i11 · d10 · u8MITRE16
APTMembersMay 29, 2026, 17:53 (UTC+9)Four Shell Companies, One CA: How Ludashi Buries Payloads in Trusted Certs
Seventeen Windows executables and DLLs. Four distinct Chinese corporate identities. A single DigiCert intermediate certificate authority threading through all of them. That is the structural core of a Ludashi adware and trojan campaign that CTX Team has been tracking across a ten-month payload timeline stretching from July 2025 through late May 2026 — a campaign that uses rotating shell-company code-signing certificates, deliberate PE header corruption, and a pre-staged CDN infrastructure built…
#PatchworkActorsPatchwork · ChinastratsIOCf20 · i8 · d10 · u52MITRE18
FILEMembersMay 29, 2026, 14:42 (UTC+9)Single Sectigo EV Certificate Signs Four Malicious Payloads in One Batch
Four malicious Windows executables — spanning PE32, PE32+, and MSI formats, collectively masquerading as a legitimate system utility suite called "Advanced Windows Manager" — were signed with a single valid Sectigo Extended Validation code-signing certificate in one batch event on the morning of 23 April 2026. The certificate, issued to an entity named "ORYON TECH LIMITED" under the Sectigo Public Code Signing CA EV R36 chain (serial 21 E3 D5 C7 00 22 7E A0 2E E6 84 AF 4F 8F 88 40, thumbprint…
#ORYONTECHLIMITED#GCleaner#EvilCh/CryptOne#pay-per-install#EVcertificateabuse#code-signing#Egypt#UnitedKingdomIOCf23 · i1 · d3 · u7MITRE48RegionsEG · GBIndustriesTechnology
C&CMembersMay 29, 2026, 14:28 (UTC+9)PBot Stealer Gets 64-Bit Rebuild, Drops to 9/76 Detections
Since CTX Team's earlier coverage of this VPN-lure PBot stealer campaign, the most operationally significant development is not the expansion of the domain or IP set — though both have grown substantially — but a single freshly compiled binary that signals the operator is actively retooling the payload build pipeline rather than coasting on existing artifacts.
#ramnit#beaconIOCf9 · i28 · d51 · u6MITRE23
APTMembersMay 29, 2026, 10:16 (UTC+9)Ludashi Campaign Expands C2 Layer With Cloud Proxy Evasion
Since CTX Team's earlier coverage of this campaign, the observable payload set has contracted while the network infrastructure has expanded dramatically — 21 new IP addresses, six new C2 domains, and seven new URLs have entered the picture, with zero new file payloads added. The delta is entirely in the network layer, and what it reveals is a meaningful escalation in how the operators route and obscure their command-and-control traffic.
#TA551#icedidActorsTA551 · ShathakIOCf19 · i21 · d6 · u7MITRE12
APTMembersMay 29, 2026, 10:04 (UTC+9)Emotet Revives 18-Year-Old Domains in Coordinated Chile Campaign
Three .com domains registered between November 2007 and January 2008 — old enough to predate the iPhone's first software update cycle — have been quietly reactivated as payload-staging and command-and-control nodes for an Emotet-linked campaign targeting Chile. The reactivation was not gradual. Between 17 April and 4 May 2026, all three domains received fresh 89-day Let's Encrypt certificates within a compressed 17-day window, a coordinated provisioning pass that CTX Team's analysis identifies…
#EmotetGroup#emotetActorsEmotet Group · TA542IOCf3 · i2 · d3 · u6RegionsCL
APTMembersMay 29, 2026, 09:53 (UTC+9)Trojanised Dr.Fone Installer Delivers VjW0rm via Three-Continent CDN-Masquerade C2
Nine new file indicators and one additional command-and-control IP have been added to the TA2541-linked VjW0rm cluster since earlier coverage, expanding a campaign whose most operationally distinctive feature was never the payload itself but the infrastructure architecture surrounding it: three geographically dispersed servers, each presenting a wildcard-SAN TLS certificate impersonating a different major CDN brand, observed within a 48-hour window and spread across three separate autonomous…
#TA2541#VjW0rm#CDNimpersonation#NSISdropper#JavaScriptworm#C2infrastructure#EgyptFranceRomaniaUnitedStates#OperationLayoverActorsTA2541 · Operation LayoverIOCf17 · i3 · d1 · u2RegionsEG · FR · RO · US
FILEMembersMay 29, 2026, 06:45 (UTC+9)One .NET Builder, Two Malware Families, One Turkish C2 IP
A single PE import-table hash — f34d5f2d4577ed6d9ceec516c1f5a744 — is the forensic thread that ties together what initially appears to be two separate commodity malware campaigns. On one end sits a 239-kilobyte AgentTesla infostealer, first submitted to VirusTotal in December 2025 and confirmed malicious by all three sandboxes that analysed it.
