APTMembersOct 6, 2026, 23:14 (UTC+9)Matching hash gives update.exe a second location—and Startup significance
A Windows executable appears in a sandbox report at %USERPROFILE%\AppData\Local\Start\update.exe, with exactly the same SHA-256 as the file submitted for analysis. A registry event associated with that sample records another important change: the user’s Startup folder is set to %USERPROFILE%\AppData\Local\Start. Why put the executable there? The folder’s role in the user’s configuration offers a more consequential explanation than its ordinary-looking name.
#Windows#logonpersistence#Startupfolder#registrychanges#Explorersettings#sandboxanalysisActorsSalty Spider · KuKuIOCf17 · i1 · d2 · u5MITRE23RegionsAU · IT · TR
FILEMembersOct 5, 2026, 15:26 (UTC+9)Two distinct Windows files share the same executable URL
The same executable URL, http://propanla.com/77.exe, appears in network-rule matches associated with two distinct Windows files: one carrying 7-Zip self-extractor metadata, the other identifying its product as FarLabUninstaller. The shared address raises a concrete question: does it connect two stages of a delivery chain, or show separate files reaching the same delivery location? CTX Threat Intelligence’s records support the second, narrower finding.
#Windowsexecutables#self-extractingpackages#executabledelivery#HTTPrequests#network-rulematches#DNSrecordsActorsLazarus Group · Hastati GroupIOCf23 · i2 · d7 · u6RegionsUSIndustriesRetail
APTMembersOct 5, 2026, 15:15 (UTC+9)Named firewall-rule deletion commands match two service artifacts
Two recorded Windows processes were launched with instructions to delete firewall rules named upWire and wire. Those same names appear in service-registry artifacts associated with two executables that share a code-signing certificate. The connection raises a more specific question than whether a firewall alert fired: was software managing rules associated with its own service components, or changing protections for another purpose?
#Windowsfirewallrules#ruledeletioncommands#service-registryartifacts#code-signingcertificate#processcreation#configurationchangesActorsSpace Pirates · WebwormIOCf20 · i9 · d6 · u2MITRE18
APTMembersOct 4, 2026, 10:53 (UTC+9)Sandbox records IP lookup and requests for two server-hosted text files
A Windows executable’s sandbox report records requests to an external-IP lookup service and to two text-file paths on 178.16.54.109. The distinction matters: one destination has an identifiable address-discovery role, while the other is a concrete source of requested remote resources. What, exactly, did the program seek from that IP-hosted server—and does the report connect those requests to the executable files written locally?
#Windowsmalware#sandboxanalysis#HTTPrequests#remoteresources#droppedexecutable#registrychanges#security-policytamperingActorsTurla · Iron HunterIOCf24 · i3 · d3 · u1RegionsUSIndustriesRetail
FILEMembersOct 2, 2026, 14:57 (UTC+9)Upatre Downloader Trips a CryptoLocker Ransomware Rule
A 57-kilobyte Windows executable now flagged by 63 of 77 engines on VirusTotal does something routine for its category and something genuinely odd for its label at the same time. It carries extra data appended past the end of its own executable image — a lightweight, old-school downloader obfuscation trick rather than a packer or custom crypter — while simultaneously tripping a YARA rule written specifically to catch CryptoLocker variants.
#Upatre#CryptoLockerYARArule#Zbot#GoldEvergreen#BusinessClub#retailsectortargeting#downloadermalware#domaininfrastructurereuseActorsGold Evergreen · Business ClubIOCf2 · i0 · d1 · u1MITRE9RegionsUSIndustriesRetail
C&CMembersOct 2, 2026, 14:39 (UTC+9)Expired Signature Still Fooled Users Two Years Later
A Win32 installer tagged to the commodity PUP family "orcinius" surfaced on VirusTotal on 2015-12-13 carrying a full three-tier code-signing chain — "Premium Installer; VeriSign Class 3 Code Signing 2010 CA; VeriSign" — and a verification status that reads, verbatim, "A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file." The leaf certificate issued to "Premium Installer" was valid from 1:00 AM on 7/13/2013…
#orcinius#PUP#code-signingabuse#C2infrastructure#VeriSigncertificate#retailsector#installermalware#domainregistrationIOCf1 · i0 · d2 · u2MITRE13RegionsUSIndustriesRetail
FILEMembersOct 2, 2026, 06:50 (UTC+9)Fake 'Snapchat Mod APK' Site Serves Hash-Rotating LummaStealer
A domain built around the promise of a "Snapchat mod APK" — the kind of search-bait a mobile user might stumble into while hunting pirated app modifications — is instead handing out Windows desktop executables and batch scripts. thesnapchatmodapk.com, registered on 2025-04-11 and still resolving behind Cloudflare more than a year later, hosts a file list of update1.exe, update2.exe, update3.exe, mine.bat and wdd.bat. None of those are mobile artifacts.
