APTMembersSep 5, 2026, 14:28 (UTC+9)A Shopify Wildcard Certificate Is Serving DarkSide's Command Channel
The freshest piece of this investigation is not the ransomware payload — it is the domain answering for it. baroquetees.com, registered on 2026-02-19 through TUCOWS.COM, CO., resolves to a single IP address, 23.227.38.71, behind Google Cloud DNS name servers (ns-cloud-a1 through ns-cloud-a4.googledomains.com). Its most recently observed TLS certificate, issued by Cloudflare TLS Issuing ECC CA 1, does not carry baroquetees.com in its subject or SAN fields at all.
#DarkSideransomware#GoldWaterfall#TLScertificatemismatch#Cloudflareinfrastructure#command-and-controldomain#Shopifywildcardcertificate#Romania#IDSsignaturedetectionActorsDarkside · Gold WaterfallIOCf1 · i0 · d1 · u2MITRE35RegionsRO
FILEMembersSep 5, 2026, 06:54 (UTC+9)A Code-Signing Chain That Fails on the Clock, Not the Crypto
A Win32 binary carrying a full COMODO-anchored code-signing chain isn't unusual — until you notice the validation failure has nothing to do with the signature itself. The file, chained through LLC "INTELEKT-SOFT" up through COMODO RSA Code Signing CA to Sectigo (formerly Comodo CA), fails verification purely because its leaf certificate's validity window — 21 September 2015 to 20 September 2016 — no longer covers the clock the verifier is checking against (35cf61c8b0…).
#Snowglobe#AnimalFarm#Sig20#babarmalware#code-signingcertificateabuse#packerevasion#command-and-controlinfrastructure#espionageActorsSnowglobe · Animal FarmIOCf1 · i0 · d2 · u0MITRE17RegionsUSIndustriesRetail
APTMembersSep 5, 2026, 06:28 (UTC+9)A 2019 Emotet Invoice Lure Resurfaces With Newly Certified Dormant Domains
A Word document dressed as a German electricity invoice and a Polish payment notice has resurfaced in telemetry alongside four domains whose registration dates read like a timeline of the internet itself — 1997, 2004, 2014, and 2026. Three of those domains sat dormant for a decade or more before anyone bothered to issue them a fresh TLS certificate; the fourth, registered this year, doesn't even carry its own certificate, borrowing a wildcard from a shared hosting platform instead.
#Emotet#TA542#MummySpider#malspam#domainreactivation#TLScertificateabuse#defenseevasion#invoicephishinglureActorsEmotet Group · TA542IOCf3 · i0 · d4 · u7RegionsDE
APTMembersSep 4, 2026, 14:35 (UTC+9)Pirated Windows Activator Hides Five-Stage Intrusion Kit
A "free" copy of KMSAuto — the activation utility that generations of users have downloaded to skirt Windows licensing — carries a code-signing certificate that the distributor minted for itself, a loader dressed as a Google Chrome updater, a userland rootkit, a coin-mining payload, and a fifteen-year-old kernel driver still on the LOLDrivers vulnerable-driver list. None of those five components is individually novel.
#KMSAuto#APT27#BYOVD#WinRing0#code-signingabuse#coinminer#rootkit#MalaysiagovernmentsectorActorsAPT27 · TEMP.HippoIOCf17 · i0 · d3 · u1MITRE58RegionsMYIndustriesGovernment
FILEMembersSep 3, 2026, 22:54 (UTC+9)Espionage C2 Domain Hides Behind Its Hosting Provider's Certificate
An espionage-linked command-and-control domain, mercadojs.com, is presenting a public face that belongs to its landlord rather than its operator. The domain resolves to a single IP address, 82.25.83.117, sitting on AS 47583 — Hostinger International Limited — but the certificate served from that address is issued to "hostinger.com" with a wildcard subject-alternative-name covering *.hosting24.com, both of them Hostinger's own branded properties, not mercadojs.com.
#mercadojs.com#OperationGhoul#Hostinger#Let'sEncrypt#Switzerland#Jordan#command-and-control#espionageActorsOperation GhoulIOCf1 · i1 · d1 · u1MITRE13RegionsCH · JOIndustriesGovernment · Support Services
APTMembersSep 3, 2026, 22:28 (UTC+9)Decade-Old Flash Exploit Rides Along With Game-Trainer Loader
A Vietnamese-language "auto-trainer" toolkit for the online game Vo Lam Truyen Ky is quietly bundling something considerably nastier than a speed-hack: a packed loader called VulanPK.exe paired, byte for byte in the same build directory, with an exploit DLL that still carries the fingerprint of a 2015 Adobe Flash Player vulnerability.
