APTMembersAug 2, 2026, 05:31 (UTC+9)Expired Certificates Keep Signing Trojanized VPN Installers
The most durable piece of tradecraft in this campaign isn't a novel loader or a clever injection technique — it's a pair of Authenticode certificates that have been technically invalid for months and are still being used to sign new builds. Two code-signing identities, WEILAI NETWORK TECHNOLOGY CO., LIMITED (chained through GlobalSign GCC R45 EV CodeSigning CA 2020) and INNOVATIVE CONNECTING PTE.
#code-signingabuse#certificatechainmanipulation#VPNtrojan#WEILAINETWORKTECHNOLOGY#INNOVATIVECONNECTING#Philippinetelecominfrastructure#TLScertificatereuse#supply-chaincompromiseActorsUAC-0063 · TAG-110IOCf74 · i13 · d13 · u3MITRE22IndustriesTechnology
APTMembersAug 1, 2026, 21:36 (UTC+9)Adware Operator Re-Signs Same Stale Build Across Two CAs
A twelve-file Authenticode cohort tied to a Windows browser product called "OneBrowser" shows something unusual for a piece of adware: the operator kept re-signing the same eight-month-old executable under a fresh certificate every time the previous one lapsed. The pattern surfaces in a batch of files carrying the identical certificate serial 0E F9 0B 20 6A 1B 07 82 E0 D0 FD 33 88 24 EC 42, issued under a GoGetSSL G4 CS RSA4096 chain rooted in DigiCert, with Authenticode signing dates falling…
#OneBrowseradware#codesigningabuse#Authenticodecertificatechurn#PUAdistribution#APT28misattribution#WorkProductInc#browserhijacking#threatinteltaggingActorsAPT28 · StrontiumIOCf18 · i0 · d2 · u44MITRE8IndustriesTelecommunications
C&CMembersAug 1, 2026, 05:38 (UTC+9)EV Certificate Lets ORYON Adware Suite Slip Past Sandbox Scans
Four differently named Windows installers — AdvancedWindowsManager.exe, Windows Updater.exe, Installer_1.0.0.exe and an MSI package called e78a2.msi — carry the exact same code-signing chain: ORYON TECH LIMITED, chaining through Sectigo Public Code Signing CA EV R36 and Sectigo Public Code Signing Root R46, all signed at the identical timestamp of 08:36 AM on 04/23/2026. That precision is the story.
#ORYONTECHLIMITED#EVcodesigningabuse#microleavesadware#sandboxevasion#pay-per-install#Cloudflareredirectordomains#QuickFetchloader#PUPdistributionIOCf20 · i1 · d5 · u15MITRE22RegionsBE · CA · DZ · GBIndustriesRetail · Technology
FILEMembersJul 31, 2026, 21:52 (UTC+9)Revoked Certs and a 1992 Timestamp: A Hacktool Kit That Won't Die
The most striking fact in this 46-file batch isn't a new malware family — it's that the tools are old, freely available, and still working. Four driver and library builds of the open-source credential-dumping tool mimikatz, including the file hashed bd177792a573f81a96c7ca9833ab7090eb8a5ea0491d1b1381efc2a5ac3f54b0, continue to carry Benjamin Delpy's original code-signing chain years after the underlying certificates were explicitly revoked by their issuers.
#mimikatz#Neshta#NirSoft#revokedcode-signingcertificates#credentialdumping#dual-usetools#LSASS#imphashActorsRoyal Ransomware · Team OneIOCf46 · i0 · d0 · u0MITRE19
APTMembersJul 31, 2026, 21:36 (UTC+9)Signed Chinese Input-Method Suite Hides IcedID-Flagged Loader
Four Windows binaries branded as 万能五笔输入法 — a legitimate Chinese Wubi input-method suite — carry an identical Extended Validation code-signing certificate, the same build timestamp, and, in two cases, a payload signature tied to the IcedID malware family, even though the sandboxes that examined them returned a clean verdict. The pairing of trusted EV signing with a static loader-kit fingerprint that slips past dynamic analysis is the sharpest signal in a nine-file, nine-IP cluster CTX Team has…
#APT27#IcedID#code-signingabuse#BYOVD#kerneldriver#CDNimpersonation#China#supplychaintrojanActorsAPT27 · TEMP.HippoIOCf9 · i9 · d0 · u0MITRE11
C&CMembersJul 31, 2026, 13:43 (UTC+9)Two 'Rival' Chinese Software Brands Share One Signing Chain
Fourteen signed Win32 binaries surfaced carrying the trusted names of two separate Chinese software vendors — a "万能五笔输入法" input-method utility from Shanghai Oriental Webcasting Co. Ltd. and a "2345看图王" photo-viewer suite from Shanghai 2345 Mobile Technology Co., Ltd. — yet both cohorts chain to the same DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 root, and a single YARA rule fires across samples signed by each.
