APTMembersAug 15, 2026, 22:30 (UTC+9)Chinese Adware Chain Hides RAT Behind UnionPay-Spoofing TLS Certs
Ten of eleven IP addresses tied to a Chinese adware delivery cluster CTX Team has been mapping sit inside a single autonomous system — AS4837, CHINA UNICOM China169 Backbone — and seven of those ten present an identical .unionpayintl.com wildcard TLS certificate that has nothing to do with UnionPay International's actual payment infrastructure.
#ChinaUnicomAS4837#PubNubRAT#codesigningabuse#TLScertificateimpersonation#UnionPayspoofing#adwaresupplychain#LuDaShiPolarWind#FIN6misattributionActorsFIN6 · Skeleton SpiderIOCf45 · i11 · d3 · u0MITRE14
FILEMembersAug 15, 2026, 14:31 (UTC+9)Fake Activation Tool Hides From Sandboxes, Not Scanners
A 744-kilobyte PowerShell script circulating under the name of a familiar piracy tool — MAS_AIO.cmd, the all-in-one installer bundled with the open-source Microsoft Activation Scripts project — carries a detection profile that should worry defenders more than its modest flagging count suggests. Fourteen of 76 engines call the file malicious and VirusTotal classifies it hacktool.presenoker/abapplication, yet the lone sandbox that ran it came back clean, zero malicious verdicts out of one.
#PowerShelldropper#MicrosoftActivationScriptslure#sandboxevasion#TA505#rockloader#wildcardcertificate#piracy-toolmalware#Let'sEncryptabuseActorsTA505 · Hive0065IOCf1 · i1 · d2 · u1MITRE16
C&CMembersAug 15, 2026, 07:41 (UTC+9)Cheat-Tool Loader Feeds a Stolen-Credential Log Shop via Dual-ASN C2
A command-and-control backend built around the domain diamotrix.world is running the same check-in panel — the path /diamo/post.php — across two IP addresses sitting on entirely unrelated hosting providers, one in France and one in Germany. Feeding that backend is a PEiD-packed .NET loader distributed under the branding "B3RAP Leecher v2.exe," a tool marketed into gaming and combo-list communities rather than built for a targeted intrusion.
#diamotrix.world#B3RAPLeecher#KidnapperCloud#credentialharvesting#stealerlogs#C2infrastructure#MSILloader#cryptocurrencywallettheftIOCf47 · i2 · d1 · u7MITRE61RegionsUS
FILEMembersAug 15, 2026, 07:01 (UTC+9)One Chinese Signing Identity Ties Together Sixteen 'Different' Malware Families
The most durable artifact in a fresh batch of sixteen file indicators tagged to TA428 (alias ThunderCats) isn't a backdoor at all — it's a code-signing certificate. Thirteen of the sixteen files carry an identical signer chain issued to 成都赤侠信息科技有限公司 and rooted in DigiCert Trusted Root G4 via DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, spanning binaries as small as 95 KB and as large as 55.9 MB. Detection ratios across that cohort run from 2 out of 76 engines to 32 out of 75.
#TA428#ThunderCats#code-signingcertificate#DigiCert#Chineseadwareoperator#malwarenamingtaxonomy#PUP#sandboxevasionActorsTA428 · ThunderCatsIOCf54 · i0 · d0 · u0MITRE22RegionsCA · CN · THIndustriesTelecommunications · Utilities
C&CMembersAug 15, 2026, 06:52 (UTC+9)Old Phorpiex Botnet Still Evades via Bare-IP Hosting, P2P C2
Six sequentially-numbered URLs — /twizt/1 through /twizt/6 — sit directly on a bare IP address, 185.215.113.84, with nothing resembling a domain name anywhere in front of them. That is unusual only in how rarely operators still do it: a Windows executable flagged by 60 of 76 engines as trojan.phorpiex/kadrbot was pulled straight from that dotted-quad host, tripping two purpose-built intrusion-detection signatures — "ET INFO Executable Download from dotted-quad Host" and "ET HUNTING SUSPICIOUS…
#Phorpiex#Kadrbot#Trikbotnet#bare-IPhosting#peer-to-peerC2#sandboxevasion#Indiagovernmentsector#commoditymalwareIOCf4 · i6 · d0 · u7MITRE31RegionsINIndustriesGovernment
APTMembersAug 15, 2026, 06:31 (UTC+9)Pirated CCleaner Crack Stalls, Then Digs In For Persistence
A Windows executable disguised as an activation crack for pirated software spends its first minutes on a victim machine doing nothing that looks like an attack at all — reading the CPU timer, checking installed memory, polling the BIOS and USB bus, watching for a debugger. Only once those checks come back clean does it write itself somewhere that survives a reboot.
