APTMembersSep 19, 2026, 22:37 (UTC+9)Same Packer, Four Years: Gh0st RAT Toolchain Refuses to Retool
Three Farfli/Gh0st droppers submitted four years apart — one first seen in April 2022, two more that surfaced fresh on September 18, 2026 — carry the identical PEiD packing signature and trip the same Elastic-authored detection logic, a rule called Windows_Trojan_Generic_9e4bb0ce. That kind of toolchain stasis, more than any single new sample, is the story in this cluster: an operator that built a packer wrapper and a Gh0st-derivative payload once and has evidently seen no operational need to…
#SaltySpider#Gh0stRAT#Farfli#rootkitdriver#code-signingcertificateabuse#sandboxevasion#credentialdumping#commandandcontrolinfrastructureActorsSalty Spider · KuKuIOCf14 · i0 · d1 · u3MITRE30RegionsUSIndustriesRetail
FILEMembersSep 19, 2026, 06:42 (UTC+9)Remcos RAT Sample Stalls Sandboxes, Checks for Debuggers
A 92-kilobyte Windows executable now flagged by 64 of 74 antivirus engines carries one of the most heavily fingerprinted commodity RATs in current circulation — and it does so with a textbook anti-analysis playbook baked in before it ever reveals its payload. The dropper, tracked here as d9950b1564b0d38cbaec507c8e1cdc41df08d8a638e5f050ff71cb5ceed84867, is unsigned, packed with PEiD, and — according to three independent sandboxes that returned a unanimous malicious verdict — runs as Remcos, the…
#RemcosRAT#GorgonGroup#Subaat#sandboxevasion#anti-debugging#UACbypass#gambling-luredomains#commoditymalwareActorsGorgon Group · SubaatIOCf1 · i0 · d3 · u2MITRE11
C&CMembersSep 19, 2026, 06:33 (UTC+9)New Iranian IP Completes Matched Amadey C2 Pair on AS44208
A new IP address surfaced in the latest sweep of this Amadey-and-RedLine crimeware cluster, and it doesn't open a new front — it closes a loop. 176.46.152.47 sits one address away from 176.46.152.46, both inside the same /22 block registered to Farahoosh Dena PLC under AS44208 in Iran, and both now confirmed serving the identical panel path, `/diamo/data.php, alongside a shared payload filename, /zx.exe.
#Amadey#RedLineStealer#ClipBanker#C2infrastructure#Iran#FarahooshDenaPLC#forgedcodesigning#crimewareIOCf14 · i3 · d0 · u20MITRE55RegionsUSIndustriesRetail
APTMembersSep 18, 2026, 23:05 (UTC+9)Aged 2018 Domain Repointed to Fresh Emotet C2 in Turkey
A domain registered back in April 2018 — long enough to have aged out of any registrar-freshness scrutiny — currently resolves to a command-and-control IP that was flagged for the first time on 2026-09-18. The domain is atici.net, and its single A-record points to 185.15.196.157, a Turkish address on AS201520 (Dedicated Telekomunikasyon Teknoloji Hiz. Tic. San. LTD. STI., Istanbul) that carries a Let's Encrypt certificate minted only weeks earlier.
#Emotet#TA542#Excel4macro#command-and-controlinfrastructure#Let'sEncryptcertificates#domainagelaundering#Turkishhosting#retailsectortargetingActorsEmotet Group · TA542IOCf1 · i2 · d3 · u2RegionsUSIndustriesRetail
FILEMembersSep 18, 2026, 14:36 (UTC+9)Sandbox Clears It, 26 Engines Don't: Allaple's Acrobat HTML Ruse
A dropper posing as an Adobe Acrobat DC interface resource carries the file name "index.html" and sits, according to its own embedded path reference, inside C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\index.html. Twenty-six of 77 engines on VirusTotal flag it as trojan.allaple. A single sandbox run on the same file, however, returned a "harmless" verdict at 99% confidence.
#Allaple#trojan.allaple#AdobeAcrobatDCmasquerade#sandboxevasion#staticvsdynamicdetection#MaxfonSrlnetblock#ItalyISPinfrastructure#packedPE32IOCf33 · i41 · d0 · u0MITRE12RegionsUSIndustriesRetail
C&CMembersSep 18, 2026, 14:27 (UTC+9)Four Disposable-Infrastructure Playbooks Share One Sharktech Backbone
A c2-servers indicator set logged by CTX Team's telemetry on 18 September carries not a single malicious file — no hash, no PE, no sandbox verdict anywhere in it. What it does carry is five IPs and eight domains, and inside that narrow footprint sit four distinct, professionally executed infrastructure playbooks running side by side: a single Let's Encrypt certificate stretched across eight numeric look-alike domains, a same-day-registered Cloudflare-fronted subdomain pair, a same-day…
#Sharktechhosting#Cloudflarefronting#fast-fluxDNS#dynamicDNSrotation#Let'sEncryptcertificatereuse#bulletproofhosting#phishinginfrastructure#containersandpackagingsectorIOCf0 · i5 · d8 · u0MITRE14IndustriesContainers & Packaging
FILEPublicSep 18, 2026, 06:57 (UTC+9)MuddyWater Loader Skips DNS, Curls Straight to a Bare IP
A Windows loader flagged as trojan.donut/dump by 57 of 75 engines is issuing outbound HTTP requests with a curl-style user agent straight to a numeric IP address rather than a resolved domain — a pattern four separate community intrusion-detection rules independently caught on the same sample. The same binary checks the CPU timer before running, a classic sandbox-timing test, and loads additional modules only after that check clears.
