FILEMembersJul 19, 2026, 13:46 (UTC+9)'Shipping Advice' Phishing Chain Skips Fingerprints, Leans on Disposable Hosting
A phishing wave dressed up as a "shipping advice" notice is running a tight, four-step reconnaissance-and-drop chain before it ever touches a durable piece of infrastructure. The sequence — a RAR-wrapped JavaScript dropper that stages a font-disguised payload and then queries the victim's own external IP address before reaching out to a single, disposable web host — reads less like a bespoke intrusion tool and more like a lean, repeatable delivery kit.
#TA505#RockLoader#phishing#JavaScriptdropper#Namecheapinfrastructure#shippingadvicelure#IPreconnaissance#fontmasqueradingActorsTA505 · Hive0065IOCf3 · i1 · d1 · u1RegionsBD · CA · CH · DEIndustriesEnergy · Hospitality & Leisure · Support Services
C&CMembersJul 19, 2026, 13:38 (UTC+9)Proxyware Signing Pipeline Stays Static Despite Infrastructure Churn
Forty-seven new file hashes, twenty-seven new IP addresses and twenty-eight new domains have surfaced around a proxyware-and-stealer distribution cluster CTX Team has been tracking — yet the tradecraft underneath hasn't moved an inch. The same three code-signing chains that anchored our earlier look at this operation — Bright Data Ltd, WEILAI NETWORK TECHNOLOGY CO., LIMITED, and INNOVATIVE CONNECTING PTE.
#proxyware#PBotstealer#codesigningabuse#BrightData#WEILAINETWORKTECHNOLOGY#INNOVATIVECONNECTING#certificatereuse#C2infrastructureActorsSpace Pirates · WebwormIOCf93 · i35 · d53 · u13MITRE17
FILEMembersJul 19, 2026, 05:47 (UTC+9)Reused Certificate Ties Two KMS Activators to One Build Pipeline
A pair of Windows licensing-bypass tools carrying an identical, cryptographically dead-end code-signing certificate has surfaced in a four-file cluster enriched for this feed — and the certificate is the strongest piece of evidence in the whole set. The x86 build, hashing to 50b277f770648c014924c5bf17ed94bfe149ec317a4f8b70129f3dd76e0d0a64, and its x64 counterpart, 3f2e66bbb2ed7be8655c258a2e0e43fb5bba482ae909c2c2e91865699d33b6bf, both carry a signature block naming "WZTeam" as signer, with a…
#KMSAuto++#WZTeamcertificate#codesigningabuse#WindowsDefenderevasion#UPXpacking#piracyluredomain#APT27misattribution#hacktool.kmsautoActorsAPT27 · TEMP.HippoIOCf4 · i0 · d1 · u1MITRE18IndustriesEnergy
C&CMembersJul 18, 2026, 21:36 (UTC+9)GoDaddy Certificate Mismatch Exposes Recycled Upatre C2 Infrastructure
A GoDaddy certificate issued in January 2024 for ebuyswap.co.uk carries a subject name of *.secure-secure.co.uk — a domain that has nothing to do with the site it secures. That single mismatch, paired with a second domain delegated to a dynamic-DNS-style nameserver pair, is the most concrete signal in a c2-servers cluster that otherwise leans on a downloader family old enough to have been retired twice over.
#Upatre#c2infrastructure#TLScertificatemismatch#dynamicDNS#GoDaddy#manufacturingsector#Australia#commoditymalwareIOCf4 · i1 · d2 · u7MITRE15RegionsAUIndustriesManufacturing
FILEMembersJul 18, 2026, 13:56 (UTC+9)Certificate for signindat.com Labels Itself 'OU=C2' in Plain Text
Somewhere in the build pipeline behind a single command-and-control domain, an operator generated a self-signed TLS certificate and left its organizational-unit field reading, verbatim, "C2." The domain is signindat.com, resolving to a single address, 193.26.115.45, and the certificate — serial 50fb9fc33758894e18d8b6a0cb42d5044a75078a — carries issuer and subject fields of CN=signindat.com, O=Hermes, OU=C2, with subject alternative names covering both the hostname and its IP.