#BlueBottle#Opera1er#CVE-2015-2387#game-trainermalware#Vietnam#MegaDNS#Taggantpacker#malvertisingActorsBlueBottle · Opera1erIOCf80 · i1 · d2 · u3MITRE35RegionsAT
C&CMembersSep 3, 2026, 14:32 (UTC+9)Disposable Certs and VPS Templates Tie Together a VPN-Trojan/Stealer Web
Three IP addresses in a single Zenlayer /21 block in the Philippines — 156.59.113.131, 156.59.113.132, and 156.59.113.134 — are all presenting the exact same self-signed TLS certificate, serial 1acf3e37b37910d932ea64e6bb27615d6484c07d, valid from March 2024 clear through March 2034. None of the three shows any VirusTotal detections (0/91 across the board), and none carries a hostname behind the certificate — the issuer and subject fields both read simply "NONE." That absence of a domain layer…
#Zenlayer#self-signedcertificate#BrightData#PBotstealer#WEILAINETWORKTECHNOLOGY#codesigningabuse#Philippinesinfrastructure#trojanizedVPNinstallerIOCf30 · i6 · d14 · u5MITRE9
C&CMembersSep 2, 2026, 23:06 (UTC+9)Bot Panel's Command Menu Exposed in Plain URL Parameters
A command-and-control server rarely tells a researcher what it can do before it is even queried, but the PHP panel sitting behind 5.175.209.151 does exactly that. Six URLs observed against the IP all funnel through the same script, /ft/si.php, and the query strings read like an operator's own feature list rather than obfuscated traffic: a listing function, a version check, a download trigger, a shell-execution flag, and a distributed-denial-of-service tasking flag, all addressed to a single bot…
#GamaredonGroup#wavipegtrojan#PHPbotpanel#DDoStasking#Microsoftmasquerade#RIPENCCGermany#imphashcluster#C2infrastructureActorsGamaredon Group · CTIGIOCf8 · i1 · d0 · u6MITRE27RegionsUA
C&CMembersSep 2, 2026, 06:42 (UTC+9)Decade-Old Locky-Lineage Loader Rides New Four-Nation C2 Panel Grid
A command-and-control backbone built from eight bare-IP endpoints spread across four unrelated hosting networks in Russia, Estonia and France — every single one answering on the identical /main.php path — has surfaced attached to a loader that first appeared on file-scanning services back in 2016. The infrastructure is the story here: none of the four autonomous systems recur elsewhere in the indicator set, no certificate or registrar links any of the eight domains that sit behind them, and yet…
#Rtm#CryptOne#Locky#Cerber#Tinba#C2infrastructure#DGAdomains#loadermalwareActorsRtmIOCf1 · i4 · d8 · u16MITRE10RegionsCH · JOIndustriesGovernment · Support Services
C&CMembersSep 1, 2026, 22:41 (UTC+9)PANMAP Dropper Fakes Microsoft Branding, C2 Cert Predates Domain
A Win32 dropper carrying the internal name PANMAP and presenting itself as PANMAP.DLL — complete with a product string reading "Microsoft® Windows® Operating System" and a Microsoft copyright line — ships with no valid code signature at all; signature validation on the binary fails outright. That single contradiction, a file dressed head-to-toe in Microsoft branding while carrying zero cryptographic proof of Microsoft origin, is the cleanest piece of tradecraft in this record, and it anchors a…
#PANMAPdropper#masquerading#Smokeloader#Tinba#self-signedcertificate#C2domain#SmokySpider#stagedpayloadActorsSmoky SpiderIOCf1 · i0 · d1 · u1MITRE21RegionsCH · JOIndustriesSupport Services
FILEMembersAug 31, 2026, 23:10 (UTC+9)RuntimeBroker Impersonator Rides a Frozen C2 Backbone
A dropper carrying the internal name WmiPrvSE and exported to disk as runtimebroker.exe has surfaced with a full anti-analysis stack — debugger checks, deliberate execution stalling, and a Zenbox sandbox verdict of MALWARE/EVADER at 88% confidence — while the infrastructure behind it has not moved at all. The three IP addresses tied to this activity sit on the same autonomous system, AS214351, registered to Femo IT Solutions Limited, that CTX Team has already tracked in earlier coverage of this…
#WizardSpider#RuntimeBrokermasquerading#AS214351#FemoITSolutions#C2infrastructure#packeddropper#SwitzerlandJordantargeting#TLScertificateimpersonationActorsWizard Spider · Grim SpiderIOCf1 · i3 · d0 · u6MITRE34RegionsCH · JOIndustriesFood & Beverages · Government · Support Services
C&CMembersAug 31, 2026, 15:07 (UTC+9)Three-Year-Old njRAT Builder Fingerprint Resurfaces in 2026 Wave
Five .NET executables tracked in this reporting cycle, first surfacing as early as May 2023 and as recently as April 2026, share a single import-table hash — f34d5f2d4577ed6d9ceec516c1f5a744 — and a universal .NET Reactor packing signature, even though VirusTotal's own classifiers split them across three different label aliases: bladabindi, variadic, and cdmip. That split is cosmetic.