#MuddyWater#Seedworm#donutloader#C2tobareIP#sandboxevasion#HostSailorLtd#espionage#in-memoryexecutionActorsMuddyWater · TEMP.ZagrosIOCf3 · i1 · d0 · u1MITRE36RegionsCN
FILEMembersSep 17, 2026, 14:29 (UTC+9)Phorpiex Drop Point Holds Steady as Yemeni Telecom ASN Absorbs New Churn
The most interesting fact in this snapshot of a long-running Phorpiex/Kadrbot cluster isn't a new payload — it's what didn't change. The bare-IP delivery host that anchored CTX Team's earlier look at this cluster, 185.215.113.84, still serves the same six sequentially numbered /twizt/1 through /twizt/6 paths it did before, sitting at 16 of 89 security-vendor detections on VirusTotal.
#Phorpiex#Kadrbot#YementelecomASN#Seychelleshosting#bare-IPdelivery#Xmrigcryptomining#wormdownloader#maliciousfilehashesIOCf4 · i4 · d0 · u7MITRE37RegionsAF · ROIndustriesHealthcare
APTMembersSep 17, 2026, 06:29 (UTC+9)One Blank TLS Certificate Links Four Unrelated Cloud Networks
Thirteen IP addresses spread across a hyperscale social-media company's own network, a discount VPS reseller with points of presence on four continents, and two little-known hosting shells registered in Russia all present the exact same self-signed TLS certificate — serial 1acf3e37b37910d932ea64e6bb27615d6484c07d, with both its issuer and subject fields rendered as the literal string "NONE." That certificate, valid from March 2024 through March 2034, is not the kind of artefact that shows up…
#WireVPN#VPNMaster#codesigningabuse#sandboxevasion#Zenlayer#Bytedanceinfrastructure#self-signedcertificate#commoditymalwaredistributionActorsSpace Pirates · WebwormIOCf70 · i22 · d4 · u0MITRE22
C&CMembersSep 16, 2026, 22:53 (UTC+9)Shared Panel Path Ties Five Rebranded Stealers to One C2 Backend
Eleven Windows payloads carrying five different VirusTotal threat labels — Amadey/Lumma, Stealc, ClipBanker/Cerbu, Kasidet/Fragtor, and Barys — all check in with the same small cluster of IP addresses using a verbatim-identical control-panel path. That's not a coincidence of naming; it's a shared backend wearing five different masks, and it's the detail that makes this cluster worth a second look rather than five separate incident tickets. The path reuse is concrete and traceable.
#Stealc#Amadey#Lumma#ClipBanker#Kasidet#Barys#AS214351#commoditymalwareC2IOCf13 · i5 · d2 · u15MITRE60RegionsBA
APTMembersSep 16, 2026, 22:43 (UTC+9)Downloader Stacks Three Evasion Tricks, Hides C2 in Alibaba DoH Traffic
A downloader carrying the threat label trojan.sfuzuan/convagent packs three separate anti-analysis tricks into a single unsigned Windows binary — a debugger check, a deliberate stall before execution, and a 32-to-64-bit mode transition known as HeavensGate — and then leans on Alibaba's own DNS-over-HTTPS infrastructure to resolve whatever it talks to next.
#trojan.sfuzuan#convagent#HeavensGate#DNS-over-HTTPS#GoldEvergreen#BusinessClub#DGAdomains#downloaderevasionActorsGold Evergreen · Business ClubIOCf5 · i0 · d7 · u2
C&CMembersSep 16, 2026, 14:31 (UTC+9)Bright Data-Signed Proxy SDK Joins Signed VPN-Trojan Pipeline
Two freshly signed executables — a proxy updater called net_updater.exe and a companion labelled idle_report.exe (2b7c3cdca1fd951c…), both carrying a Bright Data Ltd certificate and both first submitted just seventeen days before this review — have surfaced inside a signed-installer distribution pipeline CTX Team has continued to track.