#UnfadingSeaHaze#doghousepower#signindat.com#self-signedcertificate#trojan.meterpreter#espionage#Switzerland#JordanActorsUnfading Sea HazeIOCf9 · i0 · d1 · u2MITRE25RegionsCH · JOIndustriesFood & Beverages · Government · Support Services
C&CMembersJul 18, 2026, 13:46 (UTC+9)Proxyware Campaign Adds Singapore CDN Cluster, Still Resigning Same Builds
Three newly observed IP addresses in Singapore — 43.169.13.123, 43.174.132.95 and 43.174.133.38 — all sit under AS139341 (ACE) and all present the identical TLS certificate serial a9573ce73eb9e83e40cd25a3a46eef4, issued by WoTrus RSA DV SSL CA 2 for the wildcard host *.cdn.myqcloud.com. It's the freshest infrastructure fingerprint to emerge from a proxyware distribution operation CTX Team has been tracking since earlier coverage of a signer cluster that kept re-signing the same builds, in a…
#proxyware#BrightData#WEILAINETWORKTECHNOLOGY#INNOVATIVECONNECTING#SingaporeCDNinfrastructure#code-signingabuse#PUAmalware#AS139341ActorsAPT28 · StrontiumIOCf55 · i18 · d30 · u8MITRE16
APTMembersJul 18, 2026, 13:35 (UTC+9)Proxyware Family Resigned Four Times to Dodge Detection
A ninety-file cluster now under review shows a builder rebuilding and re-signing the same proxyware binary at least four times between July 2025 and March 2026, watching its own detection ratio slide from 22 out of 75 engines down to 8 out of 76 as each new build shipped. The four samples — carrying the meaningful name net_updater.exe and the internal product tag "Bright SDK" — share a single import-table hash, a4383347bad6319cb6d1cefa3c6272d8, and near-identical vhash fingerprints, yet each…
#BrightData#codesigningabuse#proxyware#PBotstealer#WireVpnPc#certificaterotation#VPNtrojan#attributionmismatchActorsCactus · Cactus Ransomware GroupIOCf89 · i14 · d36 · u8MITRE17
FILEMembersJul 17, 2026, 14:59 (UTC+9)Fireball/Elex Adware: 14 DLLs Built in a Four-Day Cycle
A cluster of fourteen unsigned Windows DLLs — plus one companion executable — compiled between January 23 and January 26, 2017 shares a builder fingerprint tight enough to read like a single production run. The modules carry deliberately mundane names: RegKey.dll, Skytech.dll, ClearLog.dll, Packet.dll, MIO.dll, Berserker.dll, Install.dll, Lancer.dll, At.dll, and a standalone WinTooll.exe. None are signed.
#Fireball#Elex#Sasquor#adware#YARArules#maliciousDLL#MSIinstaller#sinkholedC2ActorsBarium · Wicked SpiderIOCf27 · i0 · d3 · u0MITRE43RegionsBR · PK
FILEMembersJul 17, 2026, 13:37 (UTC+9)Pikabot Loader Keeps Its Slack-Mimicking C2 Disguise as Infrastructure Shrinks
Three command-and-control servers tied to a Pikabot-family loader are still answering on URL paths built to look like Slack's own Web API — /api/admin.conversations.getConversationPrefs, /api/apps.permissions.users.request, /api/admin.conversations.ekm.listOriginalConnectedChannelInfo — a naming discipline that has now held across two separate observation windows.
#Pikabot#SafePay#Contabohosting#C2infrastructure#SlackAPImimicry#loadermalware#commoditymalware#networkegressevasionActorsSafePayIOCf1 · i3 · d0 · u6MITRE13RegionsUSIndustriesRetail
APTMembersJul 17, 2026, 05:32 (UTC+9)Valid NordVPN Certificate Masks Signed Dropper, Zero AV Hits
A single Win32 executable sits at the center of this campaign, and its most interesting property is not what it does but what it is trusted to do. The file carries a fully valid GlobalSign EV code-signing chain — "nordvpn s.a.," chained through GlobalSign GCC R45 EV CodeSigning CA 2020 up to GlobalSign Root CA - R3 — with a signing date of July 13, 2026 and a product string reading "NordVPN," version 8.7.2.0. Every certificate in that chain shows a "Valid" status.
#code-signingabuse#GlobalSignEVcertificate#Proton66#NordVPNmasquerade#CommentCrew#APT1#CDNimpersonation#engineeringsectorespionageActorsComment Crew · Byzantine CandorIOCf1 · i4 · d1 · u6MITRE5IndustriesEngineering
FILEPublicJul 16, 2026, 21:47 (UTC+9)WinPEAS-Named Binary Flags Vault Credential Hooks, Splits Sandboxes
A binary distributed under the name winPEAS.exe — one of the most widely used open-source Windows privilege-escalation enumeration tools — has turned up carrying YARA hits for Windows Vault credential objects and confidential-data-store queries, alongside two sandboxes that can't agree on what it actually is. CAPE Sandbox classifies the payload as Rhadamanthys, a well-known credential-stealing malware-as-a-service family; Zenbox instead labels it "PEASS HackTool" and flags it as a…
#WinPEAS#Rhadamanthys#APT29#WindowsVault#credentialtheft#YARAdetection#FastlyCDN#privilegeescalationActorsAPT29 · MinidionisIOCf1 · i1 · d0 · u0MITRE42RegionsCHIndustriesTechnology
FILEMembersJul 16, 2026, 13:50 (UTC+9)Cert-Mill Hides Inside Chinese Adware Supply Chain
Seventeen of nineteen enriched binaries in a newly mapped cluster of Chinese PC-utility software carry a code-signing certificate issued through the identical "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" chain — yet the certificates were issued to at least five differently named Chinese companies, none of which appear to share ownership on paper.