#AgentTesla#Negasteal#crackedsoftwarelure#anti-sandboxevasion#Cloudflareinfrastructure#pay-per-installloader#Patchwork#APT28ActorsPatchwork · ChinastratsIOCf6 · i0 · d4 · u15MITRE29RegionsAD · AU · BG · BSIndustriesConstruction · Education & Research · Government
C&CMembersAug 14, 2026, 22:29 (UTC+9)Sandbox-Aware Data Collector Beacons Through Rented VPN Relay Network
A 2.6-kilobyte JavaScript file quietly filed as executors/200.js — self-identified in threat classification as a "datacollector" (eb9e1d58c0…) — has been observed deliberately stalling before it runs, a behaviour flagged in its own analysis tags as staying dormant "instead of acting immediately." Once it does wake up, it beacons out to a rotating pool of IP addresses that reads less like a fixed command post and more like a rental fleet: ten of fourteen IPs tied to this activity carry an…
#datacollectormalware#sandboxevasion#VPNinfrastructure#C2beaconing#M247Europe#HostUniversalPtyLtd#JavaScriptmalware#infrastructurediversificationIOCf1 · i14 · d0 · u24MITRE11IndustriesTechnology
APTMembersAug 14, 2026, 14:45 (UTC+9)Fake Payment-Receipt RAR Hides JS Downloader for AgentTesla
A Spanish-language RAR attachment titled "Detalles de los recibos de pago" — payment receipt details — carries a single embedded JavaScript file that a sandbox platform ultimately traces to AgentTesla-class credential theft. What makes this cluster worth a second look is not the lure itself, which is unremarkable, but the mismatch in how security engines treat its two stages: the RAR container is flagged by 13 of 76 engines, while the JavaScript it unpacks into is flagged by 31 of 76 — nearly…
#AgentTesla#ModiLoader#SLoad#TA505#Hive0065#phishing#credentialtheft#NamecheapinfrastructureActorsTA505 · Hive0065IOCf3 · i1 · d1 · u1RegionsAT · CY · DE · EGIndustriesAutomotive · Retail · Support Services
FILEMembersAug 13, 2026, 22:37 (UTC+9)Fake Anti-Cheat Installer Hides Beacon Behind China Unicom, CDN Certs
The most concrete artefact in this record is a single file: an installer named ACE-Setup.exe, signed end-to-end under a valid DigiCert-anchored chain running from ACEVILLE PTE LTD through DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 up to DigiCert Trusted Root G4. Its product string reads "Anti-Cheat Expert," and its embedded file paths reference two specific games — Delta Force and ABInfinite — placing the binary inside the exact directory structure…
#Confucius#beaconmalware#codesigningabuse#ChinaUnicom#CDNimpersonation#anti-cheatsoftware#gamingsector#TLScertificateabuseActorsConfuciusIOCf4 · i10 · d0 · u0
C&CMembersAug 13, 2026, 06:28 (UTC+9)Seven Malware Family Labels Turn Out to Be One StealC Codebase
Eleven files sitting behind a single command-and-control cluster were flagged by vendor engines as seven different malware families — StealC v2, TinyNuke, PowerLoader, Carberp, Vidar, RedLine and a Telegram-adjacent stealer tracked as MaskGramStealer. Six independent YARA rulesets and a run of IDS signatures tell a different story: several of these "families" are the same codebase and the same command-and-control protocol, wrapped in different crypto-themed lure names and shipped through…
#StealC#TinyNuke#RedLine#Vidar#MaskGramStealer#command-and-controlinfrastructure#cryptoluremalware#AS214351IOCf11 · i4 · d1 · u11MITRE45RegionsPK · USIndustriesTechnology · Telecommunications
APTMembersAug 13, 2026, 00:05 (UTC+9)Shared Certificate Serial Ties Four Lookalike Domains to One Brazil IP
Four freshly registered domains — zelpx.garden, carogra.biz, tzpx.courses, and fightwa.biz — resolve through the identical authoritative nameserver pair ns1.dyna-ns.net and ns2.dyna-ns.net, despite having been registered across two separate windows nearly three months apart. That single fact, verifiable directly against the WHOIS and DNS records, is the strongest thread running through this indicator set, and it is considerably more solid than anything the accompanying file collection offers.
#Dynadot#Hostinger#Let'sEncryptcertificatespoofing#domainmasquerading#APT28attribution#stealerlogs#Exoduswallet#BrazilhostinginfrastructureActorsAPT28 · StrontiumIOCf32 · i1 · d4 · u4MITRE34RegionsAR · CL · CM · EEIndustriesFood & Beverages
FILEMembersAug 12, 2026, 14:41 (UTC+9)15-Year-Old Sality Worm's TLS Fingerprint Ties to Tofsee C2
A Windows binary that first surfaced in mid-2010 is still being resubmitted for scanning as recently as October 2025, and its TLS behaviour trips a crowdsourced intrusion-detection rule built for an entirely different malware family. The sample is labelled trojan.sality/badcrypt and flagged by 57 of 76 engines, placing it squarely in the Sality file-infector lineage — an old, well-understood worm chassis.
#Sality#Tofsee#JA3fingerprint#clippermalware#USBpropagation#C2infrastructure#polymorphicpacker#commoditymalwareActorsSalty Spider · KuKuIOCf13 · i2 · d5 · u4MITRE32RegionsBD
APTMembersAug 12, 2026, 06:37 (UTC+9)A 2020 Loader Stub Still Circulates in Fresh Detections Today
Twenty file indicators tied to Ramsay- and DarkHotel-labeled trojans converge on a single, unmodified compiled artifact: an import-table fingerprint of 34791a1ad0a42b816d48d1d1c182fe7d and a Rich PE header hash of d9068e3808ee41e8c6f32c9fd4e83a79, both frozen to a compile timestamp of 2020-03-04. That exact build keeps resurfacing under new detections as late as December 2025 — five years after it was compiled — wearing four different VirusTotal threat labels along the way.