#WireVPN#VPNMaster#BrightData#LuminatiproxySDK#code-signingabuse#sandboxevasion#residentialproxymonetization#signed-installerdistributionActorsCactus · Cactus Ransomware GroupIOCf17 · i14 · d30 · u9MITRE19
FILEMembersSep 16, 2026, 06:44 (UTC+9)Adware Installer With Decade-Expired Cert Wrongly Tagged as Lazarus
An adware installer first signed in January 2014 is still circulating with a code-signing certificate that has been invalid for roughly a decade — and the trust chain still resolves cleanly enough that antivirus engines are split on what to do with it. The file, publicly known under the generic name Installer.exe (c5a1140f6de397ad…), carries a signature block reading "Amonetize ltd.; Thawte Code Signing CA - G2; thawte" [T1553.002], but the leaf certificate's own status field says plainly:…
#LazarusGroup#phandoor#code-signingabuse#adwarebundleware#command-and-controlinfrastructure#Amonetize#Let'sEncryptcertificate#pay-per-installActorsLazarus Group · Hastati GroupIOCf1 · i0 · d1 · u2MITRE13RegionsES · VNIndustriesTelecommunications
FILEMembersSep 15, 2026, 22:33 (UTC+9)20-File Kit Bundles Mimikatz, Revoked Driver, PrintNightmare Exploit
A 20-file dossier tracked by CTX Team reads less like a single implant and more like a toolbox someone packed once and shipped intact. At its center sits the open-source mimikatz credential dumper in its signed 2.2.0.0 release form, flanked by a kernel driver still carrying a certificate its own issuer revoked years ago, a bundled exploit module for the PrintNightmare spooler flaw (CVE-2021-1675), and five Nirsoft password-recovery utilities packed with an identical fingerprint and staged in…
#mimikatz#PrintNightmare#CVE-2021-1675#Nirsoftutilities#credentialtheft#revokedcode-signingcertificate#Sandworm#APT27ActorsSandworm · QuedaghIOCf34 · i0 · d0 · u0MITRE28RegionsBRIndustriesManufacturing
FILEMembersSep 15, 2026, 14:58 (UTC+9)A Fifteen-Year-Old Virus Still Rides a Fresh HTML Template
A Sality file infector first captured in mid-2010 is still circulating today, and the html page delivering it isn't old at all — it's a template reused just eight months apart, sitting at zero detections both times. The pairing is the real story here: a payload so well-documented that 56 of 76 engines flag it on sight, fed through a delivery artifact so unremarkable that VirusTotal's entire detection industry walks past it.
#Sality#badcrypt#salload#SaltySpider#polymorphicmalware#HTMLdropper#USBautorunspread#TofseeJA3fingerprintActorsSalty Spider · KuKuIOCf20 · i2 · d1 · u0RegionsUS
C&CMembersSep 15, 2026, 14:49 (UTC+9)Signed and Trusted: Two Malware Families Ride Valid Certs
Four executables signed with a fully valid Bright Data Ltd certificate — the kind of code-signing chain that is supposed to reassure a user they are installing legitimate software — carry threat labels ranging from hacktool and PUA to adware and downloader, and one of them was flagged outright by a sandbox as a stealer. The file, an 11.5MB installer named net_updater.exe (909f62b450…), returned a malicious verdict with the classification "STEALER" and the family name "PBot," despite presenting…
#BrightDataSDK#PBotstealer#wirevpn/jumpertrojan#code-signingabuse#residentialproxyabuse#revokedEVcertificate#templatedTLSinfrastructure#VPNtrojandistributionActorsCactus · Cactus Ransomware GroupIOCf21 · i19 · d30 · u9MITRE18
FILEMembersSep 14, 2026, 22:58 (UTC+9)One Bundler, Four Fake Names, an APT28 Label That Doesn't Fit
A single Win32 installer, 4.4 megabytes, has spent the past two years circulating under at least four different identities — a PingInfoView update, a Roblox Player installer, a Portuguese file-renaming tool called "renomear-tudo," and a Microsoft PC Manager setup package. All four are the same binary (imphash bdc39b1d…), repackaged under different display names and reused across 1,644 separate submissions from 1,438 unique sources.
#APT28misattribution#adwarebundler#codesigningcertificateabuse#malvertisingredirectinfrastructure#EnigmaProtectorpacker#pay-per-install#commoditycrimeware#Let'sEncryptcertificateabuseActorsAPT28 · StrontiumIOCf2 · i1 · d3 · u5MITRE11IndustriesUtilities
APTMembersSep 14, 2026, 22:38 (UTC+9)TA505 Loader Hides Behind Six-Year-Old Mozambique Academic Domain
The most telling artifact in this cluster isn't a binary — it's a URL. rcf.co.mz/mytimeiswriten.exe sits on a domain registered on 2020-05-03 through Mozambique's academic CIUEM Registrar, a domain that still carries active mail routing and a valid SPF record naming its own hosting IP. Rather than spinning up a fresh, throwaway domain that would trip every newly-registered-domain heuristic on the market, whoever is running this operation appears to have repurposed six years of accumulated…
#TA505#Hive0065#rockloader#DuckDNS#Let'sEncryptcertificaterotation#Mozambiquedomainabuse#dynamicDNSC2#bulletproofhostingActorsTA505 · Hive0065IOCf55 · i2 · d1 · u2RegionsDE · ID · IE · ITIndustriesConstruction · Education & Research · Manufacturing
C&CMembersSep 13, 2026, 22:30 (UTC+9)A Redirect Node With No Name: Certificate Cycling Masks a 2014 Dropper
A domain buried inside a routine C2-infrastructure record — baktus.kilu.de — is not serving its own website. Query it over TLS and the certificate that comes back carries the subject name redirect.subdomain.com, a string that points nowhere near the domain a browser actually requested. That mismatch is the clearest single artefact in this record: it marks the node as a relay hop inside a shared hosting fabric, not an independent site with its own identity.