#njRAT#Bladabindi#commodityRAT#C2infrastructure#PaaSabuse#imphashtracking#UACbypass#LazarusGroupattributionActorsLazarus Group · Hastati GroupIOCf7 · i1 · d6 · u4MITRE33RegionsUS
APTMembersAug 31, 2026, 14:42 (UTC+9)Five DDNS Hostnames, One Backend, Tied to DarkHotel Downloader
Five command-and-control hostnames spread across four unrelated free dynamic-DNS providers — Zyns, Crabdance (used twice), ServeHTTP, and Mooo — all resolve to the identical backend panel path, `/bin/home/home.php and /bin/home/view.php, and all carry the same encoded parameter string, a2=1ae8bdddea716a1fa3c8492572357e80. That repetition is the news here: gigamiros.zyns.com, microzion.crabdance.com, mirosmial.crabdance.com, microgenuinsman.servehttp.com and nanobis.mooo.com look, on the…
#DarkHotel#garveep#dynamicDNSabuse#downloadermalware#espionage#HongKong#Japan#technologysectorActorsDarkHotel · Fallout TeamIOCf1 · i1 · d1 · u25MITRE8RegionsHK · JPIndustriesTechnology
FILEMembersAug 30, 2026, 22:41 (UTC+9)Revoked 2011 Certificate Still Fools Users into Trusting AutoIt Loader
A code-signing certificate that GlobalSign revoked years ago is still doing work for its original signer's name — just not for the original signer's purpose. In a file cluster CTX Team has been tracking, a binary that presents itself as the legitimate AutoIt v3 scripting runtime carries a signature chain rooted in AutoIt Consulting Ltd, issued through GlobalSign ObjectSign CA back in May 2011 and expired by design in 2014.
#LazyScripter#NetWireRAT#AutoIt#code-signingcertificateabuse#dynamicDNS#sandboxevasion#GlobalSign#commoditymalwareActorsLazyScripterIOCf22 · i1 · d1 · u1MITRE27
C&CMembersAug 30, 2026, 14:45 (UTC+9)One Wildcard Certificate Links Five China Unicom IPs Across Four Subnets
Five IP addresses sitting on four separate subnets inside China Unicom's core network all answer HTTPS requests with the exact same TLS certificate — serial 6696262f452fcf46b79266a8, issued by GlobalSign GCC R46 OV TLS CA 2025, carrying the subject organisation "Alibaba (China) Technology Co., Ltd." and a wildcard subject name of *.certfallback.com. That is not a coincidence of shared hosting; it is one certificate identity deliberately deployed across a diversified physical footprint.
#ChinaUnicomAS4837#TLScertificateabuse#C2infrastructure#codesigningabuse#HaoZip#2345adware#Salityattribution#fallbackhostingActorsSalty Spider · KuKuIOCf5 · i5 · d1 · u1MITRE16
APTMembersAug 29, 2026, 22:36 (UTC+9)A Builder Fingerprint Ties Three 'Different' Trojans to One Assembly Line
Three files carrying three unrelated threat labels — trojan.msil/jalapeno, trojan.msil/agenttesla and trojan.msil/zusy — turn out, on inspection of their import tables, to be the same product line. Each one carries the identical import hash f34d5f2d4577ed6d9ceec516c1f5a744, a fingerprint of the exact function-import list a .NET builder or crypter service stamps into every executable it produces.
#imphash#MSILtrojan#AgentTesla#GCleaner#pay-per-installloader#Cloudflareinfrastructure#commoditystealer#OperationBlackAtlasActorsOperation Black AtlasIOCf23 · i2 · d5 · u7MITRE51
FILEMembersAug 29, 2026, 14:41 (UTC+9)A Domain Pair Provisioned in Lockstep Points to a Templated C2 Build Pipeline
Two decoy domains behind a North Korea-linked loader were not stood up independently — they were minted, hosted, and TLS-certified as a single scripted event. tecnojournals.com and semiconductboard.com were both registered through Gandi SAS on 2024-07-18, both resolve to the identical IP address 34.41.139.193, and both delegate authority to the same custom nameserver pair, ns1.hwrn.net and ns2.hwrn.net, rather than to registrar-default infrastructure.
#Andariel#Stonefly#SilentChollima#Dtrack#C2infrastructureprovisioning#Microsoftcode-signingmasquerade#NorthKorea-nexusespionage#retailsectortargetingActorsSilent Chollima · AndarielIOCf1 · i0 · d2 · u10MITRE16RegionsCN · USIndustriesRetail
C&CMembersAug 29, 2026, 00:50 (UTC+9)83 'Suppobox' Domains Trace Back to a Handful of Shared Hosts
Eighty-three lookalike ".net" domains sit inside a single threat-feed category tagged "suppobox," but the interesting story here is not a payload — it is how the hosting layer beneath those domains was built. Stripped of their two-word dictionary names (gentlemanprobable, waterbicycle, experiencewithout), the domains resolve down to a handful of shared IPs, recycled nameserver pairs, and certificates that were either batch-issued or borrowed outright from unrelated infrastructure.