#DarkHotel#Ramsaytrojan#UACMeUACbypass#reflectiveDLLinjection#imphashreuse#gamelauncherlure#SerbianresidentialIP#espionagemalwareActorsDarkHotel · Fallout TeamIOCf20 · i1 · d0 · u0MITRE11RegionsPHIndustriesTechnology
C&CMembersAug 11, 2026, 14:48 (UTC+9)Bright Data-Signed EarnApp Loader Unchanged as 66 New Domains Surround It
The malicious file cluster that CTX Team first catalogued around a Bright Data Ltd-signed EarnApp installer has not moved: the same four binaries, the same DigiCert Trusted G4 Code Signing chain, the same detection spread running from 9 of 75 engines to 24 of 76. What has moved, sharply, is everything sitting around it. This snapshot adds 66 new domains and 19 new IPs against just 9 new file hashes — an order of magnitude more growth in registration and certificate infrastructure than in…
#EarnApp#BrightData#PBotstealer#codesigningabuse#domainregistrationfraud#Let'sEncryptcertificates#residentialproxymalware#APT28attributionActorsAPT28 · StrontiumIOCf78 · i24 · d91 · u11MITRE2IndustriesCommercial Services
APTMembersAug 11, 2026, 14:28 (UTC+9)QuasarRAT Toolkit Recompiled for 13 Years Gains a Crypto Clipper
Four newly-flagged Windows binaries tied to a cluster the upstream feed labels LazyScripter share an unbroken thread: the same QuasarRAT-derived toolkit fingerprint, first compiled in 2011 and still shipping in September 2024, with a clipboard-hijacking wallet-swap module now bolted onto the frame. Rather than a fresh malware family, what CTX Team's review of the sample set shows is a chassis — Quasar's remote-access core, wrapped in RDP-wrapper persistence and Vermin/xRAT keylogging code —…
#LazyScripter#QuasarRAT#VenomRAT#xRAT#VerminKeylogger#cryptocurrencyclipper#portmap.iotunneling#RDPWrapperpersistenceActorsLazyScripterIOCf9 · i1 · d1 · u2MITRE30RegionsPT
APTMembersAug 11, 2026, 07:30 (UTC+9)One Certificate, Five Servers, Two ASNs: A Fallback C2 Fingerprint
Five IP addresses scattered across Indonesia, the Philippines, Vietnam, and Malaysia are all answering HTTPS requests with a certificate naming the same subject: *.certfallback.com. That alone would be a modest coincidence — shared wildcard certificates get resold and reused constantly in commodity hosting. What turns it into a diagnostic fingerprint is that four of those five hosts — 128.1.178.192 (Indonesia), 128.1.45.175 (Vietnam), 43.109.107.28 (Malaysia) and 155.102.33.22 (Malaysia) — are…
#certfallback.com#PureLogStealer#DustSquad#APT-C-34#offercorebundler#EVcodesigningabuse#SoutheastAsiainfrastructure#GlobalSigncertificatereuseActorsDustSquad · APTC34IOCf3 · i5 · d1 · u1MITRE5IndustriesTechnology
C&CMembersAug 11, 2026, 06:38 (UTC+9)One DigiCert Chain, Three Chengdu Shells, 12 Signed Adware Installers
A rotating cast of Chengdu-registered shell companies has spent the past eighteen months feeding disposable code-signing identities into a single DigiCert trust chain, and the resulting installers are still walking past static AV and sandbox alike. Twelve Windows binaries examined here — installer stubs for C-drive cleaners, ad blockers, and "system optimizer" tools bundled under LuDaShi/SuperApp-style directory trees — all chain up through the same DigiCert Trusted G4 Code Signing RSA4096…
#code-signingabuse#DigiCertcertificate#Chineseadware#LudashiPUA#shellcompanysigners#sandboxevasion#APT29misattribution#ChinaTelecomJiangsuinfrastructureActorsAPT29 · MinidionisIOCf23 · i2 · d0 · u0MITRE26IndustriesWholesale
C&CMembersAug 10, 2026, 22:37 (UTC+9)Lazarus Label Rides on Thin Evidence: Old Domains, Shared Certs
A cluster of internet infrastructure carrying a Lazarus Group label arrived this month with almost nothing behind it: 29 file hashes with no signer, no size, no threat classification attached to any of them, and fifteen network indicators that sit at 0 or 1 detection out of 91 security engines, with zero community votes either way.