#LummaStealer#crypterrotation#TelegramC2#phishingdomain#sandboxevasion#credentialtheft#cryptocurrencywallettheft#commoditymalwareIOCf11 · i0 · d1 · u5MITRE63RegionsGP · HUIndustriesTechnology
C&CMembersOct 2, 2026, 06:40 (UTC+9)Old Emotet Loader's TLS Fingerprint Still Trips Dridex C2 Rules
A 494-kilobyte Emotet loader DLL first catalogued in April 2022 is still showing up in intrusion-detection logs today — not because the file is new, but because the TLS handshake it performs when it calls home still matches signatures built to track an entirely different banking trojan. Six IDS rule hits fire on this binary (hash 6bdac750fd1885696ffaf5dd38806c8f7bff2c8bc706421c9b4f0c2b0a9d8520, popularly tagged "mint" and "zard" alongside its Emotet label): three separate "ET CNC Feodo Tracker…
#Emotet#Dridex#TA542#JA3fingerprint#FeodoTracker#Let'sEncryptcertificates#C2infrastructure#loader-as-a-serviceActorsEmotet Group · TA542IOCf1 · i4 · d0 · u6MITRE24
FILEMembersOct 1, 2026, 22:58 (UTC+9)A Decade-Old Driver Disguise Still Fools Two-Thirds of Antivirus
A trojan now resurfacing in a fresh indicator batch presents itself internally as c:\windows\system32\drivers\partmgr.sys — the Windows partition-manager driver — while the file that actually lands on disk carries a randomized name such as 7PLZfYlw8lxGk5pe1evjS.exe or N06A1Oj5m5fsNFiBO.exe. It ships with no code-signing certificate at all.
#Tofsee#Smokeloader#SmokySpider#filenamemasquerading#partmgr.sys#Let'sEncryptcertificateabuse#retailsectortargeting#commoditymalwareActorsSmoky SpiderIOCf2 · i1 · d0 · u1MITRE33RegionsUSIndustriesRetail
C&CMembersOct 1, 2026, 22:49 (UTC+9)StealC v2 Learns to Pick Chromium's App-Bound Encryption Lock
The newest file wave added to this campaign's tracking includes a StealC v2 build pair that now trips the same YARA rule used to catch tooling built specifically to defeat Chromium's hardened credential store — a capability jump that matters more than any single indicator count added this cycle. A 767KB sample internally labeled as the stealer-loader "marte" variant (0215f734…53624) and a 2.9MB build shipped under the name SilverBulletPro1.5.exe and tracked as "cymulate" (1465e9ea…b5660) both…
#StealCv2#ChromiumApp-BoundEncryption#BYOVD#UACbypass#AS214351#FemoITSolutions#credentialtheft#C2infrastructureIOCf10 · i5 · d3 · u13MITRE55RegionsUSIndustriesTechnology
APTMembersOct 1, 2026, 14:27 (UTC+9)2017 NSA Leak Still Builds a Working Kill Chain in 2024
Twenty files anchor this record, and on paper they should belong in a digital history archive rather than a live detection feed: EternalBlue exploitation code, the DoublePulsar kernel implant, and its sturdier successor DarkPulsar, all pulled from the Equation Group toolkit that the ShadowBrokers dumped onto the public internet in April 2017. These are not forensic curiosities sitting dormant in a vendor's sample library.
#EternalBlue#DoublePulsar#DarkPulsar#ShadowBrokers#masscan#APT40#APT39#RaspiteActorsRaspite · LeafminerIOCf50 · i0 · d1 · u2MITRE59RegionsUSIndustriesRetail
FILEMembersOct 1, 2026, 06:44 (UTC+9)Downloader Stalls, Then Runs on a Certificate That Already Expired
A Win32 downloader submitted under the name reader.exe carries a code-signing chain that should never have verified — VeriSign infrastructure revoked and expired before the file was ever signed against it — wrapped around anti-debugging logic and a network fingerprint that ties it, by rule name, to detections built for Operation Cloud Hopper. The sample (d26dae0d8e5c23ec35e8b9cf126cded45b8096fc07560ad1c06585357921eeed) is not new tradecraft.
#RedApollo#APT10#menuPass#ChChes#OperationCloudHopper#code-signingabuse#sandboxevasion#governmenttargetingActorsRed Apollo · PotassiumIOCf1 · i0 · d1 · u5MITRE13RegionsJO · ROIndustriesGovernment
C&CMembersOct 1, 2026, 06:31 (UTC+9)Cert-Rotation Pattern, Not APT27, Links PC-Repair Lure Domains
Two lookalike PC-repair domains, registered five months apart through entirely different registrars, were issued near-identical certificates by the same Let's Encrypt authority shortlisted under the CA short-name "YR2" — both carrying 89-day validity windows, both stamped with wildcard subject names pointing at secondary lure brands. mypchub.net, registered through NameCheap, Inc.