#invoiceluremalware#Let'sEncryptcertificatecycling#wildcardSANabuse#redirectorinfrastructure#overlaydataPE#billingfraudphishing#C2domainrotation#unattributedclusterIOCf10 · i3 · d16 · u7MITRE23RegionsGB · ROIndustriesTechnology
FILEMembersSep 13, 2026, 15:10 (UTC+9)Revoked EV Certificate Still Signs Fake-VPN Malware for Months
A loader-and-updater trio still carries a fully valid-looking code signature from an EV certificate that VirusTotal has explicitly marked revoked — and the operators kept building new samples under that same signing identity for roughly four months after the revocation took hold. Three files — a sideloaded DLL, its companion loader, and an updater binary that installs to C:\Windows\SysWOW64\wire\ — are signed end to end as WEILAI NETWORK TECHNOLOGY CO., LIMITED, chained up through a GlobalSign…
#WEILAINetworkTechnology#revokedEVcertificate#wirevpnloader#VPNMasterdeceptor#BrightDataSDKabuse#codesigningabuse#fakeVPNmalware#APT15ActorsAPT15 · ROYALAPTIOCf8 · i2 · d3 · u0MITRE24IndustriesFood & Beverages
C&CMembersSep 13, 2026, 15:00 (UTC+9)Decade-Old GameOver Zeus DGA Signature Still Catching Live Malware
Ten Snort and Emerging Threats alerts fired against a 13-kilobyte Windows executable disguised as a courier tracking notice — five of them the exact same rule, "MALWARE-CNC Win.Trojan.Zeus v3 DGA DNS query detected." That rule was written for GameOver Zeus, the peer-to-peer variant of the Zeus banking trojan that law enforcement spent years trying to dismantle starting in 2014.
#Zeus#ZBot#GameOverZeus#domaingenerationalgorithm#Let'sEncryptcertificates#PEiDpacker#commandandcontrol#credentialtheftIOCf5 · i2 · d20 · u6MITRE16RegionsRO
C&CMembersSep 13, 2026, 06:52 (UTC+9)Shared TLS Certificate Links Hong Kong IP to Front Domain in C2 Set
Nine domains and four IP addresses tagged as command-and-control infrastructure share almost nothing in common — different registrars, different countries, different certificate authorities — except for one pairing that stands out precisely because it shouldn't exist by coincidence. The IP address 45.154.14.190, registered to MOACK.Co.LTD under AS 138195 in Hong Kong, presents a TLS certificate whose subject and subject-alternative-name field read "anfangshen.com" and "*.anfangshen.com." The…
#commandandcontrolinfrastructure#TLScertificateabuse#Let'sEncrypt#BrightData#PBotstealer#Cactusransomwaregroup#phishingdomains#codesigningabuseActorsCactus · Cactus Ransomware GroupIOCf1 · i4 · d9 · u1MITRE7IndustriesManufacturing · Telecommunications
APTMembersSep 12, 2026, 22:27 (UTC+9)APT33-Linked Downloader Wears a Dead Code-Signing Chain
A trojan tracked as bsymem — publicly also known as Donoff — ships with an entire three-tier code-signing chain still attached to the binary: GlassWire, a legitimate desktop network-monitoring vendor, sitting underneath a Symantec Class 3 SHA256 Code Signing CA certificate and a root VeriSign certificate. VirusTotal's verdict on that chain is blunt — "the digital signature of the object did not verify" — and two of the three certificates in it are separately flagged as "not time valid." The…
#APT33#bsymem#Donoff#AutoITdownloader#codesigningabuse#customermgmt.net#sandboxevasion#masqueradingActorsAPT33 · MagnalliumIOCf3 · i0 · d1 · u1MITRE24RegionsCH · JOIndustriesGovernment · Support Services
FILEMembersSep 12, 2026, 14:56 (UTC+9)Pterodo Backdoor Hides Inside Fake Blender Install Path
A Windows DLL flagged as trojan.pterodo/doina installs itself under a filepath that reads like a legitimate Blender Foundation component — C:\Program Files\Blender Foundation\Blender\A562C7DBA738DC65D3B7DEADE7FFC31D — a GUID-style filename sitting inside a real 3D-graphics software directory rather than a temp folder or a randomly generated string in %APPDATA%.
#Pterodo#Gamaredon#Shuckworm#backdoorDLL#systembinaryproxyexecution#malwaremasquerading#C2infrastructure#espionagemalwareActorsGamaredon Group · CTIGIOCf2 · i0 · d1 · u0MITRE9RegionsCH · CNIndustriesSupport Services
FILEMembersSep 12, 2026, 06:50 (UTC+9)Aged GoDaddy Domains Get Synced Certs, Front 2018 Macro Downloader
Two domains that have sat quietly under GoDaddy registration since the mid-2000s were both re-fronted with brand-new Let's Encrypt certificates within about five weeks of each other in mid-2026 — dthakar.com and elmodular.com, ages 19 and 20 years respectively, neither showing any sign of active legitimate use in that span. A third node, eatspam.co.uk, and its sole resolving address, 45.158.164.138, picked up matching certificates from the same issuer pool on an overlapping schedule.