#LazarusGroup#mimail#certificatereissuance#CDNfronting#Incapsula#Namecheapdomains#threatattribution#commandandcontrolinfrastructureActorsLazarus Group · Hastati GroupIOCf29 · i7 · d8 · u0RegionsDE
FILEMembersAug 10, 2026, 06:52 (UTC+9)Mining-Themed Certificate Emerges as Prometei Files Go Quiet
The freshest artefact in this collection window is not a payload — it is a single IP address, 31.56.209.100, sitting on AS 209373 and carrying a Let's Encrypt certificate whose subject line reads corvusxmr.live. That domain, and its companion mine.corvusxmr.live and www.corvusxmr.live, describe themselves in the certificate's own subject-alternative-name field as Monero-mining infrastructure.
#OilRig#APT34#Prometeibotnet#Monerocryptomining#Let'sEncryptcertificate#telecommunicationssector#malwareattribution#command-and-controlinfrastructureActorsOilRig · APT34IOCf2 · i1 · d0 · u0MITRE8IndustriesTelecommunications
APTMembersAug 10, 2026, 06:35 (UTC+9)A Decade-Old Adware Builder Wearing an Espionage Label
Four JavaScript files sitting inside a record tagged "apts" and attributed to APT39 turn out, on inspection of their own build fingerprints, to be the same payload repackaged under at least six different Chrome extension identities — a mass-cloning technique straight out of the Crossrider adware playbook, not a nation-state implant.
#APT39#Chafer#Crossrider#adware#browserextensions#Chromeextensions#PUA#threatintelligenceattributionActorsAPT39 · ChaferIOCf20 · i0 · d1 · u3RegionsGB
APTMembersAug 9, 2026, 20:14 (UTC+9)Same Softonic Cert Signs a RustDesk Impostor and a Near-Clean Twin
A Win32 installer signed with the identical Softonic International SA code-signing certificate turns up in two forms with wildly different fortunes: one build draws 31 of 76 antivirus detections and ships under aliases that impersonate RustDesk and Lenovo Vantage, while its cert-mate scores a near-clean 4 of 76 and drew almost no submissions at all.
#RustDeskimpersonation#LenovoVantageimpersonation#Softoniccertificateabuse#code-signingcertificatereuse#adwarebundling#sandboxevasion#CloudFrontinfrastructure#SaltySpiderActorsSalty Spider · KuKuIOCf2 · i0 · d1 · u2MITRE21RegionsAR · BO · BR · CLIndustriesAgriculture · Construction · Education & Research
FILEMembersAug 9, 2026, 11:05 (UTC+9)One Certificate Signs Launcher, App, and Repair Tool in 3 Minutes
A single code-signing certificate — issued to SPRING (SG) PTE. LTD through the DigiCert Trusted G4 Code Signing chain — covers three functionally distinct Windows binaries: a launcher, an installed application, and a self-repair utility, all signed between 06:04 and 06:07 AM on August 2, 2026. That three-minute spread across three separate files is the most concrete fact in this record, and it reads less like three developers reaching for the same certificate and more like one build pipeline…
#codesigningcertificateabuse#DigiCert#Zenlayer#TLScertificatereuse#APT28misattribution#IcedID#maliciousfilehashes#governmentsectortargetingActorsAPT28 · StrontiumIOCf5 · i6 · d0 · u0MITRE38IndustriesGovernment
C&CMembersAug 9, 2026, 10:54 (UTC+9)Chinese Adware Ring Reuses Certs to Spoof UnionPay and Huawei
Every piece of command infrastructure in this record — all seven IP addresses tied to the cluster — sits on a single Chinese carrier backbone, AS4837, CHINA UNICOM China169 Backbone. That alone would be a footnote for China-facing infrastructure. What makes it a story is what those IPs present to anyone who connects to them: two separate, duplicated TLS certificates, each spoofing a different trusted brand.
#code-signingabuse#TLScertificatespoofing#UnionPayimpersonation#HuaweiAppGalleryspoofing#ChinaUnicomAS4837#ludashiadware#anti-analysistechniques#PUAdistributionIOCf28 · i7 · d0 · u0MITRE14
APTMembersAug 9, 2026, 10:45 (UTC+9)Old RemCom Hacktool Masks a Clean-Scoring WinSW Impostor
A remote-command-execution hacktool compiled on 2012-08-09 is still being resubmitted under randomized filenames as recently as July 2026, flagged by 46 of 75 engines and matched by three named YARA rules — and sitting in the same indicator set is a 16.8-megabyte binary posing as the open-source WinSW Windows Service Wrapper that clears every one of 77 antivirus engines outright.
#RemCom#WinSWimpersonation#lateralmovement#bulletproofhosting#Proton66#Flyservers#njRAT#CactusransomwaregroupActorsCactus · Cactus Ransomware GroupIOCf2 · i13 · d0 · u0MITRE20
FILEMembersAug 9, 2026, 01:56 (UTC+9)Fake Root CA Signs Pirated KMS Activation Tools
Four Windows activation cracks distributed under the KMSpico and AutoKMS names carry an identical code-signing chain — but the authority that issued it isn't Sectigo, DigiCert, or any of the trust roots Windows ships with. It's "@ByELDI Certificate Authority," a self-manufactured root the operators built themselves, and every certificate under it fails Windows' own validation check.