#adware#codesigningabuse#DigiCert#China#CDNinfrastructure#YARAfingerprint#Group123/APT37misattribution#SalitymisattributionActorsGroup123 · Venus 121IOCf14 · i6 · d0 · u0MITRE28
APTMembersJul 31, 2026, 13:33 (UTC+9)Decade-Spanning Cert Cohort Exposes Cactus's Standing Provisioning Pipeline
Four domains that share nothing else — not a registrar, not a top-level domain, not even a decade of age — converge on the same certificate authority, the same 89-day validity window, and an issuance timeline packed into roughly two months. 5.tipsy.co.za has been registered since 2013; presidencycollege.in surfaced in 2024 and sat dormant until this year.
#Cactus#YR1certificatecohort#Gname.com#DigiCertG4signingchain#PBotstealer#domaingenerationalgorithm#phishingdomainreactivation#telecommunicationssectorActorsCactus · Cactus Ransomware GroupIOCf23 · i3 · d9 · u0IndustriesTelecommunications
C&CMembersJul 31, 2026, 05:44 (UTC+9)Shared Certificates, Not Payloads, Tie Five Emotet-Linked Domains
Five domains and a single Hostinger-hosted IP address form a hosting cluster that looks less like purpose-built command infrastructure and more like a disposable inventory kept in circulation for years. Across the set, two distinct certificate-issuer cohorts and a shared nameserver pairing tie the nodes together with far more precision than anything the lone piece of file telemetry in this record can offer. The strongest signal here isn't a payload — it's the paperwork.
#Emotet#TA542#C2infrastructure#Let'sEncryptcertificates#domainreuse#Hostinger#educationsector#macrodownloaderActorsEmotet Group · TA542IOCf3 · i1 · d5 · u2RegionsUSIndustriesEducation & Research
APTMembersJul 31, 2026, 05:34 (UTC+9)A Revoked 2014 Certificate Still Signs the Same Adware Family
Four binaries tied to a Windows "PC optimization" installer chain — an EXE, its setup-extraction temp copy, and two helper DLLs — all carry the identical code-signing leaf certificate issued to "PC Utilities Software Limited," serial 00 CF 20 ED FB 9E 9D 56 F4 29 A4 4E 79 C3 46 58 05. That certificate expired in mid-2015 and its chain is now uniformly flagged as either time-invalid or explicitly revoked, yet the signature block is still stamped across every member of the set.
#code-signingcertificateabuse#OptimizerPro#SpeedingUpMyPC#adware/PUP#typosquatting#Snowglobe#Babar#AnimalFarmActorsSnowglobe · Animal FarmIOCf5 · i0 · d3 · u3MITRE44RegionsDE
FILEMembersJul 30, 2026, 13:44 (UTC+9)Four Shell Companies, One DigiCert Root: China Adware's Cert-Hopping Scheme
Fifteen Windows installers branded as GPU tuners, file-recycling tools and browser guards share a single, less advertised trait: whichever shell company's name appears on the digital signature, the trust chain underneath always resolves to the same DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 root. Over roughly a year and a half, four distinct Chinese signing identities — 成都奇鲁科技有限公司, 天津中思明达科技有限公司, 天津立方星球文化传媒有限公司 and 天津星聚时代科技有限公司 — have taken turns wearing that same trusted…
#code-signingabuse#certificaterotation#adware#PUPdistribution#ChinaTelecominfrastructure#DigiCert#domainfronting#supplychaintrustIOCf15 · i4 · d6 · u6MITRE12IndustriesTelecommunications
APTMembersJul 30, 2026, 13:33 (UTC+9)Two Chengdu Shell Certificates Keep an Adware Pipeline Signed for Eight Months
Twelve Win32 binaries pulled from a single indicator set trace back to just two corporate code-signing identities — both registered in Chengdu, both chained to a valid DigiCert Trusted G4 root — and both still actively signing new builds of the same PC-optimizer adware lineage as of June 2026. Rather than a single malicious drop, what emerges is a release pipeline: eight files across two named signer cohorts, installed under at least seven different consumer utility brand names, moving through…
#Ludashiadware#Chinad#code-signingcertificateabuse#Chengdu#DigiCert#PUAdistribution#masquerading#TLScertificatereuseActorsFIN6 · Skeleton SpiderIOCf23 · i7 · d0 · u1MITRE11IndustriesWholesale
C&CMembersJul 30, 2026, 05:42 (UTC+9)One Reused Certificate Signs 20 Files in Wubi Input Adware Suite
Twenty separate executables and DLLs packaged as components of "万能五笔输入法" — the Universal Wubi Input Method, a Chinese-language input tool — all carry the identical Authenticode signature from "Shanghai Oriental Webcasting Co. Ltd.," chained through DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, with the exact same certificate serial number (0B 03 D3 41 0E 57 67 8D F3 FC A1 3A 38 44 3E 84) stamped across every file.
#adware.softcnapp#code-signingabuse#Wubiinputmethod#DigiCertcertificatereuse#ChinanetCDNinfrastructure#PUAbundler#sandboxevasion#misattributedmalwarefamilyIOCf39 · i9 · d0 · u0MITRE10
APTMembersJul 29, 2026, 14:14 (UTC+9)7-Zip Wrapper Hides Decade-Old KMS Activation Cracker
Four Windows hacktools submitted to detection engines between 2016 and 2019 all trace back to the same cracking-tool lineage — kmsauto, autokms, kmsactivator, hackkms — the commodity ecosystem that has quietly sustained pirated Windows and Office activation for the better part of a decade. The most newsworthy fact in this cluster isn't who built it.