#EmotetGroup#w97m/emodldr#macrodownloader#Let'sEncryptcertificateabuse#domainhijacking#GoDaddy#WMIexecution#recycledhostinginfrastructureActorsEmotet Group · TA542IOCf3 · i1 · d3 · u6
APTMembersSep 11, 2026, 23:46 (UTC+9)Installer Hides Its Only Flagged File Among Ten Clean Decoys
Ten PNG and CSS files with an identical creation moment sit alongside a single packed Windows executable that carries every detection in the set — a pairing that reads less like a malware family and more like the internals of an ordinary software installer, repurposed. The image assets are unremarkable on inspection: a close button, a hover state, a grey button, a progress bar, a stylesheet named main.css. Individually they register 0/53 to 0/57 across antivirus engines.
#Snowglobe#AnimalFarm#Sig20#babarmalware#trojanizedinstaller#USretailsector#CloudFrontC2#packedexecutableActorsSnowglobe · Animal FarmIOCf18 · i0 · d2 · u0MITRE27RegionsUSIndustriesRetail
C&CMembersSep 11, 2026, 22:51 (UTC+9)Twenty Throwaway .xyz Domains Funnel Into One Kronos Panel Path
Twenty domains in this record — every one an algorithmically-generated string of consonant clusters under the .xyz top-level domain — resolve, wherever resolution data survives, to the identical checkout path /kronos/connect.php. That is not a coincidence of naming; it is the fingerprint of a single command-and-control panel template stamped across disposable infrastructure rather than the work product of twenty independent operators standing up their own C2.
#Kronosbankingtrojan#C2infrastructure#domaingenerationalgorithm#packed.NETloader#.xyzdomains#WHOISobfuscation#financiallymotivatedcybercrime#anti-analysistechniquesIOCf3 · i0 · d22 · u40MITRE31RegionsCH · JOIndustriesSupport Services
APTPublicSep 11, 2026, 22:38 (UTC+9)A Political Decoy Document Reopens a 2016 Word-Processor Flaw
A Korean-language document about inter-Korean political affairs is still being used to trigger a nine-year-old Hangul Word Processor flaw, and the payload it drops is evading a meaningful share of security engines nearly a decade after it was first compiled. The lure — a corrupted HWP container (29430240cb59a12fcde8e4153c0859c90d5a928503a1ca05433f08a7b3c50bf2) carrying an internal object path that resolves to a temp file named for a comparison of "2016 and 2017 South Korea-facing affairs" —…
#Group123#ScarCruft#APT37#ROKRAT#HWPexploit#CVE-2016-2569#SouthKorea#espionageActorsGroup123 · Venus 121IOCf2 · i1 · d0 · u0MITRE21RegionsCH · JOIndustriesSupport Services
C&CMembersSep 10, 2026, 22:28 (UTC+9)Shared Certificates Tie Decade-Spanning Domains to Proxyware Cluster
Five domains with nothing obviously in common — a fitness-therapy site, a Korean-registered shell, a martial-arts studio, a decade-old Chinese-registered parking page, and a fresh mobile subdomain — picked up new TLS leaf certificates from Google Trust Services within the same seven-week window in mid-2026. tswlmy.com has been registered since April 2013; fxlvpaiguan.com was registered on 2026-07-31, barely a month before the record was compiled.
#WireVPN#VPNMaster#BrightData#Zenlayer#proxyware#code-signingabuse#certificateprovisioning#PUAloadersActorsCactus · Cactus Ransomware GroupIOCf50 · i7 · d13 · u4MITRE12
FILEMembersSep 10, 2026, 14:52 (UTC+9)Fake Windows Update Binary Hides Stealc Credential Stealer
A binary that calls itself wsus.exe, complete with a spoofed "AdobeReaderFlash Corporation" copyright string, has been circulating disguised as a routine Windows Update helper — and underneath the generic trojan labels most antivirus engines assign it, a named detection rule identifies the payload specifically as Stealc, a known credential-stealing family.
#Stealc#masquerading#wsus.exe#sandboxevasion#HostkeyB.V.#credentialtheft#Silence#commandandcontrolActorsSilence · Contract CrewIOCf2 · i1 · d0 · u2MITRE23RegionsCH · CN · JOIndustriesSupport Services
C&CMembersSep 10, 2026, 14:43 (UTC+9)Amadey Malware Wears Expired Microsoft Certificate, Skips DNS
Two payloads dropped in the same late-July 2025 build window — a 2,582 KB Windows executable and a 6,338 KB 64-bit DLL — carry an identical Microsoft code-signing chain, down to the leaf certificate's serial number, and both fail signature verification the moment a scanner actually checks the math. The certificate reads "Microsoft Windows; Microsoft Windows Production PCA 2011; Microsoft Root Certificate Authority 2010," a fully-formed three-tier chain that would pass a glance at a properties…
#Amadey#RedLineStealer#LummaStealer#codesigningforgery#clipboardhijacking#C2infrastructure#commoditycrimeware#DNS-lessC2IOCf9 · i2 · d0 · u14MITRE43RegionsVN
C&CMembersSep 10, 2026, 06:48 (UTC+9)Shared Loader Code Links Five 'Unrelated' Malware Families to One C2
Ten files, five different antivirus family labels, and one code-level fingerprint that should not be there. A clipboard-hijacking banker compiled as a 251KB Windows executable and a bazaar-style loader shipped as a 109KB DLL — tools that vendor engines classify as entirely separate malware — both fire the identical YARA rule pair `INDICATOR_SUSPICIOUS_ReflectiveLoader and ReflectiveLoader.