#APT27#LuckyMouse#Rhadamanthys#LummaStealer#njrat#Let'sEncryptcertificates#commoditycrimeware#domaininfrastructureActorsAPT27 · TEMP.HippoIOCf5 · i1 · d2 · u2MITRE35RegionsBD · INIndustriesFood & Beverages
C&CMembersSep 30, 2026, 22:37 (UTC+9)Five-Day-Old Domain Found Hosting Full SQL Server Intrusion Kit
A domain registered through Namecheap on September 25 and still just five days old when it was captured is hosting a complete, ready-to-run intrusion kit — not a single payload, but an entire toolchain: packed executables, batch and VBS launchers, a SQL Server data dump, and plaintext files labeled simply "user" and "pass." The domain, vietnam852.com, resolves to one IP address, 8.230.28.79, and serves everything from a single path: site.vietnam852.com/sql/.
#vietnam852.com#SQLServer#credentialtheft#imphash#UPXpacking#ConfuserEx#retailsector#ingresstooltransferIOCf18 · i1 · d2 · u10RegionsBD · BR · EG · INIndustriesRetail
APTMembersSep 30, 2026, 22:26 (UTC+9)Fake 'Jerusalem Brochure' PDF Hides Anti-Debug Spyware Dropper
A Windows dropper built to look like a conference handout — internally named "Brochure-Jerusalem_26082019_pdf.exe" — checks whether anyone is watching it before it does anything else, and only then reaches out to a domain registered ten weeks before the sample was analyzed. The file (284a0c5c…dbd01) carries a matching PDF resource path inside it, reads the CPU clock directly to spot a sandbox, installs itself to survive a reboot, and calls out over WMI to spread to other machines on the same…
#AridViper#DesertFalcons#MICROPSIA#WMIpersistence#sandboxevasion#telecomsector#Palestinianterritories#disposableC2infrastructureActorsAPTC23 · Two-tailed ScorpionIOCf4 · i1 · d1 · u1MITRE36RegionsPSIndustriesTelecommunications
FILEMembersSep 30, 2026, 06:47 (UTC+9)A Bitter Downloader Stalls Before It Beacons, Then Gives Itself Away
A Windows downloader tracked to the Bitter espionage cluster spends its opening moments doing nothing that looks like malware at all — it waits, it checks the clock, it looks for a debugger, and only then does it drop and run its actual payload. That patience is the story. The file (90fd32f8f7b494331ab1429712b1735c3d864c8c8a2461a5ab67b05023821787), a 52KB Win32 executable masquerading under the internal name "Windows," pairs that stalling behavior with a phishing front built on two…
#BitterAPT#APT-C-08#phishinginfrastructure#downloadermalware#governmentsectortargeting#Jordan#Romania#AlibabaClouddomainsActorsBitter · APT-C-08IOCf2 · i0 · d2 · u0MITRE19RegionsJO · ROIndustriesGovernment
C&CMembersSep 30, 2026, 06:30 (UTC+9)Wizard Spider Cluster Adds CMSTP Bypass as Loader Cohort Hits Five
The freshest wave of indicators tied to this cluster doesn't expand the target list or spin up new command posts — it thickens the payload layer with a defense-evasion technique that wasn't visible in the earlier build. Two newly logged samples that share no import-table hash, no signer, and no vendor label between them — a file flagged as trojan.filerepmalware/misc (338458ce…) and one carrying a "Curiositystream by D3v.exe" filename and tagged trojan.cymulate (60b1267c…) — both trip the same…
#WizardSpider#CMSTPUACbypass#loadercohort#Injuke#Stealc#Clipbanker#C2infrastructure#vulnerabledriverActorsWizard Spider · Grim SpiderIOCf18 · i5 · d3 · u13MITRE59RegionsBE · VN
C&CMembersSep 29, 2026, 22:38 (UTC+9)Shared Beacon String Links Clipbankers, a Stealer, and a Rogue Driver
Three separate rule-level fingerprints, not a single named family, are what make this cluster worth a second look. A signed-but-expired Windows driver built to terminate security processes fires Elastic's "Windows_VulnDriver_ProcessMonitorDriver" detection on one sample; a UAC-bypass rule tied to the CMSTP COM interface [T1218.003] co-fires on two nominally unrelated loaders; and a Florian Roth YARA signature for a single-byte XOR-obfuscated "Mozilla/5.0" string turns up in three files that…
#BYOVD#CMSTPUACbypass#clipbanker#RedLineStealer#dynamicDNSabuse#AS214351#processmasquerading#commoditycrimewareActorsWizard Spider · Grim SpiderIOCf18 · i3 · d2 · u6MITRE24RegionsBE
APTMembersSep 29, 2026, 22:28 (UTC+9)Pikabot Loader Wears a Revoked Bitdefender Certificate
A Pikabot infection chain built around a single ZIP archive and its embedded executable is offering a clean look at how one loader family stages, disguises, and calls home in the same breath. The archive — 623KB, delivered under the filename pattern 557390-1743605714.zip — sits and waits: its own behavioral tags mark it as something that "waits for user interaction before running" before it unpacks a single Portable Executable weighing in at 1,459,816 uncompressed bytes.