#Ludashi#Chinad#Polarwind#code-signingabuse#DigiCertcertificatechain#ChinaMobileAS9808#PubNubRAT#adware/PUAsupplychainActorsAPT23 · KeyBoyIOCf37 · i4 · d4 · u2MITRE8
FILEMembersJul 15, 2026, 21:56 (UTC+9)Four Signers, One Playbook: Stolen Certs Mask VPN Trojans
A trojan-tagged VPN utility called upWire.exe carries a fully valid EV code-signing chain from WEILAI NETWORK TECHNOLOGY CO., LIMITED, chained through GlobalSign GCC R45 EV CodeSigning CA 2020 — and still draws 29 of 74 engine detections. That contradiction sits at the center of a file set CTX Team has been tracking: nine dossiers, at least four distinct commercial signing identities, and a consistent trick underneath all of them — wrap a PUA or trojan dropper in a legitimate-looking VPN,…
#code-signingabuse#EVcertificatefraud#VPNtrojandropper#BrightData#WEILAINETWORKTECHNOLOGY#AS24429infrastructure#PBotstealer#supplychaintrustexploitationActorsCactus · Cactus Ransomware GroupIOCf49 · i9 · d33 · u8MITRE34
C&CMembersJul 15, 2026, 21:46 (UTC+9)Salty Spider's KMSpico Crack-Tool Cluster Stays Frozen—And Still Works
Four KMS-activation installers circulating under the KMSpico and AutoKMS banners all carry the identical code-signing chain from an entity calling itself "@ByELDI" — a self-issued authority whose root nothing trusts, wrapped around binaries that also co-fire generic RAT-detection and anti-hook YARA rules that have nothing to do with license activation.
#SaltySpider#KMSpico#ByELDIcertificate#clipboardhijacking#cryptocurrencymining#ZettaHosting#Bulgaria#softwarepiracyActorsSalty Spider · KuKuIOCf14 · i3 · d4 · u29MITRE11IndustriesHealthcare
APTMembersJul 15, 2026, 21:37 (UTC+9)KMSpico Crack Kit Adds Cryptominer, Clipper on Same Old Rail
The latest sweep of Salty Spider's long-running KMSpico/AutoKMS distribution cluster turned up 19 new file hashes and four new URL variants — and not a single new IP address or domain. That lopsided delta is itself the story: the operators behind this pirated-Windows-activation funnel have left their hosting fabric completely untouched while quietly expanding what the funnel actually delivers.
#SaltySpider#KMSpico#AutoKMS#XMRig#clippermalware#cryptojacking#ZettaHostingSolutions#softwarepiracyActorsSalty Spider · KuKuIOCf33 · i3 · d4 · u33MITRE12IndustriesHealthcare
APTMembersJul 15, 2026, 13:37 (UTC+9)Six-Year-Old Domain, Faked Autodiscover Cert Outshine Blank File Hashes
Three subdomains carved out of a Thai medical-software vendor's own domain zone, a Singapore-hosted IP wearing a certificate that borrows another hosting provider's name, and a six-year-old Chinese-registered domain freshly reissued with a GoDaddy certificate — together these form the only legible signal in a record that otherwise offers almost nothing.
#bmscloud.in.thcluster#A2Hostingcertificatemasquerade#xsbl.netdomainreuse#APT28#DonotTeam#APT15Ke3chang#healthcaresectortargeting#TLScertificateabuseActorsAPT28 · StrontiumIOCf16 · i3 · d4 · u0MITRE29IndustriesGovernment · Healthcare · Telecommunications
FILEMembersJul 15, 2026, 05:36 (UTC+9)Fake RDR2 Crack Installer Feeds DBatLoader Chain to Recycled Hosting
Two "setup.exe" installers claiming to be a FitGirl-style repack of Red Dead Redemption 2 have quietly become one of the more efficient initial-access vectors observed on public malware-sharing telemetry this year — not because the lure is novel, but because of what happens after a victim runs it. Both installers trigger a DBatLoader sandbox verdict [T1204], and one of them has been submitted 14,889 times from 3,664 unique sources, a distribution footprint that reads less like a targeted…
#DBatLoader#crackedsoftwarelure#MSILloader#VoidArachne#SilverFox#maliciousinfrastructurereuse#coinminer#IDSsignatureoverlapActorsVoid Arachne · Silver FoxIOCf10 · i4 · d2 · u0RegionsBR · PT
APTMembersJul 14, 2026, 22:23 (UTC+9)25-Year-Old Domain Shares Name Servers With Fresh Emotet Asset
Two domains registered nearly a quarter-century apart are pointed at an identical set of authoritative name servers — a provisioning fingerprint that says more about this campaign's operators than any single payload does. quasi-monkey.com, registered through Porkbun LLC on 2000-09-11 and sitting on the internet for more than 9,400 days, and andysresume.info, registered on 2025-02-03, both delegate to the same four Porkbun infrastructure hosts: curitiba.ns.porkbun.com, fortaleza.ns.porkbun.com,…
#Emotet#TA542#nameserverdelegation#Let'sEncryptcertificateabuse#IBANphishinglure#macrodownloader#infrastructurefingerprinting#financesectortargetingActorsEmotet Group · TA542IOCf3 · i2 · d3 · u4RegionsDEIndustriesTechnology
C&CMembersJul 14, 2026, 21:35 (UTC+9)Cloned UnionPay TLS Certificate Links 12 Chinese Carrier IPs
A single TLS certificate serial, b16a258a252d804ceb0eb5ba860f3e5, presents identically across 12 IP addresses that have no obvious business relationship — spanning China Mobile (AS56045, AS56046, AS9808), China Unicom (AS4837), multiple China Telecom provincial networks (AS142404, AS134762, AS141998, AS138169) and CT-HangZhou-IDC (AS58461).