#StealC#BazarLoader#ClipBanker#Amadey#reflectiveDLLinjection#bare-IPC2#AS214351#FemoITSolutionsIOCf10 · i3 · d0 · u8MITRE48
FILEMembersSep 9, 2026, 22:58 (UTC+9)Malware Sample Stalls to Dodge Sandboxes, Hides Behind Thin Infrastructure
A Windows executable masquerading as joduj.exe (e9e732f7…) sits idle after launch, deliberately stalling for long stretches and polling the CPU clock directly to work out whether it has landed inside a sandbox before it will do anything else. That single behavioural signature — confirmed by a malicious verdict from the Yomi Hunter sandbox and flagged by 55 of 75 engines — is the strongest piece of evidence in this case, and it maps cleanly to time-based sandbox evasion [T1497.003].
#SpringDragon#LotusBlossom#sandboxevasion#timestomping#importtableanalysis#SouthKorea#SKBroadband#espionagemalwareActorsSpring Dragon · Lotus BlossomIOCf5 · i2 · d0 · u4RegionsIN
C&CMembersSep 9, 2026, 22:36 (UTC+9)Valid Bright Data Certificate Signs a Sandboxed PBot Stealer
A residential-proxy SDK carrying a currently valid Bright Data Ltd code-signing certificate has been sandboxed with a malicious verdict naming the stealer family PBot — the freshest and most unsettling signal in a ten-file set that otherwise reads like ordinary VPN and proxy bloatware. Two other toolchains in the same batch ride certificates that have already been revoked or expired, yet neither produces a cleaner behavioural outcome than the one still in good standing.
#BrightDataSDK#PBotstealer#residentialproxyabuse#WEILAIGlobalSignEVcertificate#VPNMasterbundler#code-signingcertificateabuse#PUAadwareeconomy#trojanizedinstallerIOCf21 · i8 · d12 · u0MITRE21
APTMembersSep 9, 2026, 22:29 (UTC+9)Pirated Mortal Kombat Installer Feeds Debugger-Aware Loader Chain
Two unsigned Win32 installers dressed up as a pirated "Mortal Kombat 1" setup from the FitGirl repack scene are functioning as the entry point for a debugger-aware loader chain that ends with a second-stage payload fetched over plain HTTP. Both files carry identical product and copyright metadata — "Mortal Kombat 1" and "FitGirl" — and both use the meaningful name setup.exe, with one retaining the full internal path E:\Mortal_Kombat_1_--_fitgirl-repacks.site\setup.exe. Neither is code-signed.
#DBatLoader#DonutLoader#VoidArachne#SilverFox#piratedsoftwarelure#TLScertificatereuse#Russia-hostedinfrastructure#ingresstooltransferActorsVoid Arachne · Silver FoxIOCf9 · i5 · d2 · u1RegionsBR
C&CMembersSep 8, 2026, 22:31 (UTC+9)Fake Alibaba, UnionPay Certificates Mask C2 on China Mobile IPs
A TLS certificate now circulating across five carrier-grade Chinese IP addresses lists its subject organization as "Alibaba (China) Technology Co., Ltd." — a real corporate name borrowed for infrastructure that has nothing to do with the company. The certificate, serial 6696262f452fcf46b79266a8, carries the common name *.certfallback.com and was issued by GlobalSign's GCC R46 OV TLS CA 2025, an organization-validated authority that is supposed to confirm the entity behind a certificate before…
#Alibabaimpersonation#UnionPayimpersonation#ChinaMobile#TLScertificatespoofing#C2infrastructure#yunkeit.com#GlobalSignOVcertificate#carrierIPabuseIOCf3 · i6 · d3 · u1MITRE37
FILEPublicSep 8, 2026, 14:33 (UTC+9)Fake KMSPico Activator Cluster Traces to Adware Builder, Not APT10
A trojanized copy of KMSPico — the pirated-software crowd's favorite "free" Windows and Office activation tool — is the lure carrying an entire adware-bundler cluster: six installers and a companion batch script, all packaged inside Nullsoft Installer (NSIS) self-extracting archives and all first seen within a roughly nine-month window spanning April 2015 to January 2016.
#KMSPico#adwarebundler#NSISinstaller#code-signingcertificateabuse#browsefox#outbrowse#RedApolloAPT10misattribution#builder-as-a-serviceActorsRed Apollo · PotassiumIOCf7 · i1 · d1 · u0MITRE21RegionsJP
C&CMembersSep 8, 2026, 06:50 (UTC+9)No Domain, No Problem: Amadey Loader Cluster Skips DNS Entirely
Six files and three IP addresses make up this record, and not one of them ever needed a hostname. Every network indicator in the set — thirteen URLs in total — resolves to a bare dotted-quad address rather than a domain, a detail confirmed by the indicator catalog itself: the domains table carries a header row and nothing beneath it. That is the most concrete signal in this campaign, and it is not incidental.