#kmsauto#autokms#kmsactivator#hackkms#masquerading#anti-sandboxevasion#Ratiborus#piratedsoftwareActorsAPT27 · TEMP.HippoIOCf4 · i0 · d0 · u0MITRE16IndustriesAgriculture · Commercial Services · Education & Research
C&CMembersJul 29, 2026, 13:43 (UTC+9)Fake Bright Data Signature Cloaks PBot Stealer in Update Lure
A Bright Data Ltd code-signing certificate — issued through DigiCert's Trusted G4 chain and still inside its 2025~2027 validity window — is authenticating a binary that a sandbox flags outright as the PBot stealer. The file, shipped internally as net_updater.exe, drops into install paths named "DriverHub" and "Bright VPN" [T1036.005], borrowing the visual language of a legitimate residential-proxy SDK to get past the trust checks that a valid signature is supposed to guarantee [T1553.002].
#PBotstealer#code-signingabuse#BrightData#transportationsector#C2infrastructure#PUAmasquerade#.NETpacker#DigiCertcertificateIOCf49 · i4 · d10 · u0MITRE6IndustriesTransportation
APTMembersJul 29, 2026, 13:35 (UTC+9)Nine-Megabyte SFX Archive Bundles Five Crimeware Families Under Lazarus Label
A 9.8MB self-extracting 7-Zip archive named 7zS.sfx.exe sits at the center of a file set nominally filed under the Lazarus Group label — but the malware riding inside it has nothing to do with bespoke espionage tooling. The archive, submitted alongside a matching overlay-carrying binary called setup_install.exe on 2022-06-05, carries seven named YARA hits, including Windows_API_Function, INDICATOR_EXE_Packed_ASPack, MALWARE_Win_DLInjector03, INDICATOR_EXE_Packed_VMProtect, AutoIT_Compiled, and…
#LazarusGroup#RedlineStealer#SmokeLoader#Socelars#Fabookie#SFXarchivedelivery#commoditycrimeware#credentialtheftActorsLazarus Group · Hastati GroupIOCf20 · i1 · d10 · u10MITRE8RegionsBR
APTMembersJul 29, 2026, 05:36 (UTC+9)Packing, Not Espionage, Explains 2017 'Barium' Adware Cluster
Nine files in this indicator set carry an identical F-PROT packer signature and land at 0/60 to 5/72 on VirusTotal — yet five unpacked DLLs bearing the exact same filenames score 38/77 to 55/77 against the same engine pool. That gap is the actual story here, not a novel exploit or a freshly built implant: it is packing [T1027], cleanly isolated as the mechanism doing the evasion work, while the underlying code stays identical.
#Fireball#Elexadware#PassCV#Barium#packingevasion#CloudFrontabuse#masquerading#commodityadwareActorsBarium · Wicked SpiderIOCf34 · i0 · d8 · u0MITRE44RegionsRO
APTMembersJul 28, 2026, 21:35 (UTC+9)KMS Crack Tool's Twin Binaries Hide Defender-Killer, Konni YARA Hits
Two Windows binaries branded as a routine Microsoft-activation "crack" — one compiled for 32-bit systems, one for 64-bit — share an identical structural hash, reuse the exact same code-signing certificate, and both carry a built-in routine to switch off Windows Defender. That alone would be a tidy defense-evasion case study.
#GamaredonGroup#Konni#WinDivert#code-signingabuse#WindowsDefenderevasion#KMScracktools#UPXpacking#anti-sandboxtechniquesActorsGamaredon Group · CTIGIOCf4 · i0 · d3 · u0MITRE36RegionsAR · BR · CI · COIndustriesConstruction · Consulting · Government
C&CMembersJul 28, 2026, 13:43 (UTC+9)One Chinese Signing Cert Underwrites Nine Adware Payloads
A single Chinese code-signing identity has quietly underwritten an entire adware production line. Nine distinct Windows binaries — a mix of EXEs and DLLs distributed under two different "utility" brand names — all carry the identical certificate chain: 沧州句号网络科技有限公司, chained through GlobalSign GCC R45 CodeSigning CA 2020, GlobalSign Code Signing Root R45, and GlobalSign Root CA - R3.
#code-signingabuse#adwarebundler#GlobalSigncertificate#ChinaUnicomhosting#masqueradingT1036.005#sandboxevasion#PUA-as-a-service#SaltySpiderattributionActorsSalty Spider · KuKuIOCf11 · i4 · d3 · u1MITRE11
APTMembersJul 28, 2026, 13:34 (UTC+9)Broken 'Not Time Valid' Certificates Still Signing VPN Trojans
Two unrelated commercial code-signing chains — one issued to WEILAI NETWORK TECHNOLOGY CO., LIMITED through GlobalSign's EV pipeline, the other to INNOVATIVE CONNECTING PTE. LIMITED through DigiCert — are each producing a small, active cluster of VPN- and proxy-branded trojans whose leaf certificates carry the identical defect: "This certificate or one of the certificates in the certificate chain is not time valid." Neither cluster has stopped signing because of it.