#clonedTLScertificate#UnionPayimpersonation#code-signingabuse#adwarePUP#Ludashi#ChinaTelecomChinaUnicomChinaMobile#DigiCertmisuse#C2frontinginfrastructureActorsFIN6 · Skeleton SpiderIOCf33 · i16 · d5 · u4MITRE20IndustriesTelecommunications
APTMembersJul 14, 2026, 14:11 (UTC+9)17 IPs, Three Budget Hosts, No Hardened C2 Behind KMS Lure
The indicator set built around a pirated Windows-activation script doesn't resolve into a single hardened command post — it resolves into three separate landlords. Cross-referencing the 17 IP addresses tied to this record turns up three matched pairs, each pair sitting on the identical autonomous system: 195.3.220.103 and 109.205.211.94 both answer from AS201814, registered to MEVSPACE sp.
#APT40#Gozi#KMSactivatorlure#sandboxevasion#VPSinfrastructure#certificatemisconfiguration#trojan.powershell/abtrojan#threatattributionActorsAPT40 · MudcarpIOCf1 · i17 · d0 · u0MITRE4IndustriesTechnology
APTMembersJul 14, 2026, 13:34 (UTC+9)Two Adware Families Share One GlobalSign EV Cert Chain
Two commodity adware installers with nothing else in common — different file types, different packers, different threat labels, submitted sixteen months apart — chain to the exact same GlobalSign intermediate certificate. That single overlap, buried inside a feed-tagged "APT28" cluster, turns out to be the most concrete, independently verifiable signal in the entire dataset, and it has nothing to do with espionage tradecraft.
#APT28misattribution#adware#MediaArena#ByteMediaBrowserAssistant#EVcodesigningcertificate#GlobalSign#redirectgateinfrastructure#PUPmonetizationActorsAPT28 · StrontiumIOCf13 · i0 · d6 · u6MITRE24IndustriesNon-Profit
C&CMembersJul 14, 2026, 05:39 (UTC+9)A Nine-Second Certificate Gap Exposes a Scripted C2 Build
Two domains on opposite sides of the top-level-domain map — deluxe.gl and geo-foundation.vg — resolve to the identical IP address, 79.124.59.146, and each received a Let's Encrypt certificate within nine seconds of the other on 2026-06-13. That kind of timing does not happen between two independent registrants. It happens when one operator, or one script, provisions both hostnames as part of the same build.
#SpringDragon#Cloudflaredomainfronting#Let'sEncryptcertificateabuse#EVcode-signingabuse#C2infrastructure#trojanmasquerade#governmentespionage#AWSrotatinginfrastructureActorsSpring Dragon · Lotus BlossomIOCf2 · i1 · d3 · u1MITRE19IndustriesGovernment
FILEMembersJul 13, 2026, 21:51 (UTC+9)Valid 360 EV Certificate Still Gets Flagged by AV, Trips IDS
Four Windows binaries branded as a "游戏助手" (game assistant) utility package carry a fully valid Extended Validation code-signing chain from Beijing Qihu Technology Co., Ltd. — the entity behind the 360 security and gaming ecosystem — chained through GlobalSign GCC R45 EV CodeSigning CA 2020 under certificate serial 77 D9 12 68 10 B4 7A D8 41 65 66 51. That should be the strongest trust signal a Windows binary can carry.
#Qihu360#EVcode-signingabuse#GameAssistant#adware#PUA#Steamcrackmalware#CDNcertificatesharing#misattributionActorsSnowglobe · Animal FarmIOCf10 · i7 · d0 · u0MITRE18
C&CMembersJul 13, 2026, 21:38 (UTC+9)Two Chinese Signing Certs Feed One Adware Pipeline, RAT Flag Emerges
Sixteen of the twenty-two files catalogued in this cluster carry "Valid" status DigiCert Trusted G4 Code Signing chains — the exact same certificate authority, issued to two different Chinese corporate identities, distributing what VirusTotal's community consistently labels as the Ludashi/PolarWind adware-PUA family. The larger cohort, twelve files signed by 北京创想界科技有限公司, spans a detection range from 5/76 up to 34/77 across a size band running from 110 KB up to 2,571 KB.
#Ludashiadware#PolarWindPUA#codesigningabuse#DigiCertcertificate#PubNubRAT#China-basedinfrastructure#CDNimpersonation#TA551misattributionActorsTA551 · ShathakIOCf22 · i68 · d5 · u2MITRE47
FILEMembersJul 13, 2026, 05:44 (UTC+9)APT33-Tagged File Catalog Is Mostly Public Webshell Kits
A record tagged to APT33 and carrying twenty file indicators turns out, on close reading, to be dominated not by a bespoke intrusion toolkit but by a corpus of long-public penetration-testing webshells — the same php-backdoor.php, cmdasp.asp, and cmd.jsp files that have circulated on GitHub archives like Webshells-main, fuzzdb-webshell, and Laudanum for well over a decade.
#APT33#webshells#YARAdetection#Laudanumtoolkit#netcat#OWASPZAP#falsepositiveattribution#AWSS3infrastructureActorsAPT33 · MagnalliumIOCf29 · i0 · d1 · u2MITRE7
FILEMembersJul 12, 2026, 21:58 (UTC+9)Free KMS Activator Ships With a Windows Defender Kill-Switch
A single cracked-software binary — sold to casual users as a free Windows activation tool — is quietly stacking four distinct evasion techniques into one package: a code-signing certificate that traces to a root nobody trusts, a UPX-packed payload that dumps itself at the original entry point, a named registry indicator for disabling Windows Defender, and anti-debug stalling behavior.