#Amadey#Stealc#Lumma#MicroClip#IP-basedC2#DNSevasion#OmegatechLTD#bulletproofhostingActorsTransparent Tribe · Copper FieldstoneIOCf6 · i3 · d0 · u13MITRE34RegionsNG
C&CMembersSep 7, 2026, 22:38 (UTC+9)Revoked EV Cert and Live Bright Data Signature Both Weaponized
Three separate builds of a fake VPN client — upWire.exe, wire.exe and wire.dll — carry the exact same EV code-signing certificate from a company called WEILAI NETWORK TECHNOLOGY CO., LIMITED, and every one of them was signed and distributed well after VirusTotal's own signature chain marked that certificate "not time valid" and its trust "revoked." That is not a one-off scan artifact.
#code-signingabuse#revokedcertificate#BrightDataSDK#PBotstealer#fakeVPNinstaller#WEILAINETWORKTECHNOLOGY#signed-binarytrustabuse#residentialproxySDKActorsSpace Pirates · WebwormIOCf10 · i4 · d3 · u1MITRE19IndustriesGovernment
APTMembersSep 7, 2026, 22:29 (UTC+9)Fake PDF Reader Ecosystem Runs on Two Valid Corporate Code Signatures
Two entirely separate, still-valid commercial code-signing chains are being used in parallel to push the same lure: consumer utility installers — PDF readers, zip tools, photo viewers — that dozens of antivirus engines flag as adware while sandboxes wave them through as clean. Thirteen samples carry a GlobalSign GCC R45 CodeSigning CA 2020 certificate issued to 沧州句号网络科技有限公司 (Cangzhou Juhao Network Technology Co., Ltd.), with detection ratios ranging from 18 to 46 out of roughly 77 engines.
#codesigningabuse#GlobalSigncertificate#DigiCertcertificate#adware#PUPdistribution#ChinaTelecomFujian#Qihoo360impersonation#fakePDFreaderActorsSalty Spider · KuKuIOCf18 · i5 · d0 · u0MITRE10
FILEMembersSep 7, 2026, 14:46 (UTC+9)One TLS Certificate Ties Five Hosts to Sekisui House Impersonation
Seventeen IP addresses sit inside a single file-hash record tagged to the Allaple worm family, and fourteen of them collapse into one place: AS4713, registered to NTT DOCOMO BUSINESS,Inc. Five of those fourteen — 202.18.210.172, 202.18.210.153, 202.18.209.143, 202.18.209.144, and 202.18.209.153 — serve a byte-identical TLS certificate, serial b9f3aa6546060eaeb9b07a8fed689d8, issued by GeoTrust TLS RSA CA G1 under DigiCert, with a wildcard subject of *.sekisuihouse.co.jp.
#Allaple#AS4713#NTTDOCOMOBUSINESS#SekisuiHouseimpersonation#TLScertificatespoofing#masquerading#Japaninfrastructure#maliciousfilehashesIOCf9 · i17 · d0 · u0MITRE25RegionsUSIndustriesRetail
C&CPublicSep 7, 2026, 14:30 (UTC+9)Sandbox Verdict 'EVADER': RFQ Downloader's Debugger Checks and Stalls
A JavaScript downloader dressed as a routine purchase-order email doesn't just evade detection by accident — in this case, a sandbox measured the evasion and gave it a name. Zenbox returned a 100%-confidence verdict of "MALWARE/EVADER" against a script masquerading as "Anika RFQ NEW ORDER V01370P25080002.js" (a670ca27…), flagging behaviour that checks whether a debugger is attached and deliberately stalls execution for long periods before doing anything else.
#EVADERsandboxverdict#RFQphishinglure#JavaScriptdownloader#trimnt.comC2#catbox.moeabuse#sagentmalware#Let'sEncryptcertificateabuse#detonation-delayevasionIOCf13 · i2 · d1 · u1RegionsAE · AT · AU · AZIndustriesArts & Entertainment · Automotive · Construction
APTMembersSep 7, 2026, 06:39 (UTC+9)One TLS Certificate Ties Three Alibaba Cloud IPs to Fallback C2
The most concrete signal in this indicator set is not a payload — it is a certificate. Three IP addresses, 163.181.72.193, 163.181.72.200 and 163.181.72.201, all sitting inside the 163.181.72.0/23 block and geolocated to Thailand, present the identical TLS certificate serial 6696262f452fcf46b79266a8 with the identical wildcard subject *.certfallback.com.
#TA505#rockloader#AlibabaCloud#certificatepinning#Thailandinfrastructure#C2fallback#crackedsoftwarelures#TLSfingerprintingActorsTA505 · Hive0065IOCf2 · i5 · d2 · u0IndustriesHealthcare
C&CMembersSep 6, 2026, 14:28 (UTC+9)Fake VPN Installers Share Packer Fingerprint, Revoked Certificate Reuse
A metadata marker meant to track Adobe image assets — the kind of thing that normally shows up in a PDF or a photo editor — turns up instead inside three Windows installers that have nothing else in common on paper. One poses as a Viber setup file. Two are builds of Bright Data's legitimate residential-proxy SDK, sold commercially as net_updater.exe.