#suppobox#C2infrastructure#domaingenerationalgorithm#certificateabuse#Dynadot#retailsector#UnitedStates#sharedhostingIOCf3 · i0 · d83 · u7MITRE25RegionsUSIndustriesRetail
APTMembersAug 28, 2026, 23:11 (UTC+9)Signed Bright Data Component Escalates From Trojan to Stealer
A binary called net_updater.exe, carrying a valid, unrevoked Authenticode chain issued to Bright Data Ltd through DigiCert's Trusted G4 code-signing program, has moved through three successive builds between September 2025 and June 2026 — and detection engines have not agreed on what to call it at any point along the way. The first build, submitted in September 2025 (ae182434d7a588ed1d73054394fca0d95d8ea8d1b2cdb51477351e7c1df0932d), drew the label trojan.luminati/brightdata from 21 of 76…
#BrightData#PBotstealer#codesigningabuse#adware#trojan#Cactusransomwaregroup#TLScertificatereuse#domaininfrastructureActorsCactus · Cactus Ransomware GroupIOCf14 · i14 · d20 · u4MITRE8IndustriesHealthcare · Telecommunications
APTMembersAug 28, 2026, 22:31 (UTC+9)Disposable Storefronts Share One DNS Backbone Behind GCleaner Loaders
Three domains dressed up as e-commerce storefronts — shhsift.click, kupzovo.shop, and vexdico.shop — resolve through the identical nameserver pair ns1.dyna-ns.net and ns2.dyna-ns.net, the Dynadot-operated DNS infrastructure that sits behind all three registrations. That is not three operators independently choosing the same registrar; it is the same DNS footprint appearing on domains with unrelated naming conventions and different final IP addresses (159.65.136.5, 66.228.41.52, and…
#GCleanerloader#InjectorNett#APT28misattribution#Dynadotinfrastructure#Let'sEncryptYE2#pay-per-install#commoditymalware#disposabledomainsActorsAPT28 · StrontiumIOCf15 · i1 · d5 · u9MITRE23
C&CMembersAug 28, 2026, 14:49 (UTC+9)Decade-Old Firefox Impersonator Resurfaces in 2026 C2 Feed
A 139-kilobyte Windows executable that dresses itself up as Firefox 40.0.3 — spoofing the product name, internal name and copyright string of Mozilla's own build metadata while carrying no digital signature at all — has surfaced inside a command-and-control indicator set first logged on 2026-02-05 and still being tracked through 2026-08-28. The file itself is nothing new: its earliest submission dates to 2015-12-10, a full decade before the rest of this record's sighting window opens.
#waledac#Firefoxspoofing#processinjection#malwareloader#C2infrastructure#unsignedexecutable#BulgariaISP#Let'sEncryptcertificateIOCf1 · i8 · d0 · u2MITRE14RegionsUSIndustriesRetail
C&CMembersAug 27, 2026, 06:30 (UTC+9)2006 MyDoom Worm Resurfaces Tagged as Lazarus Espionage Tool
A file that has been circulating since the summer of 2006 just resurfaced inside a threat feed carrying a severity score of 82, a confidence score of 85, and an attribution line naming Lazarus Group — the North Korea-aligned operation with roughly twenty tracked aliases. The artefact behind that label is not a bespoke implant.
#LazarusGroup#MyDoom#agentwdcr#Tofseebotnet#JA3fingerprint#sandboxevasion#threatintelaggregation#IncapsulaCDNActorsLazarus Group · Hastati GroupIOCf35 · i7 · d6 · u0
FILEMembersAug 25, 2026, 22:44 (UTC+9)Fake KMS Activator's Broken Signature Feeds a DynDNS Downloader Chain
The file at the center of this case doesn't try to hide what it claims to be. It presents itself as KMSoffline, a real, widely pirated Windows-activation utility, and ships inside folder paths named "activador office," "KMSoffline v2.3.5 RU EN," and "KMS Tools Portable 2022" — the exact packaging a user would expect from a torrented activation bundle.
#APT27#KMSoffline#code-signingabuse#PowerShelldownloader#DynDNSbeaconing#Thailandtransportationsector#disposabledomaininfrastructure#sandboxevasionActorsAPT27 · TEMP.HippoIOCf20 · i1 · d1 · u4MITRE53RegionsTHIndustriesTransportation
APTMembersAug 25, 2026, 22:29 (UTC+9)Fake Flash Installer Hides PlugX Loader With Timer-Based Sandbox Checks
A dropper calling itself install_flash_player.bin does something a real Adobe installer never does: it reads the CPU timer directly to work out whether it is being watched, checks for an attached debugger, and then simply waits — sometimes for long stretches — before it does anything else. Only after that stall completes does the Nullsoft-packaged installer (c56ac01b…) begin dropping its real payload.