#KMSactivator#crackedsoftware#WindowsDefenderbypass#UPXpacking#code-signingcertificateabuse#GamaredonGroup#ad-frontedinfrastructure#malwareloaderreuseActorsGamaredon Group · CTIGIOCf11 · i1 · d0 · u0MITRE19IndustriesDefense
C&CMembersJul 12, 2026, 21:44 (UTC+9)Certificate Serial Links South African IP to GoDaddy Domain
A single TLS certificate serial number — 5ee850a60d5f88bb1442ee2acebf3310dd — is the thread that unravels this cluster. It sits on an AFRINIC-registered IP, 168.76.155.178, hosted under ASLINE LIMITED (AS137951) in South Africa, and it sits, identically, on guomcc.com, a domain registered through GoDaddy.com, LLC back in July 2024.
#C2infrastructure#certificatereuse#Let'sEncryptabuse#phishingdomains#AdvancedIPScanner#hostingproviderabuse#brandimpersonation#trust-chainabuseActorsLockbit GangIOCf2 · i29 · d32 · u1MITRE8
APTMembersJul 12, 2026, 21:35 (UTC+9)APT15-Linked Set Shows Three-Tier, Cert-Rotated Hosting Discipline
Four subdomains — meddup.bmscloud.in.th, api.notify.bmscloud.in.th, donorcheck.bmscloud.in.th, and moph-phr.bmscloud.in.th — all live inside the same legitimate-looking DNS zone, bmscloud.in.th, registered through the Thai registrar THNIC to Bangkok Medical Software Co., Ltd. Three of the four resolve to the identical IP, 171.103.78.30, and the cohort as a whole shares one registrar across all four names — the kind of single-administrative-point pattern that tells an analyst these are…
#APT15#Ke3chang#Mirage#healthcaretargeting#governmenttargeting#Thailand#TLSinfrastructure#certificaterotationActorsAPT15 · ROYALAPTIOCf9 · i3 · d10 · u1MITRE9IndustriesGovernment · Healthcare · Telecommunications
C&CMembersJul 12, 2026, 13:44 (UTC+9)PacketStream Installer Trio Shares Expired Cert, Trips GhostSocks Rule
Three binaries carrying the PacketStream brand — an installer, a launcher, and a client — all share one code-signing certificate that expired more than a year before the files were still circulating with it attached. The certificate, issued to "PacketStream Inc" and chained through DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, carries serial number 08 A1 E1 05 55 6E 22 8D 46 FE D7 72 3C 52 19 1E and a signing timestamp of 07:57 AM on May 2, 2024 — identical across all three files…
#PacketStream#GhostSocks#code-signingcertificateabuse#SOCKS5proxyware#KoreaTelecomAS4766#adwareandPUA#ageddomainreuse#APT28misattributionActorsAPT28 · StrontiumIOCf3 · i13 · d5 · u0MITRE28
APTMembersJul 12, 2026, 13:35 (UTC+9)Seven Fake FIFA Job Portals Share One Registrar, One Certificate
Seven lookalike domains built around FIFA hiring and career themes — fifa-careerhub.com, fifa-hr.com, jobs-fifa.com, fifa-careerpath.com, fifa-hiring.com, fifa-careerportal.com, and fifahiring.com — sit behind a single automated registration pipeline. Six of the seven were registered through Name.com, Inc., resolve to the identical A-record 91.195.240.94, share all four name.com nameservers (ns1kpv, ns2kry, ns3jmt, ns4dmx), and were issued near-identical certificates from DigiCert's "Encryption…
#TA505#FIFArecruitmentphishing#VBScriptdownloader#domainfactory#OmegatechLTD#AS202412#DigiCertcertificateabuse#bulletproofhostingActorsTA505 · Hive0065IOCf48 · i5 · d8 · u2MITRE17
FILEMembersJul 12, 2026, 05:55 (UTC+9)Same XMRig Miner Build Resurfaces Under New Names Since 2019
A single compiled Windows binary — identified by the import-table fingerprint imphash 91ae93ed3ff0d6f8a4f22d2edd30a58e — has been circulating since June 2019, and a fresh copy of the same build turned up again as recently as June 17, 2025. Six files share that imphash, an identical rich PE header hash (50dce46bb94bc57fb0152942a792d7e2), the same PE compile timestamp (2018-09-04) and the same entry point (31187).