#agenttesla#HospitalityLeisure#TechnologyIOCf21 · i1 · d0 · u1MITRE41RegionsMA · TRIndustriesHospitality & Leisure · Technology
APTMembersMay 29, 2026, 05:53 (UTC+9)One Unrevoked Certificate, 18 Builds: Inside a 14-Month Adware Campaign
A DigiCert code-signing certificate issued to a Chengdu technology company has been used continuously for more than 14 months to sign trojanized Windows executables masquerading as components of LuDaShi (鲁大师), one of China's most widely installed PC-optimization suites — and that certificate remains unrevoked today. CTX Team's latest sweep of the campaign has surfaced 41 new file indicators alongside a purpose-built command-and-control domain pair registered in December 2025 that carries a 0/91…
#FIN6#TA428#Group123#lockergoga#ncctrojan#lummastealerActorsFIN6 · Skeleton SpiderIOCf60 · i27 · d4 · u1MITRE13
FILEMembersMay 29, 2026, 02:45 (UTC+9)Packed .NET Stealer Hits Healthcare in 7 Countries With Sandbox-Aware Evasion
A 593-kilobyte .NET assembly, unsigned and unremarkable in appearance, has been circulating against healthcare organisations across Belgium, India, Italy, Sri Lanka, Pakistan, Tunisia, and the United States since at least March 2026. What makes it analytically interesting is not its payload — credential theft is commodity work — but the layered effort its operators invested in making sure analysts never get a clean look at it.
#HealthcareIOCf3 · i1 · d0 · u1MITRE24RegionsBE · IN · IT · LKIndustriesHealthcare
APTMembersMay 29, 2026, 01:53 (UTC+9)Three DigiCert Certs, One Builder: Inside a Chinese Adware Signing Pipeline
Somewhere between a disk-cleaner utility and a remote-access implant, a modular Windows toolkit has been quietly circulating across Chinese software distribution channels, its every component bearing a valid DigiCert code-signing certificate issued to a registered Chinese legal entity. The campaign — tracked by CTX Team across at least 41 PE32 files and 20 confirmed network endpoints — deploys under four consumer-software personas (DupsClean, LargeFileClean, BirdWallpaper, and BlueDoveUnist)…
#APT33#shapeshift#icedidActorsAPT33 · MagnalliumIOCf41 · i77 · d3 · u2MITRE15
FILEMembersMay 28, 2026, 23:13 (UTC+9)Amadey Loader Hits Academic Networks Across 11 Countries via IE5 Cache
A freshly submitted Win32 executable — unsigned, just over 2 MB, first observed on VirusTotal on 2026-05-07 — is delivering a credential-harvesting payload to education and research institutions across eleven countries, using a staging chain that exploits legacy Internet Explorer cache paths, embeds a secondary payload in the binary's overlay section, and beacons home over raw HTTP to a single IPv4 address on a Seychelles-registered autonomous system that was provisioned less than nine months…
#APT28#EducationResearchActorsAPT28 · StrontiumIOCf2 · i1 · d0 · u1MITRE25RegionsBA · BO · CO · INIndustriesEducation & Research
FILEMembersMay 28, 2026, 22:59 (UTC+9)Expired 2017 Certificate Still Powers Process Hacker 2 Offensive Toolkit
Seventeen Windows executables — two main GUI binaries, a kernel-mode driver, a PE viewer, and thirteen plugin DLLs — have been assembled into a unified offensive package and are circulating with Authenticode signatures that expired in January 2017. The signing identity is "Wen Jia Liu," issued under two DigiCert certificate serials that together bind every file in the toolkit to a single developer lineage.