#MustangPanda#PlugX#Korplug#CobaltStrike#sandboxevasion#NSISinstaller#Switzerland#supportservicessectorActorsMustang Panda · HoneyMyteIOCf3 · i0 · d2 · u81MITRE20RegionsCHIndustriesSupport Services
APTMembersAug 25, 2026, 14:37 (UTC+9)Four Chinese Shell Firms, One DigiCert Chain, One Hidden RAT
Twenty Chinese-language "PC optimizer" and wallpaper-app binaries in this catalog carry code-signing certificates from four different corporate entities — 成都奇鲁科技有限公司, 北京创想界科技有限公司, 成都盈畅时代文化传播有限公司, and 成都赤侠信息科技有限公司 — and every single one of those certificates chains to the identical issuing authority, "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1." That is not four vendors independently buying trust from the same certificate authority; the detection spread inside each cohort argues…
#codesigningabuse#certificaterotation#Ludashi#PolarWind#PubNubRAT#ChinaMobileAS56047#PUAadware#DigiCerttrustchainActorsFIN6 · Skeleton SpiderIOCf36 · i4 · d1 · u5MITRE28
FILEMembersAug 24, 2026, 22:33 (UTC+9)Five-Year-Old Emotet Macro Downloader Resurfaces in 2026 Tracking Window
A Word document that first surfaced on VirusTotal in October 2020 is still doing exactly what it was built to do: open itself, drop a second file, and run it. The sample — internally named Attachment-5598.doc, a naming pattern consistent with an email-lure delivery method [T1566.001] though no delivery URL or mail header sits in this record to confirm that path — carries the tags "auto open," "creates OLE objects," "contains office macros," and "runs a file it drops to disk." That is not a…
#Emotet#TA542#macrodownloader#PowerShelldownloader#Let'sEncryptcertificates#phishingdocument#educationsector#governmentsectorActorsEmotet Group · TA542IOCf4 · i1 · d2 · u0RegionsRO · USIndustriesEducation & Research · Government
FILEMembersAug 24, 2026, 14:46 (UTC+9)Severity-100 Espionage Alert Unravels Into Two Pirated Activators
A threat-feed record carrying top severity and an attribution to Gamaredon Group turns out, once the underlying files are pulled apart, to rest on nothing more exotic than two pirated Windows activation tools — one wrapped in a code-signing certificate whose trust chain dead-ends at an unrecognized root, the other an unsigned console build tied to a well-documented KMS emulator kit.
#GamaredonGroup#AutoKMS/KMSAuto#code-signingabuse#UPXpacking#anti-analysistechniques#threat-feedattribution#piratedsoftware#RatiborusKMSemulatorActorsGamaredon Group · CTIGIOCf3 · i0 · d0 · u0MITRE17IndustriesGovernment
FILEMembersAug 24, 2026, 06:37 (UTC+9)Fake Invoice Lure Ships Same Downloader in PowerShell and JavaScript
A purchase-order-themed archive built to impersonate a signed PDF invoice — PO_400269712_Signed_Copy.pdf.txz — has turned up alongside a matching downloader kit that ships the same payload twice: once as a PowerShell script and once as JavaScript, both carrying the identical internal name sleestak_payload_1.bin, both exactly 64KB, and both first observed on the same day, 2026-08-12, with zero antivirus detections on either.
#TA505#Hive0065#rockloader#PowerShelldownloader#JavaScriptdownloader#manufacturingsectorphishing#SouthAfricahostinginfrastructure#purchaseorderlureActorsTA505 · Hive0065IOCf7 · i1 · d1 · u2RegionsDE · IN · IT · THIndustriesManufacturing
APTMembersAug 23, 2026, 14:27 (UTC+9)One Static Token Ties Four Rotating DarkHotel C2 Domains Together
An unsigned 2.4MB Windows executable masquerading as an Adobe updater (catalogued as 672c82c1…d26b65ef, and referred to here as the Catch.exe downloader after its internal name) carries a full anti-analysis stack — virtualization and sandbox checks [T1497, T1497.002, T1497.003], debugger evasion [T1622], and code injection into another process's window memory [T1055.011] — before it ever reaches out to command infrastructure.
#DarkHotel#dynamicDNS#C2infrastructure#downloadermalware#anti-analysistechniques#Japantelecomtargeting#codesigningevasion#APT-C-06ActorsDarkHotel · Fallout TeamIOCf1 · i0 · d1 · u19MITRE10RegionsJPIndustriesTelecommunications
APTMembersAug 22, 2026, 22:37 (UTC+9)Same-Second Certificate Reuse Exposes a Templated Provisioning Habit
A self-signed TLS certificate carrying serial number "1" was issued at 2025-09-03 05:55:01 — and only that exact second — on two domains that have nothing else in common on paper: bijibali.com, registered 2023-08-26, and inspiringgemsshop.com, registered 2026-02-11, roughly two and a half years apart. Both certificates share an identical thumbprint and the same placeholder issuer and subject line, "localhost." That is not a coincidence of timing; a certificate minted at one instant cannot…
#SaltySpider#Salityworm#XMRigcryptomining#certificatereuse#self-signedTLS#ProserviceLLCGeorgia#GIFmasquerade#USBautorunActorsSalty Spider · KuKuIOCf18 · i2 · d6 · u31MITRE15RegionsUSIndustriesRetail
FILEMembersAug 22, 2026, 14:52 (UTC+9)A Five-Minute Certificate, a Decade-Old Encryptor, One Shared Record
A domain flagged for phishing and fraud, atlanticinsulationservices.co.uk, was issued a TLS certificate on August 10, 2026 that expired five minutes after it was cut — valid from 11:17:47 to 11:22:47 UTC. That is not the certificate of a working website; it reads like automated infrastructure standing itself up, existing, and disappearing before an analyst could even resolve it in a browser.