#XMRig#cryptominingmalware#PyInstaller#UPXpacking#RampantKittenmisattribution#commoditymalware#living-off-the-landmasquerading#malwareclusteringActorsRampant KittenIOCf8 · i1 · d0 · u0MITRE8IndustriesConsulting
C&CMembersJul 12, 2026, 05:45 (UTC+9)One DigiCert Root, Four Shell Firms: Inside a Chinese Adware Signing Ring
A single DigiCert code-signing root has quietly underwritten twenty different Chinese PC-optimizer and "app store" installers over roughly three years — but the signer name attached to that root has changed four times. 成都奇鲁科技有限公司, 北京创想界科技有限公司, 成都星汉云科科技有限公司, and a now-expired Chengdu Qilu Technology Co. Ltd. certificate all chain up to either "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" or its SHA2 predecessor, signing installer chrome, uninstallers, and helper DLLs that…
#Ludashiadware#code-signingabuse#DigiCertcertificates#PubNubRAT#PUAdistribution#ChinaCDNinfrastructure#PatchworkAPTattribution#xhyktech.comActorsPatchwork · ChinastratsIOCf33 · i2 · d5 · u28
APTMembersJul 11, 2026, 22:06 (UTC+9)Old and New Certificates Both Fool Antivirus in Same Cluster
A 2012-era remote-access tool still clears the majority of antivirus engines on the strength of a VeriSign signature that has technically expired but still chains to a valid root — while, on the other end of the trust spectrum, a binary carrying a fully current DigiCert code-signing chain issued this March slips past most detection under a stealer classification.
#code-signingabuse#FlawedAmmyy#PBotstealer#BrightData#SaltySpider#CDN-frontedC2#certificatetrust#T1553.002ActorsSalty Spider · KuKuIOCf26 · i3 · d8 · u0MITRE13IndustriesConstruction · Containers & Packaging · Education & Research
FILEMembersJul 11, 2026, 21:46 (UTC+9)Trojanized Ultrasurf Sample Wraps Genuine Signature in UPX Packer
A copy of Ultrasurf — the anti-censorship proxy client used for over two decades by activists and ordinary internet users to route around national firewalls — is circulating in a UPX-packed form that nineteen of 74 engines now flag as trojan or PUA activity, even though the file still carries a genuine Ultrareach Internet Corp. code-signing chain.
#Ultrasurf#codesigningabuse#UPXpacking#MuddyWater#SilentChollima#Glupteba#TorC2#circumventiontoolsActorsMuddyWater · TEMP.ZagrosIOCf4 · i1 · d1 · u1MITRE20IndustriesGovernment
C&CMembersJul 11, 2026, 21:37 (UTC+9)Two Dead Certificates Still Signing Live VPN Malware
Two unrelated shell companies — one issued an EV code-signing certificate by GlobalSign, the other an OV certificate by DigiCert — are each vouching for a trio of VPN-branded Windows binaries whose leaf certificates VirusTotal now flags as "not time valid." That should mean nothing runs. Instead, both cohorts keep circulating: a "WireVPN" loader-and-DLL set signed under WEILAI NETWORK TECHNOLOGY CO., LIMITED racks up 14 to 29 flags out of 74-75 engines, while a "VPNMaster" trio signed under…
#code-signingabuse#WireVPN#VPNMaster#WEILAINETWORKTECHNOLOGY#INNOVATIVECONNECTINGPTE.LIMITED#PUAbundler#proxyware#trust-controlsubversionActorsSpace Pirates · WebwormIOCf37 · i21 · d87 · u27MITRE18
APTMembersJul 11, 2026, 05:33 (UTC+9)Expired Certificate, Still Trusted: A Bundler Wearing Four Disguises
A single Win32 binary circulating under the guise of at least four unrelated software titles — Resource Hacker, the XMEye video-surveillance client, the KeyTweak keyboard remapper, and the log viewer glogg — carries a code-signing chain that keeps presenting as "Signed" to Windows even though its own leaf certificate has expired.
#code-signingabuse#adwarebundler#sandboxevasion#APT28#APT15#crypto-faucetscam#Servers.comhosting#threatintelattributionActorsAPT28 · StrontiumIOCf12 · i3 · d4 · u2MITRE10IndustriesEnergy
APTMembersJul 10, 2026, 19:48 (UTC+9)World Cup Streaming Lures Tie Four Registrars to One Operator
Four landing pages captured in a single infrastructure snapshot all promise the same thing: a live stream of a 2026 FIFA World Cup match. The URLs — watchme.mom/9813/0/fifa/4, sportxlive.sbs/2562/0/soccer%20ss/19, nowstreams.top/player.php/iran-vs-new-zealand-fifa-world-cup-football, and foxtrend.click/event/wc-2026-iran-vs-new-zealand-m — sit on four domains registered through four different registrars, at four different points between February and May 2026.