#code-signingabuse#WireVPN#VPNMaster#BrightData#PBotstealer#proxyware#certificatemisuse#TLSinfrastructureActorsCactus · Cactus Ransomware GroupIOCf48 · i16 · d36 · u8MITRE18
FILEPublicJul 28, 2026, 05:47 (UTC+9)Shared Imphash Links Pirated Keygen Trojan to Signed 2026 Installer
A single import-table hash — f34d5f2d4577ed6d9ceec516c1f5a744 — is the thread connecting two very different-looking files: a widely pirated 2024 keygen trojan detected by 45 of 75 engines on VirusTotal, and a pair of 2026 binaries carrying a valid, unexpired code-signing certificate from a company called YAMICSOFT SOLUTIONS LIMITED.
#imphashpivoting#code-signingabuse#AgentTesla#piratedsoftwarelure#YAMICSOFTSOLUTIONSLIMITED#TA505#detectionevasion#commoditymalwareActorsTA505 · Hive0065IOCf52 · i0 · d0 · u0MITRE10RegionsAT · AU · BE · BOIndustriesTechnology
C&CMembersJul 28, 2026, 05:37 (UTC+9)Fake uTorrent Installer Uses Malformed Signature to Hide Decade-Old Adware
A Windows installer branded as uTorrent build 331 carries an Authenticode signature that fails validation outright — VirusTotal's own signing verdict states plainly that "the digital signature of the object is malformed," pointing analysts to the decade-old Microsoft security bulletin MS13-098 that documented exactly this class of forgeable signature block.
#DealPly#InstallCore#uTorrent#adware#codesigningabuse#pay-per-install#downloadredirector#AzionCDNIOCf8 · i2 · d3 · u2MITRE34RegionsBRIndustriesSupport Services
C&CMembersJul 27, 2026, 05:36 (UTC+9)UnionPay-Named TLS Certificate Found Reused Across Three Chinese ISPs
A single TLS certificate presenting the subject line `*.unionpayintl.com is now live on three IP addresses spread across three separate Chinese autonomous systems — 61.160.230.232 on AS140293 (CHINATELECOM Jiangsu province Changzhou 5G network), 58.216.102.31 on AS134769 (ChinaNet Jiangsu Changzhou Liyang IDC network), and 218.92.141.107 on AS4134 (Chinanet).
#Ludashi#unwantedx#adware#codesigningcertificateabuse#TLScertificatereuse#PUAbundling#ChineseISPs#DigiCertActorsFIN6 · Skeleton SpiderIOCf29 · i5 · d3 · u2MITRE38IndustriesEducation & Research · Wholesale
C&CMembersJul 26, 2026, 21:42 (UTC+9)Bright Data's Own Code-Signing Cert Fronts PBot Stealer
A binary carrying Bright Data Ltd's genuine DigiCert-issued code-signing certificate — valid, unrevoked, chained straight to DigiCert Trusted Root G4 — installs itself under program paths named "Bright VPN" and "DriverHub" as net_updater32.exe. A sandbox verdict names what's actually running behind that trusted signature: PBot, classified as a credential-and-data-theft stealer. The certificate is real. The vendor is real. The proxy SDK it claims to be is real.
#BrightData#PBotstealer#code-signingabuse#masquerading#governmentsector#C2infrastructure#Let'sEncryptcertificates#DigiCertIOCf35 · i5 · d6 · u2MITRE8IndustriesGovernment
APTMembersJul 26, 2026, 21:34 (UTC+9)15-Year-Old Sality Virus Still Delivering Monero Miners Today
A file-infector that first appeared on antivirus radars in July 2010 is still being submitted for scanning in 2025 — and in the same indicator set, two unrelated cryptomining binaries are dressed up as core Windows processes, one as svcd.exe/vcuia.exe, the other as RuntimeBroker.exe. Nothing about the infrastructure behind this cohort is sophisticated: a single self-signed certificate labeled "localhost," minted in 2011 and still valid until 2038, is the only thread tying a Georgian IP to a…
#Sality#SaltySpider#XMRig#Moneromining#file-infectorworm#Tofsee#retailsector#processmasqueradingActorsSalty Spider · KuKuIOCf26 · i2 · d2 · u11MITRE57RegionsUSIndustriesRetail
C&CMembersJul 26, 2026, 13:43 (UTC+9)Matching 89-Day Certificates Link Two 'Unrelated' Crack Sites
Two lure domains that look, on the surface, like they belong to entirely different corners of the pirated-software economy — a game-mod hub called modedapk.net and an Adobe-crack site called adobephotoshopcrack.com — are provisioning their TLS certificates on an identical clock. modedapk.net's certificate, issued by Let's Encrypt under issuer YE1, runs from 2026-07-12 to 2026-10-10. adobephotoshopcrack.com's certificate, issued under YR1, runs from 2026-06-11 to 2026-09-09.