#KMSpico#AutoKMS#codesigningabuse#self-signedcertificate#piratedsoftware#dynamicDNS#anti-analysistechniques#PatchworkActorsPatchwork · ChinastratsIOCf14 · i1 · d1 · u1MITRE51
APTMembersAug 9, 2026, 01:46 (UTC+9)A Disposable AWS Front and a CDN Wildcard Are the Real Story, Not the File
Two pieces of infrastructure — a beacon domain delegated through Amazon's own nameservers and a CDN-fronted IP wearing someone else's wildcard certificate — carry far more evidential weight in this record than the single file attached to it. The domain, wb.sleevesbarbing.com, resolves through eight rotating A-records behind AWS Route53 delegation and serves six URLs that all follow the identical templated path /mtn/130079/<32-character-hash>.<epoch-timestamp>.000.
#AWSRoute53delegation#CDNwildcardcertificate#AdvancedIPScanner#Famatechcodesigning#Edgenextinfrastructure#telecomsectortargeting#disposableC2domain#expiredcertificatechainActorsLockbit GangIOCf1 · i1 · d1 · u6MITRE4IndustriesTelecommunications
FILEMembersAug 9, 2026, 00:27 (UTC+9)One Code-Signing Certificate Covers 14 WaveBrowser Bundleware Files
A single leaf certificate — serial 09 D7 7A 45 C1 C0 97 55 AE 3E 7A 51 53 98 3C 03, issued to "Wavesor Software (Eightpoint Technologies Ltd. SEZC)" under the DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 chain — signs all fourteen core binaries CTX Team has catalogued for a browser-and-updater bundle marketed as WaveBrowser and its companion SWUpdater service.
#codesigningcertificateabuse#bundleware#WaveBrowser#SWUpdater#PUA/adware#sandboxevasion#Authenticodetrust#misattributionActorsAPT28 · StrontiumIOCf16 · i1 · d0 · u0MITRE9IndustriesEducation & Research
FILEPublicAug 8, 2026, 23:59 (UTC+9)Signed Process Hacker Driver Now Anchors a Four-Stage Attack Chain
A signed kernel driver that Microsoft's own trust chain still vouches for is quietly doing double duty as a privilege-escalation primitive, and it is not travelling alone. The newest indicators added to a long-tracked Process Hacker 2 file set — both the x86 and x64 builds of kprocesshacker.sys (0f97f6d53fff…, 70211a3f9037…) — fire the LOLDrivers-catalogued rule PUA_VULN_Driver_Wj_Kprocesshacker_7021 despite carrying a fully valid DigiCert code-signing chain.
#ProcessHacker#BYOVD#kprocesshacker.sys#LOLDrivers#NirSoft#credentialtheft#signedmalware#kernelprivilegeescalationActorsRoyal Ransomware · Team OneIOCf35 · i0 · d0 · u0IndustriesGovernment
APTMembersAug 8, 2026, 23:04 (UTC+9)Windows Defender-Killer Tool Folded Into XRed RAT Dropper
A commodity tool built to switch off Windows Defender with one click has turned up inside the build of a remote-access-trojan dropper — not dropped alongside it, but sharing the same crowdsourced YARA signature. The standalone hacktool, tracked publicly as DefenderControl and carried in this set as 1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326, and a Synaptics-driver-themed dropper that sandboxing names as the XRed RAT,…
#GorgonGroup#Subaat#XRedRAT#DefenderControl#HongKongtechnologysector#dynamicDNSabuse#masqueradetechnique#espionageActorsGorgon Group · SubaatIOCf15 · i1 · d0 · u0MITRE29RegionsHKIndustriesTechnology
C&CMembersAug 8, 2026, 20:44 (UTC+9)Valid Bright Data Signature Found on EarnApp Installers Flagged as PBot Stealer
Four Windows installers branded as EarnApp — the passive-income tool that pays users to resell idle bandwidth through Bright Data's proxy network — carry a fully valid Bright Data Ltd code-signing chain from DigiCert, and two of them are independently flagged by a sandbox as the "PBot" stealer family. That combination is the story here, not because a certificate was forged or revoked, but because it wasn't.
#EarnApp#BrightData#PBotstealer#code-signingabuse#DigiCert#supply-chaintrustabuse#proxyware#bandwidth-sharingmalwareIOCf69 · i22 · d98 · u9MITRE4IndustriesCommercial Services
FILEPublicAug 8, 2026, 19:48 (UTC+9)One Trojan Sample Shows Full Evasion Playbook, No Campaign in Sight
A Win32 executable currently flagged by 61 of 76 antivirus engines packs a textbook sandbox-evasion triad — checking for an attached debugger, reading the CPU clock directly, and inspecting the CPU model string — into a single unsigned dropper that has circulated under at least four unrelated decoy filenames since 2016. What makes the sample newsworthy is not a hosting cluster or a signing certificate; there is neither.
#trojan.python/fkuk#stitchmalwarefamily#sandboxevasion#WMIdiscovery#HolyWater#StormCloud#persistencetechniques#lurefilenamesActorsHolyWater · Storm CloudIOCf1 · i0 · d0 · u0IndustriesEducation & Research
C&CMembersAug 8, 2026, 19:39 (UTC+9)Fake UnionPay TLS Certificate Ties Together 19 Chinese Adware Hosts
Nineteen IP addresses scattered across five or more distinct Chinese ISPs — China Unicom's China169 backbone, three separate China Mobile autonomous systems, and a scatter of regional China Telecom blocks — all present the identical TLS certificate when a browser connects to them. The subject line reads *.unionpayintl.com, organisation "UnionPay International Co., Ltd.," issued by DigiCert's Basic OV G2 TLS CA.