#WireVPN#BrightDataSDK#PBotstealer#revokedEVcertificate#self-signedTLScertificate#code-signingabuse#C2infrastructure#ZenlayerBytedancehostingActorsCactus · Cactus Ransomware GroupIOCf36 · i8 · d12 · u2MITRE16
C&CMembersSep 6, 2026, 06:41 (UTC+9)Five-Year-Old Phorpiex Banker Still Fools Two of Six Sandboxes
A Win32 executable built in May 2021 is still checking in against the same command-and-control panel it has used for years, and it is still winning against two of the six sandboxes that tried to detonate it. The file — 100KB, unsigned, carrying the threat label trojan.phorpiex/clipbanker (552ac091…9e17) — has been resubmitted 46 times from 37 unique sources, with a submission as recent as 2026-08-22 sitting on top of a compile timestamp from 2021-05-07.
#Phorpiex#ClipBanker#clipboardhijacking#commandandcontrol#sandboxevasion#cryptocurrencytheft#constructionsector#ToronionserviceIOCf3 · i1 · d1 · u7MITRE34RegionsBO · KZ · MXIndustriesConstruction · Technology
FILEMembersSep 5, 2026, 22:40 (UTC+9)Fake Adobe Acrobat DC Folder Hides Base64-Obfuscated URL
Three HTML files carrying the generic "trojan.allaple" label look, at first glance, like leftovers from a worm outbreak that antivirus vendors have tracked for the better part of two decades. Buried in their metadata, though, is a more specific and more current story: two of the three files were captured with internal path names placing them inside a real Adobe Acrobat DC installation tree — C:\Program Files\Adobe\Acrobat DC\Acrobat\ngl_resources\resources\ui\index.html and C:\Program…
#Allaple#masquerading#defenseevasion#AdobeAcrobatDC#Base64obfuscation#VerizonBusiness#maliciousfilehashes#YARAdetectionIOCf33 · i11 · d0 · u1MITRE25RegionsUSIndustriesRetail
C&CMembersSep 5, 2026, 22:27 (UTC+9)Fake VPN Installer, IR-Aware Beacon, Forged Signature Tie to One Server
A fake VPN installer that a leading sandbox rated 97% "clean," a reverse-shell beacon built to notice when incident responders are watching, and a 6-megabyte trojan that dresses itself in a code signature no root authority will vouch for — three unrelated builds, no shared imphash, no shared signer, converging on a single certificate-linked server.
#APT28#trojanizedVPNinstaller#reverse-shellbeacon#codesigningabuse#Let'sEncryptcertificate#C2infrastructure#Netherlandshosting#IDSdetectionActorsAPT28 · StrontiumIOCf34 · i1 · d1 · u2RegionsCH · JO · TWIndustriesFood & Beverages · Government · Support Services
APTMembersSep 5, 2026, 14:28 (UTC+9)A Shopify Wildcard Certificate Is Serving DarkSide's Command Channel
The freshest piece of this investigation is not the ransomware payload — it is the domain answering for it. baroquetees.com, registered on 2026-02-19 through TUCOWS.COM, CO., resolves to a single IP address, 23.227.38.71, behind Google Cloud DNS name servers (ns-cloud-a1 through ns-cloud-a4.googledomains.com). Its most recently observed TLS certificate, issued by Cloudflare TLS Issuing ECC CA 1, does not carry baroquetees.com in its subject or SAN fields at all.
#DarkSideransomware#GoldWaterfall#TLScertificatemismatch#Cloudflareinfrastructure#command-and-controldomain#Shopifywildcardcertificate#Romania#IDSsignaturedetectionActorsDarkside · Gold WaterfallIOCf1 · i0 · d1 · u2MITRE35RegionsRO
FILEMembersSep 5, 2026, 06:54 (UTC+9)A Code-Signing Chain That Fails on the Clock, Not the Crypto
A Win32 binary carrying a full COMODO-anchored code-signing chain isn't unusual — until you notice the validation failure has nothing to do with the signature itself. The file, chained through LLC "INTELEKT-SOFT" up through COMODO RSA Code Signing CA to Sectigo (formerly Comodo CA), fails verification purely because its leaf certificate's validity window — 21 September 2015 to 20 September 2016 — no longer covers the clock the verifier is checking against (35cf61c8b0…).
#Snowglobe#AnimalFarm#Sig20#babarmalware#code-signingcertificateabuse#packerevasion#command-and-controlinfrastructure#espionageActorsSnowglobe · Animal FarmIOCf1 · i0 · d2 · u0MITRE17RegionsUSIndustriesRetail
APTMembersSep 5, 2026, 06:28 (UTC+9)A 2019 Emotet Invoice Lure Resurfaces With Newly Certified Dormant Domains
A Word document dressed as a German electricity invoice and a Polish payment notice has resurfaced in telemetry alongside four domains whose registration dates read like a timeline of the internet itself — 1997, 2004, 2014, and 2026. Three of those domains sat dormant for a decade or more before anyone bothered to issue them a fresh TLS certificate; the fourth, registered this year, doesn't even carry its own certificate, borrowing a wildcard from a shared hosting platform instead.
#Emotet#TA542#MummySpider#malspam#domainreactivation#TLScertificateabuse#defenseevasion#invoicephishinglureActorsEmotet Group · TA542IOCf3 · i0 · d4 · u7RegionsDE