#LummaStealer#XMRig#AsyncRAT#crack-sitemalware#Let'sEncryptcertificateabuse#Startupfolderpersistence#offsh.nlinfrastructure#commoditycrimewareIOCf13 · i2 · d2 · u11MITRE32RegionsCN
APTMembersJul 26, 2026, 13:35 (UTC+9)Recycled Certificates Tie Russian Hosts to a Loader-to-Miner Chain
Two pairs of IP addresses, sitting on two unrelated Russian-registered autonomous systems, are presenting identical TLS certificate serial numbers — a detail that has nothing to do with coincidence and everything to do with shared infrastructure. On AS29182, operated by JSC IOT out of Moscow, addresses 62.109.31.142 and 37.230.117.113 both serve certificate serial 7b670437a77c69583d393d4c, issued by GlobalSign GCC R6 AlphaSSL CA 2025 for the wildcard subject *.imageban.ru — a legitimate-looking…
#VoidArachne#SilverFox#certificatereuse#MSILloader#cryptomining#CobaltStrike#vulnerabledriver#RussianhostinginfrastructureActorsVoid Arachne · Silver FoxIOCf26 · i5 · d3 · u4MITRE15RegionsBR
C&CMembersJul 26, 2026, 05:34 (UTC+9)A Single Chinese Certificate Has Signed Adware for 13 Straight Months
Thirteen Windows binaries submitted between April 2025 and May 2026 — spanning executables and DLLs with names like privacy_clean.exe, cclean.exe, multi_wechat.exe, and NetSentinelTray.exe — all carry the identical code-signing certificate issued to 成都奇鲁科技有限公司 (Chengdu Qilu Technology Co.), serial 0D 07 8E 70 EA EE 48 FF EB 95 76 BD D4 00 BE 98, chained through DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 up to DigiCert Trusted Root G4.
#Ludashi/ChinADadware#code-signingabuse#PUAdistribution#ChengduQiluTechnology#TLScertificaterecycling#ChinanetJiangsu#masqueradingT1036.005#threatfeedmisattributionActorsAPT29 · MinidionisIOCf26 · i6 · d0 · u0MITRE24IndustriesEducation & Research · Wholesale
APTMembersJul 25, 2026, 13:38 (UTC+9)Same Signer, Split Verdict: EarnApp Installer Hides a Stealer
Three Windows installers branded as Bright Data's EarnApp bandwidth-sharing SDK carry an identical Bright Data Ltd/DigiCert code-signing chain — the same signer, the same certificate-authority path, the same product story. Yet one of the three, a build called net_updater32.exe, is classified by sandbox analysis as a STEALER named PBot, while its two signer-siblings return clean verdicts.
#APT28misattribution#EarnApp#BrightData#codesigningabuse#PBotstealer#DGAdomains#PUPdistribution#TLScertificatepivotingActorsAPT28 · StrontiumIOCf10 · i10 · d38 · u8MITRE7IndustriesCommercial Services
FILEMembersJul 25, 2026, 05:49 (UTC+9)Fake 'Intel Driver' Malware Checks for Sandboxes Before Striking
Before it does anything else, the binary looks around. A Win32 executable calling itself Inteldriver.exe — a name chosen to blend into a driver folder or a running-process list rather than draw attention — spends its opening moves probing the machine it has landed on for signs of a sandbox or a debugger. That single behavioural signal, carried by a file that VirusTotal shows 39 of 75 engines flagging as malicious, is the most concrete piece of tradecraft in an otherwise thin batch of 24 file…
#APT28#FancyBear#DonutLoader#sandboxevasion#processinjection#telecomsector#malwareloader#threatattributionActorsAPT28 · StrontiumIOCf24 · i1 · d0 · u1MITRE13RegionsCA · ESIndustriesTelecommunications
APTMembersJul 25, 2026, 05:36 (UTC+9)Fourth Shell-Company Signer Joins Chinese Adware Cert-Farming Pipeline
A Chinese code-signing operation that CTX Team has tracked as a persistent Ludashi/PolarWind adware-bundler pipeline has picked up a fourth disposable signing identity — and, alongside it, a packing technique the earlier builds never used. The signer, 武汉诺沃网络科技有限公司, obtained its certificate from DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 in January 2026 and used it to sign a 4,533 KB binary, instantview_service.exe, that first appeared with a 5/75 detection ratio — by far the…
#Ludashi#PolarWindadware#certificatefarming#DigiCertcodesigning#PubNubRAT#TA428misattribution#PUAbundler#China-basedinfrastructureActorsTA428 · ThunderCatsIOCf18 · i1 · d6 · u9IndustriesTelecommunications
FILEMembersJul 24, 2026, 21:34 (UTC+9)One Domain, a Disposable Cert, and an APT29 Label That Doesn't Fit
A domain called holzbrenzii.com went live on 2025-06-23 through registrar PDR Ltd. d/b/a PublicDomainRegistry.com, sat quietly on a single hosting record for over a year, then picked up a wildcard TLS certificate with an unusually tight 89-day validity window. That's the entirety of the corroborated evidence in a threat-feed entry that also carries an APT29 attribution and a Remcos malware tag — labels that, on closer inspection, are bolted onto a record with no file, no payload, and no…
#APT29#Remcos#phishinginfrastructure#disposabledomains#TLScertificateabuse#WHOISobfuscation#threatintelligenceattribution#commoditymalwareActorsAPT29 · MinidionisIOCf1 · i0 · d1 · u0MITRE28RegionsAU · BA · BG · ECIndustriesBusiness Associations · Commercial Services · Engineering
FILEMembersJul 24, 2026, 13:47 (UTC+9)2008-Signed Kernel Driver Still Evades Most Antivirus Engines