#Pikabot#SafePay#Bitdefenderspoofing#revokedEVcertificate#Jordangovernment#Let'sEncryptrotation#TrickBotJA3signatures#commodityloaderActorsSafePayIOCf2 · i5 · d0 · u12MITRE12RegionsJOIndustriesGovernment
C&CMembersSep 29, 2026, 14:44 (UTC+9)One Build, Four AV Labels: Inside a Stealer Masquerade Pipeline
Four files carrying four different antivirus threat labels — trojan.injuke/hrgx, trojan.clipbanker/hrgz, trojan.stealc/stealer, and trojan.mikey/clipbanker — turn out, on closer inspection, to be the same binary wearing different clothes. All four share an identical import-table hash (75c410d3cdd17cf4a33ccaf94384484f) and an identical rich PE header hash (dee6ab558f324ac40038942e3c424ed4), a level of structural identity that has nothing to do with coincidence and everything to do with a single…
#StealC#ClipBanker#Amadey#BYOVD#CMSTPUACbypass#processmasquerading#AS214351#WizardSpiderattributionActorsWizard Spider · Grim SpiderIOCf18 · i5 · d3 · u13MITRE20RegionsBE
C&CMembersSep 28, 2026, 22:44 (UTC+9)A Three-Year-Old Packer Fingerprint Still Feeds the Same Amadey Panel
A Windows binary called ReverseHoo.exe, first catalogued in July 2022, and a same-family binary called ReverseHoo Checker.exe, submitted more than three years later in October 2025, fire an identical five-rule packer signature: HKTL_NET_NAME_AsStrongAsFuck, SUSP_NET_NAME_ConfuserEx, and three separate INDICATOR_EXE_Packed_* rules covering ConfuserEx, dotNetProtector, Dotfuscator, Goliath and Babel.
#Amadey#LummaStealer#ConfuserExpacker#DiamotrixC2panel#OmegatechLTD#FarahooshDena#loadermalware#GermanyNetherlandsIraninfrastructureIOCf5 · i4 · d0 · u10MITRE37RegionsDE
APTMembersSep 28, 2026, 14:28 (UTC+9)A 2010 Worm Still Trips a Live Tofsee Fingerprint — and Now It's Hauling a Miner
A Sality-lineage dropper that first surfaced in mid-2010 is still active enough to trip a live malicious-JA3 detection tied to Tofsee command-and-control infrastructure, and in the same indicator set it turns up alongside a matched XMRig mining kit — an executable and its configuration file staged through identical randomized-hex Temp folders — plus two low-detection payloads disguised as image files.
#Salityworm#Tofsee#XMRig#SaltySpider#cryptomining#malxmr#hostinginfrastructure#masqueradingActorsSalty Spider · KuKuIOCf26 · i5 · d4 · u3RegionsUSIndustriesRetail
C&CMembersSep 28, 2026, 06:32 (UTC+9)A Log Shop That Never Reboots Its Servers
Eighteen of the forty-seven files CTX Team has tracked against this collection point turned over in the most recent sweep — new stolen-data artifacts rotating in, old ones rotating out — while every piece of network infrastructure behind the operation stayed exactly where it was. The domain, the IP, and the seven URLs tied to this cluster show zero change.
#diamotrix.world#credentialtheft#stealerlogs#gatak#Exoduswallet#FileZilla#Telegram#C2infrastructureIOCf47 · i2 · d1 · u7MITRE55RegionsUSIndustriesMedia
FILEMembersSep 27, 2026, 22:59 (UTC+9)KerrDown Loader Disguises DLL as C:\Windows .exe, Splits Sandboxes
A Win32 dynamic-link library carrying the internal path C:\Windows\intkxqhf.exe is, by every technical measure VirusTotal records, not an executable at all — it is a raw PE32 DLL, unsigned, 90 kilobytes, first surfacing on public scanning infrastructure in November 2018 and still being resubmitted as recently as mid-2022. The mismatch between the file's true form and its disguised, exe-shaped alias is not cosmetic.
#KerrDown#OceanLotus#APT32#loadermalware#sandboxevasion#TLScertificatespoofing#governmentsectorespionage#masqueradingActorsOceanLotus · APT32IOCf1 · i0 · d1 · u2MITRE9RegionsJO · ROIndustriesGovernment
APTMembersSep 27, 2026, 22:41 (UTC+9)Hidden Excel4 Macro Resurfaces, Drops Emotet Loader with Dridex-Linked JA3
A hidden-macrosheet spreadsheet submitted just eight days before this analysis, on 2026-09-19 (f2f0b898…), reconfirms one of the oldest tricks still working in commodity malspam: burying an Excel4 auto-open macro inside a sheet the workbook itself keeps hidden from the user. What makes this snapshot notable isn't the delivery mechanism — that has been documented in this campaign before — but what it hands off to.
#Emotet#Excel4macros#Zenpak#DridexJA3#hiddenmacrosheet#USretail#loadermalware#TA542ActorsEmotet Group · TA542IOCf5 · i3 · d1 · u6RegionsUSIndustriesRetail
APTMembersSep 27, 2026, 06:30 (UTC+9)Six Droppers, One Codebase: The Masquerade Behind FreeEIM and RuntimeBroker
A cluster of six Windows binaries surfacing under names like "RuntimeBroker" and "FreeEIM" turns out to be the same Gh0st RAT-lineage codebase wearing five different vendor labels — farfli, zegost, mulinex, dump, and killmbr — a fragmentation that has less to do with new malware and more to do with how detection taxonomy handles a code family that refuses to die.