#LazarusGroup#torpig#WorldCuplure#phishingdomains#Let'sEncryptcertificates#Cloudflarefronting#Namecheapsharedhosting#spearphishinglinkActorsLazarus Group · Hastati GroupIOCf0 · i2 · d5 · u4MITRE4IndustriesEducation & Research · Utilities
C&CMembersJul 10, 2026, 19:36 (UTC+9)One DigiCert Certificate Signed 13 Chinese Adware Builds for 18 Months
The most durable artifact in this dataset isn't a zero-day or a novel loader — it's a single DigiCert-issued code-signing certificate that has quietly signed thirteen different Win32 binaries over eighteen months, from November 2024 through May 2026. The signer of record is 成都奇鲁科技有限公司, and the certificate — serial 0D 07 8E 70 EA EE 48 FF EB 95 76 BD D4 00 BE 98, chained through DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 up to DigiCert Trusted Root G4 — has stayed valid and in…
#code-signingcertificateabuse#adware/PUAdistribution#China#TLScertificatespoofing#UnionPayimpersonation#defenseevasion#DigiCert#config-deliveryinfrastructureActorsFIN6 · Skeleton SpiderIOCf42 · i21 · d5 · u10MITRE22IndustriesTelecommunications
APTMembersJul 10, 2026, 19:27 (UTC+9)Expired and Valid Code-Signing Certificates Both Fuel VPN Malware
Three code-signing identities — WEILAI NETWORK TECHNOLOGY CO., LIMITED, Bright Data Ltd, and INNOVATIVE CONNECTING PTE. LIMITED — anchor a cluster of VPN and proxy installers now circulating with a shared defect: the certificates behind them have lapsed, and the binaries keep shipping anyway. The most striking case is a single leaf certificate (serial 03 A9 18 8A A5 10 C0 F8 34 34 26 BF), issued to WEILAI NETWORK TECHNOLOGY under a GlobalSign GCC R45 EV CodeSigning chain, that signs three…
#code-signingabuse#PBotstealer#BrightData#VPNtrojan#expiredcertificate#brandimpersonationdomains#supplychaintrustabuse#commoditymalwareActorsEvilnum · DeathStalkerIOCf21 · i22 · d45 · u3MITRE18
C&CMembersJul 10, 2026, 09:03 (UTC+9)Three Valid Chinese Code-Signing Certs Push Adware Past AV, Sandboxes
Three legitimately issued DigiCert code-signing certificates — bearing the corporate names Shanghai Oriental Webcasting Co. Ltd., Shenzhen Kaixin Kangaroo Technology Co., Ltd., and Shanghai 2345 Mobile Technology Co., Ltd. — sit atop a wave of Chinese consumer-software installers that up to 47 of 77 antivirus engines now flag as adware, even as the same binaries clear behavioral sandboxes as harmless.
#code-signingcertificateabuse#adware#PUA#ChineseCDNimpersonation#HuaweiAppGalleryspoofing#C2infrastructure#DigiCert#sandboxevasionActorsSalty Spider · KuKuIOCf25 · i11 · d1 · u1MITRE32
C&CMembersJul 10, 2026, 08:48 (UTC+9)Self-Signed 'malware.com' Cert Ties Two Domains to One Host
Two subdomains of one 2018-registered domain — update.buffernavpose.com and errors.buffernavpose.com — terminate in an identical self-signed TLS certificate whose subject and issuer both read literally "*.malware.com," issued under the stock OpenSSL demo organization name "Internet Widgits Pty Ltd." Both hostnames resolve to the same address, 34.209.195.255, and both sit on a domain registered through Dynadot Inc on 2018-05-12 and still being updated as recently as 2026-04-16.
#APT28#shlayer#self-signedcertificate#update.jsonbeacon#PUPadware#Dynadotdomain#energysector#C2infrastructureActorsAPT28 · StrontiumIOCf2 · i0 · d2 · u36MITRE15IndustriesEnergy
APTMembersJul 10, 2026, 08:36 (UTC+9)Fake UnionPay Certificate Ties Together Eighteen IPs on Nine Chinese Carriers
Fifteen of eighteen catalogued IP addresses, scattered across nine distinct Chinese network operators, present the exact same TLS certificate serial — b16a258a252d804ceb0eb5ba860f3e5 — for a subject that has nothing to do with any of them: *.unionpayintl.com, issued by DigiCert Basic OV G2 TLS CN RSA4096 SHA256 2022 CA1 and valid from September 30, 2025 to October 31, 2026.
#UnionPayimpersonation#code-signingabuse#ChineseCDNinfrastructure#adware/PUA#DigiCertcertificatemill#PubNubRAT#ChinaUnicomAS4837#threatattributionmismatchActorsFIN6 · Skeleton SpiderIOCf84 · i25 · d2 · u1MITRE29
C&CMembersJul 10, 2026, 04:33 (UTC+9)Debug-Path YARA Rule Unmasks Prometei Botnet Behind OilRig Label
Two files land in this cluster carrying almost nothing in common on paper. One is tagged by commercial engines as trojan.prometei/bjsg; the other as trojan.gdvw/leonem. Their import hashes differ entirely, and nothing in their surface metadata suggests a shared origin. Yet both — 39b1042a5b02f3925141733c0f78b64f9fae71a37041c6acc9a9a4e70723a0f1 and ea8cde21792543d7e55dd9a2a894c3cd4fc4fabaeab20ba689b84416c20a6e37 — fire the same crowdsourced YARA rule, Prometei_PDB, a signature built specifically…
#Prometeibotnet#OilRig#APT34#SSHRDPbruteforce#self-propagatingmalware#YARAdetection#CAPESandbox#masqueradingActorsOilRig · APT34IOCf4 · i1 · d0 · u0MITRE9IndustriesTelecommunications
APTMembersJul 10, 2026, 02:42 (UTC+9)Shared Import Table Ties Four AD Attack Tools to One Build Pipeline
A single .NET import-table fingerprint — imphash f34d5f2d4577ed6d9ceec516c1f5a744 — turns up on eight separate files carrying four different public tool identities: SharpHound, Certify, Rubeus, DefenderCheck, and an unlabeled dropper masquerading as RandomName.exe. None of these tools were written by the same author, and none share a codebase.