#UnionPayimpersonation#wildcardTLScertificate#Ludashi#Chinad#PolarWind#codesigningabuse#APT23#adwaredistributioninfrastructureActorsAPT23 · KeyBoyIOCf17 · i23 · d2 · u0MITRE7
APTMembersAug 8, 2026, 19:30 (UTC+9)Valid Code Signatures Mask PBot Stealer in VPN/Proxy Installers
A Windows installer branded as Bright Data's residential-proxy SDK carries a complete, unbroken DigiCert code-signing chain — and still returns a sandbox verdict naming the PBot stealer classification. Across ten files reviewed by CTX Team, three separate code-signing identities — Bright Data Ltd, WEILAI NETWORK TECHNOLOGY CO., LIMITED, and INNOVATIVE CONNECTING PTE.
#PBotstealer#code-signingabuse#proxyware#BrightData/Luminati#WireVPN#VPNMaster#DigiCert#PUAActorsEmotet Group · TA542IOCf15 · i36 · d51 · u10MITRE22
C&CMembersAug 8, 2026, 14:23 (UTC+9)One Chinese Certificate Signed Nine Months of Ludashi Adware Builds
The most durable piece of infrastructure behind a sprawling family of Chinese system-utility adware is not a server or a domain — it is a single code-signing certificate. Eight of nine binaries examined in this cluster carry an identical signer chain: 成都奇鲁科技有限公司, chained through DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 up to DigiCert's root, with certificate serial 0D 07 8E 70 EA EE 48 FF EB 95 76 BD D4 00 BE 98.
#Ludashiadware#code-signingcertificateabuse#ChinaD#UnwantedX#wildcardTLScertificate#China-basedinfrastructure#adwareC2#PUAdistributionActorsFIN6 · Skeleton SpiderIOCf9 · i2 · d4 · u3MITRE11
APTMembersAug 7, 2026, 06:05 (UTC+9)Old Macro-to-PowerShell Emotet Chain Still Fools Every Sandbox
A macro-laced Word document circulating against United States education and research targets is producing a rare thing in modern detection telemetry: unanimous agreement. All three sandboxes that processed the sample — C2AE, ReaQta-Hive, and BitDam ATP — return a "malicious" verdict, and 43 of 75 antivirus engines flag the file outright.
#Emotet#TA542#macromalware#PowerShelldownloader#educationsector#masquerading#Let'sEncryptcertificates#loader-for-hireActorsEmotet Group · TA542IOCf3 · i1 · d2 · u5RegionsUSIndustriesEducation & Research
C&CMembersAug 6, 2026, 22:12 (UTC+9)C2 Cluster Adds 9 IPs, 20 Domains — Just 5 New Files
Nine new IP addresses and twenty new domains have surfaced around a C2-server cluster CTX Team has been tracking since earlier coverage of a campaign built on trojanized VPN and proxy installers ("Two Vendor Signatures, One Stealer"). Only five new files joined the set in the same window. That lopsided ratio is itself the story: the operators are not retooling their malware, they are aggressively provisioning and rotating the network fabric that fronts it.
#C2infrastructure#trojanizedinstallers#WireVPN#BrightDataimpersonation#certificatereuse#SpacePirates#Cactus#disposableinfrastructureActorsSpace Pirates · WebwormIOCf14 · i21 · d47 · u6MITRE16
C&CMembersAug 5, 2026, 22:13 (UTC+9)Batch-Signed Adware Beats AV Detection, Fools Every Sandbox
A code-signing certificate issued to a company called Shenzhen Kaixin Kangaroo Technology Co., Ltd. was used to sign eight different executables and DLLs — all in the same eight-minute window on March 20, 2024. A separate certificate, issued this time to Shanghai Oriental Webcasting Co. Ltd., produced the same pattern two months later: seven of eight files signed within a single minute on May 29, 2024.
#code-signingcertificateabuse#adware#PUA#GoodZip#WanNengWBInput#APT27#SaltySpider#ChinaCDNinfrastructureActorsAPT27 · TEMP.HippoIOCf30 · i14 · d1 · u1MITRE24
APTMembersAug 5, 2026, 22:04 (UTC+9)Wizard Spider Kit Adds Stealer-to-Downloader Handoff, C2 Unchanged
The kit CTX Team has tracked under this cluster just picked up a matched pair of new files, and they slot together like a delivery chain missing its middle link. A stealc-tagged dropper — carried under the path %APPDATA%\crkhost.exe and flagged malicious by 55 of 76 engines — and a downloader dressed as a Windows service process, taskhostw.exe (also seen as WinUpdateHelper.exe, 46/76 detections), both first appeared within a 24-hour window in early May and both share a single YARA signature:…
#WizardSpider#Stealc#credentialtheft#vulnerabledriverabuse#hostsfiletampering#certificateimpersonation#AS214351#commandandcontrolinfrastructureActorsWizard Spider · Grim SpiderIOCf5 · i3 · d0 · u6MITRE25RegionsJOIndustriesFood & Beverages
FILEMembersAug 5, 2026, 11:49 (UTC+9)Pirated Windows Activator Bundle Hides Shared Base64 Execution Trick
A "Microsoft Activation Scripts" archive built to bypass Windows and Office licensing is now doubling as a delivery mechanism for base64-encoded PowerShell payloads — and the same authoring fingerprint shows up in two structurally different file types inside the same drop. Eight of nine files tied to this indicator set carry file paths referencing "MAS/Separate-Files-Version" or "MAS/All-In-One-Version-KL," all first appearing within a 48-hour window between July 4 and July 6, 2026.