#SaltySpider#Gh0stRAT#FreeEIM#RuntimeBroker#farfli#rootkitdriver#certificateblocklist#USretailActorsSalty Spider · KuKuIOCf19 · i1 · d0 · u0MITRE35RegionsUSIndustriesRetail
C&CMembersSep 26, 2026, 22:34 (UTC+9)Identical TLS Certificate Links Manila Server to Bytedance-Registered US IP
Two servers with nothing obvious in common — one sitting inside Zenlayer's Philippine address space, the other inside a block registered to Bytedance Inc. in the United States — are presenting the exact same TLS certificate. Not a similar one: byte-identical. The certificate at 156.59.113.130 (AS21859, Zenlayer Inc, Philippines) and the one at 71.18.106.229 (AS396986, Bytedance Inc., United States) share serial number 1acf3e37b37910d932ea64e6bb27615d6484c07d, an identical thumbprint, and the…
#certificateabuse#codesigning#APT28#PBotstealer#BrightDataSDK#Let'sEncrypt#loadermalware#infrastructuresprawlActorsAPT28 · StrontiumIOCf133 · i12 · d26 · u3MITRE25
APTMembersSep 26, 2026, 14:33 (UTC+9)A Decade-Old Fareit/Pony Stealer Still Fires the Same Signatures
A Windows executable flagged by 67 of 76 engines checks in over HTTP using traffic patterns that intrusion-detection vendors have signatured for more than ten years — not because the operators built something new, but because they didn't need to. The file (hash prefix 8feae039…) carries the threat label trojan.fareit/tepfer and the popular names fareit, tepfer, and stealer, and it fires three named YARA rules, including Elastic Security's Windows_Trojan_Pony_d5516fe8 and the Malpedia signature…
#GorgonGroup#Subaat#Fareit#Ponystealer#credentialtheft#sandboxevasion#domaindrop-catching#RomaniaActorsGorgon Group · SubaatIOCf2 · i0 · d5 · u2MITRE27RegionsRO
APTMembersSep 26, 2026, 06:30 (UTC+9)Same AutoIT Toolkit Links 2021 Droppers to 2024 Excel Lures
A dropper wave built in mid-2021 and an Excel-lure campaign built in October 2024 have almost nothing in common on the surface — different file formats, different lure themes, three years of separation — except that both fire the same YARA rule for AutoIT scripting. That single recurring signature, tying a 2021 downloader (164e93724abba0dd…) to a 2024 Office add-in (7acc59a5ff51435e…), is the most durable thread running through a file set that CTX Team has been tracking under the tag Operation…
#OperationBlackAtlas#RedLineStealer#ClipBanker#AutoIT#DiscordCDNabuse#SingNetinfrastructure#credentialtheft#malwaremasqueradingActorsOperation Black AtlasIOCf18 · i3 · d3 · u8RegionsUS
FILEMembersSep 25, 2026, 22:33 (UTC+9)Gamaredon's Pterodo Loader Stalls Sandboxes to Hide Its Real Payload
A Pterodo-family loader flagged by 57 of 77 antivirus engines carries something more interesting than its detection score. The binary reads the CPU timer directly to work out whether it is running inside an analysis environment, deliberately stalls for long periods before doing anything else, and only then reaches past the end of its own file to load a second payload that was appended there as raw bytes [T1497.003, T1106].
#Gamaredon#Pterodo#Shuckworm#sandboxevasion#macrodropper#overlaypayload#self-signedcertificate#RussianhostinginfrastructureActorsGamaredon Group · CTIGIOCf3 · i1 · d0 · u2MITRE16RegionsRO
FILEMembersSep 25, 2026, 14:43 (UTC+9)WebMonitor RAT Hides Behind Rotating Pool of Hex-Named .to Domains
Nine domains that look, at first glance, like noise — 81252b01.to, 69385701.to, efe87401.to, 1e517001.to, cf488101.to, 49b56c01.to, bb8c4e01.to, 53fb0701.to, 93319601.to — turn out to share a single, deliberate signature: every one of them exposes an identical subdomain, "stubbzy," and an identical checkin path, "recv3.php." That is not what independently registered infrastructure looks like.