#Rtm#Cerber#CryptoWall#ransomware#TLScertificateabuse#Let'sEncrypt#phishinginfrastructure#retailsectorActorsRtmIOCf1 · i6 · d24 · u6MITRE22RegionsUSIndustriesRetail
APTMembersAug 22, 2026, 14:30 (UTC+9)Signed 'PC Cleaner' DLLs Flagged as PubNubRAT by Sandbox Engine
A system-optimizer bundle marketed under the WinOptimize brand carries two DLLs that a dedicated malware sandbox names as a remote-access trojan called "PubNubRAT" — even though both files are digitally signed and roughly two-thirds of static antivirus engines wave them through as ordinary adware. The privacy.dll component (82c06ae2…f0928) triggers a malicious verdict from the C2AE sandbox, which classifies it outright as a RAT and names PubNubRAT as the payload family; a second DLL from the…
#PubNubRAT#WinOptimize#Ludashiadware#code-signingabuse#ChinaMobileAS56047#sandboxevasion#TA428/ThunderCats#PUA-to-RATpivotActorsTA428 · ThunderCatsIOCf17 · i7 · d2 · u13MITRE24
APTMembersAug 21, 2026, 22:58 (UTC+9)Three Unrelated Trojans Hit in 48 Hours, One Fake Mail Server Behind Them
Between August 10 and August 11, 2026, three completely unrelated pieces of commodity malware surfaced in rapid succession — a JavaScript downloader carrying an Agent Tesla/Etecer label, a RAR-packaged ModiLoader dropper, and a heavily obfuscated JavaScript file tagged Luainj — none of them sharing an import hash, a code signer, or even a threat family name with the others.
#TA505#AgentTesla#ModiLoader#Luainj#trimnt.com#phishinglure#commoditymalware#C2infrastructureActorsTA505 · Hive0065IOCf5 · i1 · d1 · u0RegionsAU · CH · DE · ESIndustriesBusiness Associations · Chemicals · Education & Research
C&CMembersAug 20, 2026, 22:46 (UTC+9)A Certificate for Every Stage: How DustSquad Weaponized Three Trust Systems
Two adware installers signed under a code-signing certificate that was later revoked. A VPN-branded credential stealer signed under a Microsoft-verified chain whose leaf certificate was valid for exactly three days. A pair of command-and-control nodes on two different continents, each wearing a TLS certificate cloned to look like Akamai or Alibaba Cloud.
#DustSquad#APT-C-34#NomadicOctopus#PureLogStealer#code-signingcertificateabuse#TLScertificatecloning#Akamaispoofing#adwarebundlersActorsDustSquad · APTC34IOCf3 · i8 · d7 · u0IndustriesNon-Profit
C&CMembersAug 20, 2026, 06:42 (UTC+9)Shared TLS Certificate Ties Two China Telecom ASNs to One CDN Edge
The most interesting fact in this catalog isn't a file — it's a TLS certificate. Two IP addresses sitting on different China Telecom autonomous systems, 113.96.132.210 (AS4134, Chinanet) and a newly catalogued 119.147.118.106 (AS134763, CHINANET Guangdong province network), terminate the exact same certificate: serial b234dba9d0c0f44f93cd5fdc51fcfa4, issued by DigiCert Basic OV G2 TLS CN RSA4096 SHA256 2022 CA1, subject default.chinanetcenter.com.
#ShanghaiOrientalWebcasting#WanNengWBInput#Shanghai2345MobileTechnology#ChinaNetCenterCDN#code-signingabuse#adware#sandboxevasion#ChinaTelecominfrastructureActorsGroup123 · Venus 121IOCf16 · i4 · d0 · u0MITRE28
APTMembersAug 19, 2026, 14:40 (UTC+9)Lazarus-Tagged Feed's Only Real Evidence Is a MyDoom-Era Worm
A Windows binary classified as worm.mydoom/emailworm (fdeacb79…) — flagged by 66 of 76 engines and carrying the popular names "mydoom," "emailworm," and "amfu" — is the only file in this record that comes with any forensic detail at all. Of 33 catalogued file hashes tied to the package, 32 are bare values: no type, no size, no detection count, nothing.
#LazarusGroup#MyDoom#emailworm#malwareattribution#threatintelligencefeeds#CDNinfrastructure#falseattribution#dataqualityActorsLazarus Group · Hastati GroupIOCf33 · i10 · d11 · u0RegionsDE
FILEMembersAug 19, 2026, 07:10 (UTC+9)Salat Stealer Domains Share TLS Cert Cadence Despite 2-Year Gap
The most concrete signal in this update to the Snowglobe-linked campaign isn't a new payload capability — it's a provisioning pattern. Two command-and-control domains, sa1atik.cn and websalat.top, were issued matching Google Trust Services "WE1" wildcard certificates within an 18-day window this summer, despite the domains themselves being registered nearly two years apart.
#Snowglobe#SalatStealer#Vidar#Babar#wildcardTLScertificate#Cloudflareinfrastructure#UPXpacking#credentialtheftActorsSnowglobe · Animal FarmIOCf1 · i2 · d2 · u2MITRE10RegionsCN · DE
C&CMembersAug 19, 2026, 06:51 (UTC+9)Signed 2345HomePage Adware Installer Splits AV Detection in Two
A validly signed homepage-hijacking installer from Shanghai 2345 Mobile Technology Co., Ltd. is drawing detections from 31 of 77 antivirus engines, yet neither of the two sandboxes that detonated the file called it malicious. That split — a firm static-engine consensus sitting on top of a clean dynamic verdict — is the most concrete new finding to surface in this update to a Chinese command-and-control cluster carrying a phorpiex family tag and a financial-gain motivation.