#SharpHound#Mimikatz#Rubeus#Certify#SafetyKatz#ActiveDirectory#credentialtheft#buildprovenanceActorsSandworm · QuedaghIOCf106 · i0 · d2 · u18MITRE22
FILEMembersJul 9, 2026, 19:04 (UTC+9)Same Femo IT Hosting Block Swaps Phishing for Amadey-Stealc Crimeware
The AS214351 hosting block operated out of Femo IT Solutions Limited's German netblocks has appeared in CTX Team's tracking before, tied to rapid certificate rotation behind phishing infrastructure. This snapshot shows the same three IPs — 62.60.226.159, 196.251.107.104, and 196.251.107.130 — still live, but every one of the nine files riding them is new. The ASN hasn't moved.
#AS214351#FemoITSolutions#Amadey#Stealcv2#clipboardhijacker#Rhadamanthys#KuCointyposquat#credentialtheftIOCf9 · i3 · d0 · u10MITRE48RegionsVNIndustriesTelecommunications
C&CMembersJul 9, 2026, 18:51 (UTC+9)Three-IP Hosting Block Masks KuCoin Fake and Wallet-Stealer Kit
Three IP addresses — 62.60.226.159, 196.251.107.104, and 196.251.107.130 — sit on a single small hosting block registered to Femo It Solutions Limited under AS214351, and two of them are dressed in freshly minted TLS certificates that have nothing to do with each other's cover story. One serves a Let's Encrypt certificate for "kucoin.sh," complete with subject alternative names for security.kucoin.sh and www.kucoin.sh — a crypto-exchange lookalike.
#KuCoinimpersonation#clipboardhijacker#Exoduswallettheft#AS214351#FemoITSolutions#Let'sEncryptcertificateabuse#commoditystealer#PHPC2panelIOCf32 · i3 · d0 · u9MITRE56RegionsDE · VNIndustriesTelecommunications
APTMembersJul 9, 2026, 18:41 (UTC+9)Packed svchost.exe Dropper Reveals Tor C2 Inside Sparse APT Feed
A single UPX-packed binary sitting inside an otherwise thin indicator set shows a strikingly complete tradecraft arc — from disguised execution through anti-analysis packing to discovery and an anonymized command channel — even though the wider record around it barely holds together. The sample, a 7-megabyte Win32 executable that VirusTotal engines label trojan.dekimine, installs itself as %APPDATA%\pwo6\svchost.exe, borrowing the name of a core Windows process while stashing alternate copies…
#APT-C-35#DonotTeam#trojan.dekimine#UPXpacking#masquerading#TorC2#WMIdiscovery#AkamaicertificatemismatchActorsAPTC35 · Donot TeamIOCf58 · i3 · d0 · u1RegionsPL
FILEMembersJul 9, 2026, 10:53 (UTC+9)Fleet of Look-Alike Domains Shares One WE1 Certificate Pipeline
Five domains in a seven-domain delivery fleet — cartmask.xyz, fluxautomation.cc, microlsireqjn.com, rabbitsbird.info and silversongs.info — were issued certificates by the same Google Trust Services intermediate, "WE1," inside a roughly one-month window running from June 6 to July 7, 2026. That kind of certificate-issuance cadence, layered on top of a shared Namecheap registration workflow across three of those domains, is the signature of tooling, not coincidence — an operator standing up…
#Lummastealer#ClipBanker#KMSpicocracklure#domainfleet#GoogleTrustServicesWE1#Namecheapregistration#code-signingspoofing#cryptocurrencyclipperIOCf5 · i1 · d7 · u14MITRE52RegionsCH · KE · USIndustriesHospitality & Leisure · Technology
APTMembersJul 9, 2026, 10:43 (UTC+9)JScript Downloader Checks Its Own IP Before Calling Home
An unsigned UTF-16 JScript file, submitted four times from three separate sources on the same day, spends its opening moments doing something most invoice-lure malware skips: it pauses, checks whether it is being watched, and looks up its own public IP address before doing anything else. That combination — deliberate sleep cycles tagged internally as "long-sleeps" and "idle," paired with an external-IP self-check against checkip.dyndns.org and reallyfreegeoip.org — is the most concrete and…
#Rockloader#TA505#JScriptdownloader#sandboxevasion#invoicelure#self-signedcertificate#VPSinfrastructure#SSLblocklistActorsTA505 · Hive0065IOCf2 · i1 · d0 · u2RegionsBD · DE · ES · FRIndustriesCommercial Services · Construction · Containers & Packaging
C&CMembersJul 8, 2026, 18:49 (UTC+9)One Reflective Loader, Three Antivirus Verdicts: A Single Kit Unmasked
Antivirus engines looked at three Windows binaries and returned three different answers: stealc/marte, clipbanker/tedy, mikey/bank. A closer read of the code underneath tells a different story. All three — a 10.5MB file masquerading as "EmailCheckerPro 2.0.exe", a 253KB "WindowsHost.exe," and a 333KB dropper staged under %APPDATA% — co-fire the same two YARA rules, ReflectiveLoader and INDICATOR_SUSPICIOUS_ReflectiveLoader, tripwires that flag reflective DLL injection artifacts rather than any…
#Stealcv2#ClipBanker#Amadey#reflectiveDLLinjection#CMSTPUACbypass#BYOVD#FemoITSolutions#domain-lessC2infrastructureIOCf11 · i4 · d0 · u10MITRE20RegionsHK