#WebMonitorRAT#RevCode#UPXpacking#DGAdomains#C2infrastructure#Switzerland#Jordan#RomaniaIOCf2 · i0 · d11 · u9MITRE24RegionsCH · JO · ROIndustriesGovernment · Support Services
FILEMembersSep 25, 2026, 06:56 (UTC+9)APT29 Tag Doesn't Fit This Commodity RedLine/ClipBanker Cluster
A DevExpress-branded "patch and keygen" tool for pirated developer software has been circulating for at least four years, and CTX Team's review of the build artefacts shows it was never a one-off release. Two files trading on that exact branding — a 159KB tool named DevExpress_Patch_Keygen_DFoX.exe (c5460701f45d70e8b7255195ee08d15d87aa7847562ca27a6b5cd0c803418f5d) and a 6.4MB dropper named DevExpressPatch.exe (ebe9cb6a4e6bf1285e1cd120ca031e3f8d7fab938e1122579cfb49735d3db81d) — share an…
#APT29#RedLine#ClipBanker#njRAT#DevExpresscracklure#dynamicDNSinfrastructure#clipboardhijacking#commoditycrimewareActorsAPT29 · MinidionisIOCf13 · i0 · d1 · u0MITRE11RegionsIT
C&CMembersSep 25, 2026, 06:46 (UTC+9)Revoked Certs, Live Trojans: VPN Malware Signs On Anyway
A revoked EV certificate does not usually stop working the moment a certificate authority pulls it — Windows still launches the binary, users still click through the warning dialog if one even appears, and the software keeps installing exactly as it did the day it was minted. That quiet mechanical fact is the throughline connecting three unrelated Windows codebases surfacing in the same indicator set: a VPN trojan signed by WEILAI NETWORK TECHNOLOGY CO., LIMITED whose GlobalSign EV certificate…
#codesigningabuse#certificaterevocation#VPNtrojan#proxyware#BrightData#PBotstealer#graywaredistribution#threatattributionActorsCactus · Cactus Ransomware GroupIOCf16 · i9 · d12 · u0MITRE16
APTMembersSep 24, 2026, 15:31 (UTC+9)Decade-Old Tofsee Payload Masquerades as Windows Driver partmgr.sys
A 10,878-kilobyte Win32 executable circulates under the file path of a legitimate Windows disk-partition driver — c:\windows\system32\drivers\partmgr.sys — while its delivery names rotate through disposable installer strings such as 89UlgiO5LXmpwSOaII.exe and 8krHNSKndIeDU5GFnJECrkOs.exe. VirusTotal resolves the binary (456d4a6d6f…, hereafter the partmgr.sys impersonator) to trojan.tofsee/dump, and 65 of 76 antivirus engines currently flag it.
#Tofsee#Smokeloader#masquerading#sandboxevasion#wormpropagation#AS132825#Let'sEncryptcertificate#commoditymalwareActorsSmoky SpiderIOCf2 · i1 · d0 · u1MITRE33RegionsCH · NLIndustriesSupport Services · Technology
C&CMembersSep 24, 2026, 14:37 (UTC+9)One Wildcard Certificate Ties APT28 Infrastructure Across Six Nations
Eighteen IP addresses scattered across the United States, Hong Kong, Vietnam, South Korea, Malaysia and Thailand are all presenting the identical TLS certificate — a wildcard issued for a domain whose name gives away its purpose: certfallback.com. The certificate carries serial number 6696262f452fcf46b79266a8, was issued by GlobalSign GCC R46 OV TLS CA 2025 to an organization listed as Alibaba (China) Technology Co., Ltd. in Hangzhou, Zhejiang, and runs from 2026-07-30 through 2027-02-14.
#APT28#FancyBear#wildcardcertificate#AlibabaCloud#commandandcontrol#educationsector#phishing#espionageActorsAPT28 · StrontiumIOCf0 · i21 · d8 · u1MITRE2IndustriesEducation & Research
FILEMembersSep 24, 2026, 07:05 (UTC+9)A Coin-Miner Wearing svchost's Name
A six-indicator bundle arrived tagged to a named espionage actor and a bespoke malware family, but the only file in the set with a confirmed threat classification, matching rule hits, and a sandbox verdict is not an espionage tool at all — it is a UPX-packed cryptomining dropper that renames itself svchost.exe and trips an IDS signature associated with Tor relay traffic.
#coin-miner#svchostmasquerading#APT-C-35#DonotTeam#cryptojacking#UPXpacking#Torrelaytraffic#malwaremisattributionActorsAPTC35 · Donot TeamIOCf10 · i2 · d0 · u1MITRE38RegionsPLIndustriesManufacturing
APTMembersSep 23, 2026, 14:28 (UTC+9)Russian-Registered AS213010 Has Hosted C2 Since 2019
The most durable artifact in this record isn't a binary or a certificate — it's a network. Autonomous System 213010, registered to an entity RIPE lists as "Gening Nikita Dmitrievich," has hosted at least two IP addresses that anchor domains registered three years apart: 87.251.75.204, which carries a domain first registered on 2023-09-20 (poolfreshstep.com), and 80.66.76.210, which is fronting a domain that was only 14 days old when this record closed (bunnysecurityrelay.com, created…
#VoidArachne#SilverFox#CobaltStrike#AS213010#NICENIC#Cloudflare#piratedsoftwarelure#infrastructurereuseActorsVoid Arachne · Silver FoxIOCf17 · i3 · d4 · u2RegionsBRIndustriesEngineering
FILEMembersSep 22, 2026, 22:34 (UTC+9)Recycled Sectigo Certificate Links Loader and Banking-Trojan Payload
The same revoked leaf certificate — serial 00 8E 3E 9A 2F E7 3C 91 98 5B 4F 90 D5 95 77 CD 6C, issued under the name MASTER LIM LTD and chained through COMODO RSA Code Signing CA up to Sectigo (formerly Comodo CA) — is stamped on two files that sit at opposite ends of a delivery chain: an NSIS self-extracting installer and the banking-trojan DLL it ultimately drops.