#TA505#rockloader#hacktool.autokms#hacktool.kmsauto#base64PowerShellexecution#KMSactivationpiracy#WindowsOfficelicensing#.winTLDDNScallbackActorsTA505 · Hive0065IOCf10 · i1 · d0 · u0MITRE13
C&CMembersAug 5, 2026, 11:41 (UTC+9)Two Vendor Signatures, One Stealer: VPN Installers Abuse Trust Chains
Three files circulating under VPN branding this year carry a code-signing chain that VirusTotal's own signer inspection flags as broken. The signer field reads "WEILAI NETWORK TECHNOLOGY CO., LIMITED," countersigned through GlobalSign GCC R45 EV CodeSigning CA 2020, and every one of the three samples' signer-details blocks returns the same line: "This certificate or one of the certificates in the certificate chain is not time valid." That should be a hard stop for any endpoint relying on…
#code-signingabuse#PBotstealer#BrightData#WEILAINETWORKTECHNOLOGY#VPNinstallertrojan#fast-fluxhosting#Let'sEncryptabuse#SpacePiratesActorsSpace Pirates · WebwormIOCf9 · i15 · d27 · u3MITRE17
APTMembersAug 5, 2026, 05:34 (UTC+9)Fake YCleaner Hides PowerShell Fetch Loop Behind Spoofed AV Certificate
A "system cleaner" branded YCleaner wraps a multi-stage dropper chain that leans on a spoofed antivirus-vendor certificate and a single PowerShell-invoked downloader signature reused across three separate binaries — and stages its final payload inside a ZIP archive that, as of this writing, zero of 77 scanning engines flag as malicious. The domain feeding the chain, adobehelp.net, carries a nameserver record that contradicts its own WHOIS listing.
#YCleaner#PowerShelldownloader#fakesystemcleaner#BlueBottle#adobehelp.net#code-signingspoofing#encryptedarchiveevasion#MalaysiaActorsBlueBottle · Opera1erIOCf16 · i0 · d1 · u2MITRE29RegionsMY
FILEMembersAug 4, 2026, 13:47 (UTC+9)Validly Signed uTorrent Installer Hides Trojan.Offercore
An executable calling itself utorrent_installer.exe carries a fully valid four-tier code-signing chain — BitTorrent Inc, chained up through DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 to DigiCert Trusted Root G4 — and yet 18 of 76 engines still flag it as trojan.offercore/r783575. That combination is the story here: not a forged certificate, but a genuine one riding on top of a payload the security industry has learned to distrust.
#trojan.offercore#code-signingabuse#uTorrent#anti-sandboxevasion#CloudFrontinfrastructure#P2Ptrafficmimicry#adware/PUP#TLScertificatespoofingIOCf28 · i4 · d2 · u0MITRE48RegionsAD · AE · AL · AMIndustriesChemicals · Commercial Services · Construction
APTMembersAug 4, 2026, 05:33 (UTC+9)Donot Team Ties Three Domain Clusters via 89-Day Cert Cadence
Five domains, three registrars, three continents' worth of WHOIS geography, and not a single shared owner on paper — yet every one of them carries an identical 89-day Let's Encrypt certificate validity window. That convergence, surfaced across a Thai medical-software vendor's subdomain fleet, an AWS Route53-fronted delivery node registered through a Panama privacy proxy, and a decade-old Japanese domain flagged for compromise, is the strongest signal in this indicator set — stronger, in fact,…
#DonotTeam#APTC35#SectorE02#certificateprovisioning#spearphishing#healthcaretargeting#AWSRoute53abuse#domainhijackingActorsAPTC35 · Donot TeamIOCf7 · i0 · d5 · u15MITRE18IndustriesGovernment · Healthcare · Telecommunications
FILEMembersAug 3, 2026, 21:49 (UTC+9)Vietnamese ISP Netblock, Not C2 Fleet, Behind Allaple Spread
Nineteen of the twenty IP addresses populated in this record sit inside a single netblock — 14.160.0.0/11, registered to VNPT Corp under AS45899 — and every one of them returns a VirusTotal detection ratio of either 0/91 or 1/91. That is not what a dedicated command-and-control fleet usually looks like. Purpose-built C2 infrastructure tends to concentrate on a handful of dedicated hosts with at least some flagged reputation, rented specifically for the operation and often swapped out once…
#Allapleworm#VNPTCorp#AS45899#Vietnam#masqueradingT1036#SynologyNAS#trojan.allaple#consumerISPaddressspaceIOCf33 · i23 · d0 · u0MITRE25RegionsUSIndustriesRetail
APTMembersAug 3, 2026, 21:35 (UTC+9)A Builder Stub That Outlived Four Different Malware Labels
Cybercrime taxonomies love clean boundaries — XWorm here, Amadey there, a "msilheracles" trojan somewhere else. But a set of Windows binaries CTX Team has been tracking, tagged in upstream telemetry to APT28-associated activity, shows how thin those labels can be. Four samples that public detection engines classify as four unrelated families — a 2024 XWorm loader, a 2023 Amadey downloader, and two "QCoin"-branded .NET binaries dating back to December 2017 — all carry the exact same import-table…
#APT28#XWorm#Amadey#DarkKomet#XRed#imphashreuse#timestomping#masqueradingActorsAPT28 · StrontiumIOCf35 · i7 · d2 · u6MITRE100
APTMembersAug 3, 2026, 13:34 (UTC+9)Fake reCAPTCHA Lure Tied to Dedicated Host via Certificate Match
A domain calling itself verifyrecapcha.info is not, in fact, a CAPTCHA. It is a phishing front end that mimics the verification interstitial Google uses to separate humans from bots, and it has been flagged by 19 of 91 security engines — a detection band that puts it firmly in known-bad territory even before the infrastructure underneath it is examined.