A driver signed nearly two decades ago — its entire certificate chain now flagged as time-invalid — has resurfaced in a small but sharply detailed record that puts vulnerable-driver tradecraft, not infrastructure, at the center of the story. The file is WinRing0.sys, a hardware-monitoring kernel driver, and it carries a signature chain minted in 2007~2008 that has since decayed into forensic wreckage: every intermediate certificate in the Authenticode chain, from signer Noriyuki MIYAZAKI…
#BYOVD#vulnerabledriver#WinRing0.sys#kerneldriverexploitation#Turla#AkamaiCDNinfrastructure#LOLDrivers#signedmalwarecertificateabuseActorsTurla · Iron HunterIOCf2 · i4 · d0 · u0MITRE7IndustriesEducation & Research
C&CMembersJul 24, 2026, 13:39 (UTC+9)Fake .bat File Hides Packed Loader in Sprawling EU C2 Set
A single Win32 executable dressed up as docs.log.bat sits at the center of a c2-servers record otherwise padded with 57 domains and 12 IPs across a dozen European hosting providers — and the disguise is almost the whole story. Sixty of 75 engines flag the file as malicious, yet it was submitted to detection platforms exactly once, from a single source, and carries zero sandbox telemetry to explain what it actually does once it runs.
#packedloader#T1027obfuscation#persistencemechanism#Europeanhostinginfrastructure#Let'sEncryptcertificates#C2infrastructure#falsecohesion#detectionconsensusIOCf11 · i12 · d57 · u3MITRE31RegionsUSIndustriesRetail
APTMembersJul 24, 2026, 13:32 (UTC+9)Feed Mislabels Chinese Adware Bundle as Lazarus Group Intrusion
An indicator set flowing through commercial threat feeds under a severity rating of 100 and an 85 confidence score comes labeled, at the actor level, with one of the most storied names in offensive cyber operations: Lazarus Group. Cross-reference the actual artifacts against that label, however, and the picture that emerges is not an espionage intrusion set at all.
#LazarusGroupmisattribution#TheWorldadware#Qihoo360#trojan.adload#CDNinfrastructure#falsepositivethreatintel#torpig#ChinaActorsLazarus Group · Hastati GroupIOCf49 · i15 · d0 · u0RegionsCN · MY
C&CMembersJul 24, 2026, 05:40 (UTC+9)Decade-Old Dynu DDNS Pool Found Feeding Live AgentTesla C2
Eleven domains, all registered through the same free dynamic-DNS registrar, all resolving through the same nameserver block — and some of them have sat dormant since 2015. That's the picture emerging from a fresh piece of C2 infrastructure that CTX Team has been tracking since mid-June: a Dynu Systems Incorporated domain reservoir that stretches across two historical registration waves and one very recent addition, feeding a ConfuserEx-packed .NET dropper that a sandbox has tagged as…
#AgentTesla#DynudynamicDNS#C2infrastructure#ConfuserExpacker#credentialstealer#Let'sEncryptcertificatepivot#mediaandtelecomsector#domainrotationIOCf5 · i1 · d11 · u2MITRE51RegionsBD · FR · GR · HKIndustriesMedia · Telecommunications
APTMembersJul 24, 2026, 05:31 (UTC+9)HijackLoader Hides Behind Real Zalo Code-Signing Certificate
Three days before this cluster surfaced, a file calling itself Zalo.exe carried a fully valid VNG GROUP JSC code-signing certificate — the same signing identity that legitimate builds of Vietnam's dominant chat app use — and only 3 of 75 engines flagged it. CAPE Sandbox and the crowdsourced YARA rule HijackLoaderStub, firing twice on the sample, both independently identified it as HijackLoader, a loader family that has no business hiding behind a trusted Vietnamese software publisher's…
#HijackLoader#codesigningcertificateabuse#Zaloimpersonation#VNGGROUPJSC#TA551#Vietnam#FPTTelecom#certificateserialpivotActorsTA551 · ShathakIOCf6 · i2 · d2 · u9MITRE13
FILEMembersJul 23, 2026, 21:51 (UTC+9)Expired Certificate Still Trusted in Four-Named Bundler
A single Win32 binary has been submitted to detection platforms 11,721 times from 3,694 distinct sources while wearing four different disguises — packaged and distributed as a Resource Hacker installer, an XMEye VMS setup file, a KeyTweak utility, and a glogg build. The file, catalogued under the threat label `adware.bundler/cppinstaller with popular names bundler, cppinstaller, and installcore, is the kind of high-volume, low-sophistication artifact that rarely gets a deep look — until you…
#code-signingcertificateabuse#adwarebundler#sandboxevasion#installcore#Bumblebeemisattribution#Hostingerinfrastructure#Let'sEncryptabuse#falseattributionActorsPatchwork · ChinastratsIOCf3 · i3 · d3 · u3MITRE8IndustriesEnergy
C&CMembersJul 23, 2026, 21:42 (UTC+9)Fake Browser Installers Use Valid EV Certificates to Spread Adware
A pair of Windows installers now flagged by 30 or more security engines each didn't need packers, obfuscated loaders, or stolen certificates to get past baseline defenses — they used real ones, freshly issued to real, if newly registered, Chinese companies. One installer poses as "GptChrome," a knockoff AI-browser setup; the other impersonates JiSu (极速浏览器), a popular Chinese browser installer.