#TA505#LDPinchbanker#Sectigocodesigningabuse#NSISinstaller#VBScriptstager#sandboxevasion#DGAdomains#bankingtrojanActorsTA505 · Hive0065IOCf5 · i0 · d2 · u4MITRE37RegionsCH · USIndustriesRetail · Support Services
FILEMembersSep 22, 2026, 14:47 (UTC+9)5KB Fake 'update.exe' Stager Ties to Tomiris/YoroTrooper Espionage
A stager built to pass as nothing more than a routine Windows update file is barely large enough to hold its own icon — five kilobytes of packed .NET code, unsigned, dropped straight into C:\Windows\Temp\update.exe. Despite the size, 55 of 76 antivirus engines flag it, and the record ties the sample (4f237b5a…) to the espionage-focused Tomiris and YoroTrooper clusters.
#Tomiris#YoroTrooper#AgentTesla#.NETstager#anti-debuggingevasion#Let'sEncryptcertificateabuse#VDSINAVPShosting#espionagemalwareActorsTomiris · YoroTrooperIOCf1 · i1 · d0 · u1MITRE12RegionsCH · JO · USIndustriesGovernment · Retail · Support Services
C&CMembersSep 21, 2026, 22:29 (UTC+9)Two Shell Firms, One DigiCert Root: Adware's Signing Trick Repeats
AloneTrayServer.exe and MLPrivacy.exe — two installers newly added to a long-running Chinese adware-distribution cluster — both carry valid, chained code-signing certificates issued to a company calling itself 成都星汉云科科技有限公司. That in itself would be unremarkable. What makes it worth a second look is that this is now the second shell identity CTX Team has traced back to the exact same intermediate certificate authority — DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 — after an earlier…
#code-signingabuse#shellcompanies#DigiCert#adware#Ludashi#T1553.002#sideloading#China-basedinfrastructureIOCf9 · i3 · d4 · u1MITRE45
FILEMembersSep 21, 2026, 14:31 (UTC+9)One 2009 Compile Job Is the Only Real Link in 'Klovbot' Cluster
Everything else in this record is décor around one hard fact: two of the five files carried under a shared feed label share not just a detection verdict but an identical import table hash, an identical rich-header fingerprint, and an identical PE compile timestamp of January 14, 2009. That is not coincidence — it is proof that whoever built the Hiloti/Mufanom downloader compiled it once and shipped it out twice, once packaged as a standalone executable and once as a dynamic-link library, both…
#Klovbot#Hiloti#Mufanom#Buzus#Prolaco#Renos#commoditymalware#malwareclusteringIOCf46 · i1 · d6 · u2MITRE48RegionsUSIndustriesEngineering
FILEMembersSep 21, 2026, 07:04 (UTC+9)Fake Adobe Audition Patch Fans Out Into Two Trojan Families
A pirated license patch for Adobe Audition is doing more work than a typical cracked-software lure. Once a victim runs the fake "Adobe Audition Patch v24.exe," the package drops from an identical temporary-folder fragment — u2pvkyr3.1xh\Patch-Activated\ — into two forensically distinct payloads that VirusTotal resolves under entirely different threat labels: trojan.swisyn/gosys on one branch, trojan.autoit/nymeria on the other.
#crackedsoftwarelure#AutoITdropper#Doeneriumstealer#imphashreuse#JA3fingerprint#node.exemasquerade#CommentCrew/APT1#malwaredistributionActorsComment Crew · Byzantine CandorIOCf48 · i0 · d0 · u0MITRE51RegionsGT
C&CPublicSep 21, 2026, 06:50 (UTC+9)A Two-Tier Certificate Strategy Behind a Freshly Rotating C2 Cluster
Four IP addresses and three domains now tracked under a single command-and-control cluster show something that rarely shows up this cleanly in raw infrastructure data: two entirely different levels of operational care, running side by side on the same campaign. On one tier, listener IPs are still wearing the certificates they shipped with — an OpenSSL install default, a Chinese vendor's untouched template — the kind of TLS hygiene nobody bothers to fix on infrastructure meant to be thrown away.
#command-and-controlinfrastructure#TLScertificatehygiene#wildcardcertificates#dynamicDNS#DGAdomains#unattributedthreatcluster#certificatetransparency#networkinfrastructureanalysisIOCf0 · i4 · d3 · u0MITRE10IndustriesContainers & Packaging
APTMembersSep 21, 2026, 06:32 (UTC+9)Cracked-Software Lure Network Runs on Expired EV Cert, Shared Hosting
Three files sitting in the same threat record advertise themselves as ordinary utility software — a network scanner, a product activator, a WhatsApp data-transfer tool — and all three are wrapped in commercial anti-analysis packing strong enough to blunt most of the engines that inspect them. That combination, not the actor label attached to the record, is the actual story here.