#RoyalRansomware#CommentCrew#glasses#prochackActorsRoyal Ransomware · Team OneIOCf19 · i0 · d0 · u0MITRE10
C&CMembersMay 28, 2026, 22:40 (UTC+9)Trojanized Security Suite Uses Valid DigiCert Cert to Blind Sandboxes
Nine PE32 components masquerading as a legitimate Chinese consumer security product are circulating with a currently-valid DigiCert code-signing certificate, a direct-syscall evasion technique confirmed by YARA, and payload delivery routed through Alibaba's KunlunCan CDN — a combination that collapses sandbox verdicts to zero while roughly half of antivirus engines still flag the files on static analysis alone. The gap between those two numbers is the operational story of this campaign.
#SaltySpider#salityActorsSalty Spider · KuKuIOCf9 · i21 · d2 · u5MITRE22
C&CMembersMay 28, 2026, 22:28 (UTC+9)One DigiCert Cert, 14 Executables, Nine Months Undetected
Fourteen distinct Windows executables. Six different product personas. One code-signing certificate — and nine months of continuous, largely undetected operation. That is the operational picture CTX Team has assembled from a cluster of signed PE32 binaries circulating through the Ludashi PUA distribution ecosystem, all stamped with a single DigiCert certificate issued to the Chengdu-registered entity 成都奇鲁科技有限公司 (serial 0D 07 8E 70 EA EE 48 FF EB 95 76 BD D4 00 BE 98, valid through 2027-05-20).
#FIN6#Group123#SaltySpider#lockergoga#salityActorsFIN6 · Skeleton SpiderIOCf23 · i25 · d4 · u1MITRE11
APTMembersMay 28, 2026, 21:56 (UTC+9)Dual DigiCert Certs Cloak Adware-to-RAT Campaign Across 19 Payloads
##A Single Certificate, Nineteen Signed Payloads, and a RAT Hidden Inside an Adware Framework Nineteen Windows binaries carrying valid DigiCert code-signing certificates — issued to two distinct Chinese-registered entities — have been circulating across Mandarin-language software distribution channels for at least eight months, wrapping a Ludashi/PolarWind adware framework around a RAT-capable core that most endpoint products still cannot see clearly.
#FIN6#TA428#APT23#lockergoga#ncctrojan#lummastealerActorsFIN6 · Skeleton SpiderIOCf61 · i5 · d3 · u3MITRE20
FILEMembersMay 28, 2026, 19:00 (UTC+9)Fake Windows DLL Targets Singapore Construction Firms in 16-Year Campaign
A 43-kilobyte Windows DLL masquerading as the operating system's own language-pack library is at the centre of an active implant chain targeting Singapore's construction sector — a toolkit that combines DLL search-order hijacking, active sandbox detection, post-execution self-deletion, and service-based persistence into a layered evasion architecture that has remained operationally relevant from its first recorded submission in July 2010 through at least May 2026.