#phorpiex#2345MobileTechnology#code-signingabuse#adware/PUA#ChinaTelecom#certificatereuse#C2infrastructure#detectionevasionIOCf4 · i25 · d0 · u0MITRE20RegionsCNIndustriesWholesale
APTMembersAug 19, 2026, 06:34 (UTC+9)One EV Certificate Signs Four Files, Fools Every Sandbox
Four separate binaries — a loader, an updater, a secondary installer, and an MSI payload — all carry the identical Sectigo EV code-signing chain issued to "ORYON TECH LIMITED," and that shared, currently valid certificate is functioning as an active evasion layer rather than a simple trust marker. Static antivirus engines are not fooled: 24 to 44 of roughly 75 to 76 engines flag each file as malicious.
#ORYONTECHLIMITED#EVcode-signingabuse#adwareinstallerchain#microleaves/legionPUPfamily#crackedsoftwarelure#sandboxevasion#domaininfrastructurereuse#pay-per-installActorsPatchwork · ChinastratsIOCf21 · i0 · d6 · u14MITRE49RegionsIN
FILEMembersAug 18, 2026, 14:51 (UTC+9)Cracked SQLi Dumper Tool Doubles as BitRAT Delivery Vehicle
A pirated copy of a well-known penetration-testing utility is being used as bait to plant a commodity remote-access trojan on victim machines, according to indicators CTX Team has reviewed. Two Win32 executables in this cluster present themselves as a "cracked" release of SQLi Dumper v8.5, a SQL-injection scanning tool popular with penetration testers and opportunistic attackers alike, while sharing the same packing signature and a matching set of anti-analysis checks.
#BitRAT#SQLiDumper#BlueBottle#crackedsoftwarelure#Italyfoodandbeveragesector#commodityRAT#self-signedTLScertificate#anti-analysistechniquesActorsBlueBottle · Opera1erIOCf4 · i1 · d0 · u1MITRE23RegionsITIndustriesFood & Beverages
C&CMembersAug 18, 2026, 14:28 (UTC+9)Three VPN-Branded Signing Identities Share One C2 Certificate
A revoked EV certificate from a company called WEILAI NETWORK TECHNOLOGY CO., LIMITED is still riding inside binaries that call themselves WireVPN. A separate, still-valid DigiCert chain issued to INNOVATIVE CONNECTING PTE. LIMITED backs a VPNMaster installer that sandboxes clean despite carrying a trojan label. And a validly signed Bright Data Ltd proxy-SDK component — the kind of software that legitimately resells residential IP addresses — comes back from a sandbox pass as a…
#WireVPN#VPNMaster#BrightData#PBotstealer#codesigningabuse#C2infrastructure#BytedanceASN#PUAmalwareActorsAPT15 · ROYALAPTIOCf12 · i8 · d4 · u0MITRE14IndustriesFood & Beverages
C&CMembersAug 17, 2026, 22:47 (UTC+9)Shared TLS Certificate Serial Links Three Unrelated Chinese ISPs
Three IP addresses sitting on three separate Chinese internet providers — China TieTong Telecommunications (AS24138), China Mobile (AS56046), and a small Jinhua, Zhejiang Province carrier operating out of AS136190 — all terminate inbound TLS connections behind a certificate issued to a domain that appears nowhere else in this indicator set: a wildcard for *.certfallback.com.
#Kimsuky#Cactusransomware#Guloader#China-basedadware#code-signingabuse#certificatetransparency#PUAdistribution#T1553.002ActorsCactus · Cactus Ransomware GroupIOCf8 · i3 · d1 · u3MITRE10
APTMembersAug 17, 2026, 22:29 (UTC+9)Same Evasion Trick, Same Compiler Run, Tie Five Files Together
Three files in this cluster carry three different VirusTotal threat labels — a clipboard-hijacking banker, a generic dropper, and a DLL flagged for lateral spread — yet all three share the identical pair of behavioural tags: a check for whether a debugger is attached, and a routine that stalls for long periods before doing anything else. That repetition, sitting underneath payloads that otherwise look unrelated, is the more interesting story here than any single malware family.