#EVcode-signingabuse#adwaredistribution#JiSubrowserinstaller#GptChromefakeinstaller#CDN-frontedinfrastructure#ChinanetZhejiang#anti-sandboxevasion#shellcompanycertificatesActorsAPT28 · StrontiumIOCf2 · i7 · d2 · u1MITRE13
APTMembersJul 23, 2026, 21:33 (UTC+9)Old Emotet Macro Pairs With Barely-Flagged New Infrastructure
A Word document flagged trojan.w97m/emotet doesn't just drop a payload — it stalls first. Sandbox tags on the sample read like a checklist for frustrating automated analysis: auto-open, detect-debug-environment, long-sleeps, calls-wmi. Put together, they describe a VBA macro that fires the instant the document opens [T1204.002], then deliberately pauses and probes its environment for signs of virtualization or debugging before doing anything else [T1497].
#Emotet#TA542#macrodownloader#sandboxevasion#phishing#educationsector#Let'sEncryptcertificates#PowerShelldownloaderActorsEmotet Group · TA542IOCf3 · i1 · d2 · u5RegionsUSIndustriesEducation & Research
FILEMembersJul 23, 2026, 13:47 (UTC+9)Fifth IP Joins Huawei-Spoofing Cert Cluster in Guangdong
The file side of this campaign has gone quiet — zero new signed installers have surfaced since the last snapshot, while fifteen previously tracked hashes have dropped out of view entirely. But the network layer tells a different story. A newly observed address, 119.147.128.39, has joined a cluster of four IPs already sharing an identical TLS certificate — serial 5ace246430093aa3ef595686 — bringing the cohort to five distinct hosts spread across two /21 netblocks in Guangdong province, all…
#SaltySpider#sality#adware.softcnapp#TLScertificateimpersonation#HuaweiAppGalleryspoofing#CHINANETGuangdong#codesigningabuse#HappyPictureinstallerActorsSalty Spider · KuKuIOCf10 · i8 · d0 · u0MITRE6
C&CMembersJul 23, 2026, 13:34 (UTC+9)Certificate-Recycling Pipeline Links 12 Domains Behind Weak Detection
Twelve domains, four IP addresses, and a single executable make up this cluster — and on the surface, they look unrelated: a decade-old Vietnamese-language domain, a pair of gambling lure pages using Indonesian togel slang, a 2016-registered relic now sitting on sinkhole nameservers, and a 221MB EV-signed installer called "Rave.exe." What ties them together isn't a shared malware family or a dedicated bulletproof host.
#APT15#Ke3chang#certificateabuse#C2infrastructure#domaingenerationalgorithm#lawfirms#gamblinglures#Let'sEncryptActorsAPT15 · ROYALAPTIOCf1 · i4 · d12 · u0MITRE6IndustriesLegal Services
C&CMembersJul 23, 2026, 05:46 (UTC+9)Six Rotating Certificates Keep Chinese Adware Cluster Trusted
A batch of 19 Win32 binaries flagged under a "c2-servers" threat record shows something far more mundane, and arguably more instructive, than the record's own label suggests. Twelve of the files share one code-signing identity — 成都奇鲁科技有限公司, chained under DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 — used continuously across builds first seen from May 2025 through April 2026.
#Ludashi#ChinaAD#PUAadware#code-signingcertificaterotation#ChinaUnicom#FIN6misattribution#CDNinfrastructure#threatintellabelingActorsFIN6 · Skeleton SpiderIOCf36 · i13 · d2 · u0MITRE19
APTMembersJul 23, 2026, 05:36 (UTC+9)Snowglobe APT Hides C2 Behind Thai Medical Vendor's Subdomains
Five subdomains of a single Thai domain — meddup, files, donorcheck, labonline and api-notify, all trailing .bmscloud.in.th — resolve to one IP address, 171.103.78.30, and two of them, labonline and api-notify, present the literal same TLS certificate serial number, 514d02f527f0d4cf66ff4701d9104a1f622, for a *.bmscloud.in.th wildcard.
#Snowglobe#AnimalFarm#Sig20#APTespionage#healthcaresectortargeting#TLScertificateabuse#domainmasquerading#ThailandinfrastructureActorsSnowglobe · Animal FarmIOCf7 · i4 · d11 · u1MITRE15IndustriesGovernment · Healthcare · Telecommunications
FILEMembersJul 21, 2026, 13:40 (UTC+9)Bright Data's EarnApp Signing Chain Split to Smuggle a Stealer
A Windows installer that presents itself as EarnApp — Bright Data Ltd's consumer bandwidth-sharing client — is circulating in at least three variants that all carry a valid Bright Data Ltd code-signing chain anchored to DigiCert. Two of those variants read clean or undetected. The third, a component named net_updater32.exe dropped inside the same Program Files\EarnApp path, is classified by the C2AE sandbox as a stealer, with the malware family tag PBot attached at 50% confidence.