#GoblinPanda#avzhan#ConstructionActorsGoblin Panda · CycldekIOCf2 · i0 · d0 · u0MITRE23RegionsSGIndustriesConstruction
FILEMembersMay 28, 2026, 18:49 (UTC+9)Signed VPN Installer Trojan Targets Food and Beverage Firms
Three Windows executables — VPNMaster.exe, Startup.exe, and master_vpn-service.exe — are circulating as components of a coherent VPN product installation, each carrying a DigiCert G4 code-signing certificate issued to a Singapore-registered entity called "INNOVATIVE CONNECTING PTE. LIMITED." The certificate, serial number 0C 8F 89 21 C5 36 49 3E 67 DF 84 FB 82 23 B0 92, expired on 2 April 2026, yet the binaries remain structurally signed and continue to bypass security controls on systems that…
#Barium#APT15#Cactus#ramnit#FoodBeveragesActorsBarium · Wicked SpiderIOCf14 · i1 · d6 · u1MITRE7IndustriesFood & Beverages
C&CMembersMay 28, 2026, 18:31 (UTC+9)One EV Certificate, Two Trojans, Three Fake Windows Binaries
Two trojan.jumper payloads circulating under the guise of a WireVPN client share an identical GlobalSign Extended Validation code-signing certificate — serial 03 A9 18 8A A5 10 C0 F8 34 34 26 BF, issued to WEILAI NETWORK TECHNOLOGY CO., LIMITED — while three companion files masquerade as canonical Windows system executables, carrying valid Microsoft signatures and zero detections across 76 scanning engines.
#beacon#AutomotiveIOCf6 · i6 · d6 · u0MITRE12IndustriesAutomotive
C&CMembersMay 28, 2026, 18:11 (UTC+9)Space Pirates Add Signed .NET Stealer to Trojanized-VPN Arsenal
Since CTX Team's earlier coverage of this campaign, eight new malicious files and a complete refresh of 18 IP addresses and 26 domains have surfaced — but the most operationally significant development is not the scale of the infrastructure turnover. It is the addition of a third signed-binary abuse vector: a Dotfuscator-packed, encrypted .NET stealer classified as PBot, hidden inside a binary carrying a valid Bright Data Ltd code-signing certificate.
#SpacePirates#ramnit#beaconActorsSpace Pirates · WebwormIOCf14 · i18 · d26 · u4MITRE17
FILEMembersMay 28, 2026, 14:45 (UTC+9)APT28's Three-Signer Chain Leaves Four Files at Zero Detections
Eight Windows executables. Three separate trusted signing identities. Four files sitting at zero detections across 76 antivirus engines. The campaign that CTX Team has been tracking under the RostPay/RostDown family designation is not a blunt-force intrusion operation — it is a methodical exercise in trust subversion, engineered so that the failure of any single certificate or detection rule leaves at least two other evasion layers intact.
#APT28#nitol#ghost#CommercialActorsAPT28 · StrontiumIOCf8 · i2 · d0 · u0MITRE11IndustriesCommercial Services
FILEMembersMay 28, 2026, 10:58 (UTC+9)XWorm Campaign Expands to Three-Channel C2 Fabric Across Offshore ASNs
Since CTX Team's earlier coverage of this XWorm campaign, two freshly provisioned command-and-control nodes have surfaced in RIPE NCC address space allocated in late 2025 — 158.94.209.22 under ASN 202412 (Omegatech LTD, Seychelles-registered) and 143.20.134.59 under ASN 215703 (Freakhosting Ltd, nominally UK-registered) — alongside a new dynamic DNS endpoint, jar5.ydns.eu, that carries no VirusTotal detection data at all.
#Commercial#Government#Manufacturing#Media#SupportServiceActivities#TechnologyIOCf12 · i2 · d0 · u1MITRE33RegionsAT · BE · BS · CAIndustriesCommercial Services · Government · Manufacturing
C&CMembersMay 28, 2026, 06:11 (UTC+9)Ludashi PUA Pivots to Cloud-Fronted C2 via Tencent API Gateway
Since CTX Team's earlier coverage of the Ludashi PUA campaign, the observable infrastructure has undergone a complete turnover: twelve new IP addresses, six new domains, and seven new URLs have entered the active indicator set, while every previously tracked file has rotated out. The payload layer is quiet — zero new binaries — but the network layer tells a story of deliberate, operationally sophisticated infrastructure replacement.
#TA551#icedidActorsTA551 · ShathakIOCf19 · i12 · d6 · u7MITRE12