#APT28#ClipBanker#PowerLoader#sandboxevasion#anti-debugging#CloudFlareOriginCertificate#AS214351#commoditycrimewareActorsAPT28 · StrontiumIOCf54 · i3 · d4 · u4MITRE66RegionsJO · NL · RO · SA
C&CMembersAug 17, 2026, 14:31 (UTC+9)Seven Alibaba IPs in Four Countries Share One TLS Certificate
Seven IP addresses split across the United States, Singapore, the Philippines and Hong Kong now answer HTTPS probes with the identical TLS certificate — a wildcard for *.certfallback.com, serial 6696262f452fcf46b79266a8, issued by GlobalSign GCC R46 OV TLS CA 2025 and valid from July 30, 2026 through February 14, 2027. That is the strongest new signal in a fresh sweep of an already-tracked proxyware-and-VPN-trojan campaign, one that in this pass added 27 domains and 12 IP addresses to the…
#proxyware#WireVPNtrojan#AlibabaCloudinfrastructure#Let'sEncryptabuse#TLScertificatereuse#BrightDataSDKabuse#C2infrastructure#PBotstealerActorsCactus · Cactus Ransomware GroupIOCf87 · i18 · d55 · u17MITRE21
FILEMembersAug 16, 2026, 23:04 (UTC+9)Signed Nmap Ncat Build Disguised as Windows Shell File
Eight files pulled into a single record span two decades of Windows malware, but the one that earns the headline is neither the biggest ransomware name in the batch nor the newest. It is a disguised build of Nmap's own Ncat utility (88119be028596ae376318a37d8baa146d7b2f7a97ae3acac4a73db3abeaea866), carrying a fully valid signing chain from "Insecure.Com LLC; DigiCert EV Code Signing CA (SHA2); DigiCert" — the same certificate authority chain that legitimately signs Nmap's own releases — yet…
#Ncatmasquerading#DigiCertEVcertificateabuse#Zerologonexploit#Contiransomware#Petyaransomware#LockBitransomware#TeslaCrypt#anti-sandboxtechniquesActorsLockbit Gang · DragonForceIOCf9 · i0 · d0 · u0MITRE7
C&CMembersAug 16, 2026, 22:50 (UTC+9)A Bright Data Certificate Keeps Signing Off on Worse and Worse Verdicts
A commercial proxy-network SDK's own code-signing certificate is what is holding together five different builds of a Windows binary called net_updater.exe — and the security industry's read on those builds has drifted, release over release, from potentially-unwanted software toward hacktool and adware categorization while an internal sandbox verdict flags the payload outright as a credential-stealing tool.
#BrightData#DigiCertcode-signingabuse#WireVPN#WEILAINETWORKTECHNOLOGY#revokedEVcertificate#PBotstealer#AlibabaCloudAS24429#residentialproxynetworkActorsCactus · Cactus Ransomware GroupIOCf44 · i20 · d45 · u8MITRE9
APTMembersAug 16, 2026, 22:28 (UTC+9)Shared Self-Signed TLS Cert Links Bytedance, Zenlayer IPs to VPN Trojans
Four IP addresses that share nothing else in common are running the identical self-signed TLS certificate — two sitting inside Bytedance's US-registered network block, two inside Zenlayer's Philippines allocation on the other side of the Pacific. The certificate carries serial number 1acf3e37b37910d932ea64e6bb27615d6484c07d, with both issuer and subject fields recorded simply as "NONE," and it is valid from March 12, 2024 clear through March 10, 2034 — a ten-year span that is itself unusual for…
#UAC-0063#TAG-110#WireVPN#PBotstealer#BrightDataimpersonation#self-signedcertificate#code-signingabuse#VPNPUAActorsUAC-0063 · TAG-110IOCf36 · i4 · d1 · u0MITRE21
FILEMembersAug 16, 2026, 14:57 (UTC+9)WHQL-Signed Vulnerable Driver Hides in Unsigned Stealer Bundle
A twelve-file submission batch built around commodity stealers and loaders carries one outlier that changes its risk profile entirely: a 34-kilobyte driver called ProcessMonitorDriver, signed through a legitimate Microsoft Windows Hardware Compatibility Publisher chain, that trips Elastic Security's `Windows_VulnDriver_ProcessMonitorDriver` detection rule — the community's marker for a WHQL-blessed driver that is also abusable to kill security tooling.
#BYOVD#vulnerabledriver#Amadey#StealC#Lumma#ClipBanker#PowerLoader#crimewaredistributionIOCf12 · i2 · d0 · u3MITRE40RegionsAL · DE · ECIndustriesCommercial Services
APTMembersAug 16, 2026, 14:29 (UTC+9)Fake VPN Installers Keep Shipping Under Revoked Signing Certificates
Two trojanized VPN and proxy installer families have kept circulating for months after the code-signing certificates behind them were marked revoked or no longer time-valid — a pattern that turns a routine trust-chain failure into an operational feature rather than a bug. One cluster, branded WireVPN, rides a GlobalSign EV certificate issued to WEILAI NETWORK TECHNOLOGY CO., LIMITED; the other, a fake VPN suite calling itself VPNMaster, rides a single DigiCert certificate issued to INNOVATIVE…
#WireVPN#VPNMaster#codesigningabuse#WEILAINETWORKTECHNOLOGY#INNOVATIVECONNECTINGPTE#PEGTECHINC#sandboxevasion#trojanizedVPNinstallersActorsAPT15 · ROYALAPTIOCf17 · i3 · d8 · u2MITRE8IndustriesFood & Beverages
FILEMembersAug 16, 2026, 06:51 (UTC+9)Three Domains, Three Registrars, One Identical 89-Day Cert Span
Three domains registered through three unrelated registrars — smileplz.com through Bluehost Inc., veonetwork.com through Cosmotown with Cloudflare nameservers, voxdream.com through Dynadot Inc. with Bunny.net nameservers — were each issued a Let's Encrypt certificate carrying an identical 89-day validity span, all inside a 33-day issuance window running from 2026-07-07 to 2026-08-09.
#Emotet#TA542#MummySpider#Let'sEncryptcertificateabuse#autodiscoverphishing#domaininfrastructureclustering#webmailimpersonation#macrodownloaderActorsEmotet Group · TA542IOCf4 · i0 · d3 · u6RegionsNGIndustriesManufacturing