#EarnApp#BrightDataLtd#codesigningabuse#PBotstealer#APT28attributionmismatch#supply-chainmasquerade#PUPdomainC2#certificateinfrastructureActorsAPT28 · StrontiumIOCf92 · i9 · d44 · u6MITRE4IndustriesCommercial Services
C&CMembersJul 21, 2026, 05:47 (UTC+9)Proxyware Cluster Swaps Infrastructure, Keeps Same Signed Binaries
Eighteen new domains and eight new IPs have joined a proxyware-and-stealer cluster CTX Team has been tracking since mid-July, while nineteen domains and twenty-one IPs from the prior snapshot have gone dark. That is a substantial share of the observable hosting layer turning over in a matter of days. What has not moved at all is the delivery pipeline underneath it: the same two Authenticode-signed binary families — one carrying a Bright Data Ltd.
#proxyware#stealermalware#BrightDataLtd#WEILAINETWORKTECHNOLOGY#codesigningabuse#PBot#C2infrastructure#DGAdomainsActorsCactus · Cactus Ransomware GroupIOCf114 · i22 · d52 · u13MITRE19
APTMembersJul 21, 2026, 05:34 (UTC+9)Decade-Old Self-Signed Certificate Ties FIN7 Infrastructure Together
A self-signed TLS certificate stamped "localhost.localdomain" and valid for exactly one year beginning in October 2015 is still doing operational work more than a decade later. Three domains — diamonddollsfitness.com, mastering-the-art-of.com, and lf7blogpro.com — present the byte-identical certificate, serial cfddb89f9d1426ad, and all three resolve to the same IP address, 184.105.192.2.
#FIN7#certificatereuse#beaconinginfrastructure#phishinglure#Cloudflareabuse#command-and-control#sinkholeddomains#invoicemalwareActorsFIN7 · Gold NiagaraIOCf2 · i0 · d4 · u8MITRE21
FILEMembersJul 20, 2026, 21:46 (UTC+9)vjw0rm Worm's Full Dropper Chain Resurfaces Five Years Later
Nine file indicators tied to the vjw0rm worm family let CTX Team reconstruct, almost stage by stage, how this decade-old commodity malware still moves through a target environment in 2026: a booby-trapped Windows shortcut hands off to a batch script, which drops an AutoIT-compiled payload dressed up as a core Windows process, which then calls home to a free dynamic-DNS domain.
#vjw0rm#TA2541#OperationLayover#AutoITmalware#dynamicDNSabuse#processmasquerading#manufacturingsectorThailand#LNKdropperActorsTA2541 · Operation LayoverIOCf9 · i0 · d0 · u2RegionsTHIndustriesManufacturing
C&CMembersJul 20, 2026, 21:36 (UTC+9)Three Shell Companies, One Trusted Root: Adware's Signing Shuffle
Twenty binaries tied to a single Chinese-language adware and PUA toolset carry a valid "Signed" verdict from VirusTotal — but the certificates behind that verdict rotate through at least three different corporate identities, all validating through the same trusted chain: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1. 成都星汉云科科技有限公司 signs ten files. 北京创想界科技有限公司 signs seven more. 成都赤侠信息科技有限公司 signs a final two.
#adware#codesigningabuse#Ludashi#PolarWind#PCAccelerate#ChinaUnicom#Patchworkmisattribution#bundlermalwareActorsPatchwork · ChinastratsIOCf34 · i6 · d5 · u27MITRE17
FILEPublicJul 20, 2026, 05:35 (UTC+9)Expired Certificate Still Signs Circulating UltraSurf-Branded Binary
A Win32 binary distributed under the UltraSurf and Ultrareach brand names — tools historically marketed as anti-censorship proxy utilities — carries a code-signing certificate from Ultrareach Internet Corp. that expired more than two years ago, yet the file was still circulating in submission traffic as recently as July 7, 2026.
#UltraSurf#Ultrareach#expiredcode-signingcertificate#UPXpacking#sandboxevasion#Toregress#HurricaneElectricAS6939#Glupteba2ActorsMuddyWater · TEMP.ZagrosIOCf1 · i4 · d0 · u0IndustriesWholesale
C&CMembersJul 19, 2026, 21:40 (UTC+9)Signed Adware Cluster Hides Confirmed RAT Behind Chengdu Shell Certs
A 26-file cluster of Windows utility installers — branded as DllFix, WinClean, ZXStoreX and PicSnapX — is being distributed under two rotating Chinese corporate code-signing identities that both terminate in the identical certificate authority chain, and at least one binary from that signed cohort has triggered a sandbox-confirmed remote-access-trojan verdict rather than the run-of-the-mill adware payload the rest of the set carries.
#Ludashiadware#PolarWind#PubNubRAT#codesigningcertificateabuse#CDNbrandimpersonation#ChinaUnicomAS4837#Chengdushellcompanies#PatchworkmisattributionActorsPatchwork · ChinastratsIOCf26 · i16 · d15 · u16