#crackedsoftwarelures#codesigningabuse#VMProtectpacking#maliciousdomaininfrastructure#CloudflareDNSpivot#attributionmismatch#AdvancedIPScannerimpersonation#certificaterotationActorsLockbit GangIOCf3 · i0 · d5 · u0MITRE6IndustriesContainers & Packaging
C&CPublicSep 20, 2026, 22:49 (UTC+9)Emotet 'C2 Servers' Entry Bundles 3 Unrelated IPs, No Shared Fingerprint
A feed entry logged at 00:03 UTC on September 20 groups nine indicators under the category "c2-servers" — a single Emotet loader DLL and three IP addresses spread across Malaysia, Ghana and South Korea. The label implies a working command-and-control triangle behind a live banking-trojan campaign. The evidence inside the record says something closer to the opposite: none of the three IPs share an autonomous system, a certificate, or a registrant record with each other or with the file, and two…
#Emotet#C2infrastructure#bankingtrojan#threatintelligencefeeds#certificatestaleness#Malaysia#Ghana#SouthKoreaIOCf6 · i3 · d0 · u6RegionsUSIndustriesRetail
APTPublicSep 20, 2026, 22:41 (UTC+9)Fake Skype Installer Ran a Full Espionage Chain for a Decade
A Win32 executable that calls itself Skype.exe, carries Skype's product name and a "© 2003-2012 Skype and/or Microsoft" copyright string, and still ships completely unsigned has been circulating in low volumes for more than a decade — first submitted for scanning in October 2014, most recently as March 2025. The file (b6ca1211…8f518a403) is flagged by 61 of 78 engines, a strong consensus that has held steady across its long life.
#Molerats#GazaCybergang#AridViper#Skypemasquerade#trojanizedinstaller#anti-analysisevasion#DNSbeacon#espionagemalwareActorsMolerats · Gaza CybergangIOCf1 · i0 · d1 · u1MITRE9RegionsCN · HKIndustriesRetail
C&CMembersSep 20, 2026, 14:37 (UTC+9)A Hidden Macrosheet Reopens Emotet's Front Door
A spreadsheet flagged as trojan.abracadabra/emotet, submitted for scanning barely a day before this review and already caught by 42 of 75 engines, carries an Excel4 macro built to fire the moment the file opens — and the macro logic itself sits inside a sheet the workbook keeps hidden from anyone who opens it in Excel. Two named detections establish this precisely: the YARA rule `SUSP_Excel4Macro_AutoOpen matches the auto-executing macro trigger, and Microsoft_Excel_Hidden_Macrosheet` catches…
#Emotet#TA542#Excel4macro#hiddenmacrosheet#DridexJA3fingerprint#Zenpakloader#retailsector#crimewareinfrastructureActorsEmotet Group · TA542IOCf5 · i3 · d1 · u6RegionsUSIndustriesRetail
APTMembersSep 20, 2026, 14:29 (UTC+9)Fake WebView2 DLL Stalls Sandboxes to Outwait Detection
A DLL calling itself WebView2Loader.dll — the file Microsoft's own browser-embedding runtime uses on tens of millions of Windows machines — turns out to be a 3,544KB Win32 payload that checks for an attached debugger, stalls execution for long stretches, waits for a human to actually touch the keyboard, and probes the BIOS before doing anything else.
#WebView2masquerade#SalatStealer#Vidar#Snowglobe#Varistpacker#sandboxevasion#Let'sEncryptcertificaterotation#retailsectortargetingActorsSnowglobe · Animal FarmIOCf45 · i2 · d1 · u2RegionsUSIndustriesRetail
C&CMembersSep 20, 2026, 06:37 (UTC+9)Adware Operator Recycles Qihoo, Alibaba, UnionPay TLS Certs on Carrier IPs
Four subdomains under a single Chinese apex — adblock.yunkeit.com, cdn-ali-v3.yunkeit.com, stat.yunkeit.com and upgrade.yunkeit.com — were all registered on the same day, 2025-09-11, through the Hichina registrar (grs-whois.hichina.com, nameservers DNS23/24.HICHINA.COM). Three of the four resolve to the identical A-record, 47.94.14.179, and the fourth, cdn-ali-v3.yunkeit.com, fans out across an eight-address block (180.163.147.83 through .90) behind a CNAME to w.kunluncan.com.
#yunkeit.com#codesigningabuse#TLScertificaterecycling#ChinaMobile#adwaredistribution#Ludashi#DLLside-loading#PUAbundlerIOCf8 · i11 · d4 · u3MITRE36
APTMembersSep 20, 2026, 06:28 (UTC+9)VPN Trojan Trio Shares Revoked EV Signature, Clears Sandbox Despite Flags
Three Windows binaries branded as pieces of a consumer VPN client — a small stub called wire.exe, a much larger DLL called wire.dll, and a standalone installer called upWire.exe — all carry the identical publisher chain: WEILAI NETWORK TECHNOLOGY CO., LIMITED, chained up through GlobalSign GCC R45 EV CodeSigning CA 2020 to GlobalSign's root.
#Cactus#ramnitActorsCactus · Cactus Ransomware GroupIOCf33 · i5 · d9 · u2MITRE20