#Tortilla#phishinginfrastructure#fakereCAPTCHA#TLScertificatepivot#Cloudflarefronting#resellerhosting#espionage#PDR/DirectiASNActorsTortillaIOCf0 · i4 · d2 · u1MITRE10IndustriesArts & Entertainment
C&CMembersAug 3, 2026, 05:32 (UTC+9)APT28-Tagged Cluster Shows 89-Day Cert Pattern, No Malware
Three domains with nothing else in common — different registrars, different creation dates, different Let's Encrypt intermediates — share one oddly precise trait: certificates valid for exactly 89 days. ccu.to, swisscutterastronaut.com, and each-task.com were issued certificates by three separate Let's Encrypt intermediates (R13, YR2, and YE1, respectively), yet all three validity windows run to the same 89-day span.
#APT28#FancyBear#Let'sEncryptcertificates#certificatecloning#C2infrastructure#domainregistrationfraud#espionage#TencentCDNActorsAPT28 · StrontiumIOCf0 · i5 · d7 · u0MITRE4IndustriesContainers & Packaging
APTMembersAug 2, 2026, 21:35 (UTC+9)VPN Trojan Cluster Adds 10 IPs, 6 Domains, No New Malware
The latest pass through this VPN-and-proxy-trojan operation surfaces ten additional IP addresses and six additional domains — and not a single new malicious binary. That lopsided delta is itself the story. While the signed installers that anchor this campaign have sat unchanged for months, the network layer underneath them keeps expanding, and the clearest evidence of that expansion is a single TLS certificate serial, 363a6b88ee219be351b40934, now confirmed live on four separate hosts spread…
#VPNtrojan#proxymalware#certificateabuse#WEILAINETWORKTECHNOLOGY#INNOVATIVECONNECTING#BrightData#China#PhilippinesActorsUAC-0063 · TAG-110IOCf35 · i21 · d15 · u4MITRE21IndustriesTechnology
FILEMembersAug 2, 2026, 05:49 (UTC+9)Fake Shipping Documents Deliver AgentTesla Stealer Under Five Packers
The payload doesn't look like malware when it lands in an inbox. It looks like a vessel particulars sheet — "MV TBN SHIP PARTICULARS.docx.exe," "SHIP PARTICULARS - MV OSTC01.xlsx.exe," "MV PACIFIC ENDEAVOR V2202 PARTICULARS I.docx.exe." Each of those alternate filenames belongs to the same 490KB Windows executable, a double-extension trick that hides an EXE behind a familiar Word or Excel icon — a lure built for whoever in a shipping or freight-forwarding chain is used to receiving cargo…
#AgentTesla#spear-phishing#maritimeshippinglure#double-extensionmalware#.NETobfuscation#SMTPexfiltration#APT29misattribution#commodityinfostealerActorsAPT29 · MinidionisIOCf9 · i0 · d2 · u0MITRE38
C&CMembersAug 2, 2026, 05:41 (UTC+9)Fake Baidu, Alibaba TLS Certs Mask Five-Year RAT Campaign
Ten IP addresses tied to a single threat-intelligence record show almost no malicious signal on their own — nine come back 0/91 on antivirus scanning, one scrapes a single flag at 1/91. Yet three of those IPs pair up with a twin elsewhere on the internet through an identical TLS certificate, and each pairing wildcards a domain the certificate's real owner has nothing to do with. Two Alibaba Cloud-registered addresses share one GlobalSign-issued certificate for .certfallback.com.
#XRedRAT#certificatereuse#TLSimpersonation#Baiduspoofing#AlibabaCloud#ChinaUnicom#APT28attribution#dynamicDNSC2ActorsAPT28 · StrontiumIOCf13 · i10 · d0 · u0MITRE40RegionsTW