APTMembersJul 8, 2026, 11:18 (UTC+9)Fake Filmora Crack Installer Uses PPI-Style Builder Backend, Tied to APT28
A file calling itself "Wondershare Filmora.exe" — bundled inside a folder path reading "Wondershare Filmora v15.2.5.17803 (x64) Crack 2026 New" — is not a video editor. It is a Nullsoft Installer self-extracting archive that 37 of 75 antivirus engines flag as a trojan downloader, distributed through three Cloudflare-fronted .info domains that carry matching wildcard-SAN TLS certificates and, in one case, an on-demand builder endpoint that mints a fresh installer binary for every click.
#APT28#FancyBear#NSISinstaller#pay-per-install#crackedsoftwarelure#healthcaresector#Cloudflareinfrastructure#wildcardTLScertificateActorsAPT28 · StrontiumIOCf3 · i0 · d3 · u12MITRE23RegionsFR · GR · IT · LKIndustriesHealthcare
FILEMembersJul 8, 2026, 10:45 (UTC+9)2008-Vintage Pushdo Downloader Resurfaces With Named C2 Signatures
A Win32 downloader carrying an eighteen-year-old compile timestamp surfaced in detection feeds eleven days ago, and once it started talking, it said something specific: named Snort and Emerging Threats signatures identify its outbound traffic as Pushdo botnet check-in behaviour, not generic malware noise. The binary's PE header reads 2008-09-12; its first appearance in detection telemetry is 2026-06-27 — a gap of roughly eighteen years that is consistent with a decade-old Cutwail/Pushdo builder…
#Pushdo#Cutwail#botnetdownloader#packedPEmalware#HIVELOCITYAS29802#threatintelligencemislabeling#IDSsignaturedetection#C2beaconingActorsPinchy Spider · SodinokibiIOCf3 · i9 · d10 · u7RegionsDE
FILEPublicJul 8, 2026, 02:52 (UTC+9)One Domain Runs Both Ends of a SWIFT-Themed Malware Chain
A domain named to evoke SWIFT bank-transfer messaging, registered through Dynadot Inc on 2022-06-10, has been quietly running both ends of an intrusion chain from one machine. swift-be.com is not fronting a CDN, is not split across a constellation of look-alike names, and is not hiding behind a bulletproof host. Instead, the same domain serves a PHP check-in script at swift-be.com/roks4/gate.php and a directly named executable payload at swift-be.com/roks4/shit.exe — both sitting under the…
#GorgonGroup#Subaat#swift-be.com#gate.phpC2#commoditydropper#Let'sEncryptcertificateabuse#manufacturingsectorBangladesh#PEpackerevasionActorsGorgon Group · SubaatIOCf2 · i0 · d1 · u2RegionsBDIndustriesManufacturing
C&CMembersJul 8, 2026, 02:44 (UTC+9)Five Malware Families, One Shared Diamotrix C2 Panel
Eight new binaries entered the same tracked cluster this week, and on paper they look like five unrelated infections: a ClipBanker variant, a second ClipBanker variant, a third ClipBanker variant, a StealC-labelled stealer, a PowerLoader-tagged loader, and a file flagged as Rhadamanthys whose only sandbox verdict instead calls it Formbook. Static antivirus labels alone would read this as a grab-bag of commodity crimeware.
#StealCv2#ClipBanker#PowerLoader#Rhadamanthys#Diamotrix#reflectiveDLLinjection#command-and-controlinfrastructure#malware-as-a-serviceIOCf8 · i4 · d0 · u8MITRE48RegionsES
FILEMembersJul 7, 2026, 18:55 (UTC+9)Batch-Registered Domains Mimic Baixaki to Push COMODO-Signed Adware
Three domains registered in the same transaction, at the same registrar, at the same second, are doing the work of an entire distribution network for a low-detection installer campaign. The apex domain, baixakialtcdn.com, and its two operational subdomains — os.baixakialtcdn.com and os2.baixakialtcdn.com — were all created through PDR Ltd.
#DealPly#PUP#Baixakiimpersonation#AzionCDN#COMODOcodesigning#domainsquatting#Brazil#bundledinstallerIOCf8 · i2 · d3 · u5MITRE34RegionsBR
FILEMembersJul 7, 2026, 11:09 (UTC+9)Six-Year-Old Emotet Macro Doc Still Evades a Third of AV Engines
A macro-enabled Word document that first surfaced in October 2020 is still doing exactly what it was built to do: get opened, auto-run its embedded VBA project, and quietly hand off to a follow-on payload — while nearly a quarter of the antivirus industry either misses it outright or can't parse the file at all. The sample, carrying the threat label "downloader.w97m/emotet," draws 46 flags out of 77 engines and a unanimous 3-for-3 malicious verdict across three separate sandboxes.
#Emotet#macrodownloader#VBAmalware#phishingattachment#sandboxdetection#GoDaddyhosting#Microsoft365#TA542ActorsEmotet Group · TA542IOCf4 · i0 · d2 · u4RegionsAT
APTMembersJul 7, 2026, 10:44 (UTC+9)Sality-Linked Miner Cluster Shares Temp Staging, Not Build Code
Two XMRig-derived cryptomining binaries flagged in the same indicator set carry the identical classification tokens "malxmr" and "smcgr26" — yet their import-table hashes and vhash fingerprints have nothing in common, meaning they were never compiled from the same source tree. What does tie the cluster together is a staging habit: a config file, a miner executable, and an unidentified data blob all drop into randomized six-character hex subfolders inside %TEMP%, a loader convention that…
#SaltySpider#Sality#XMRig#cryptojacking#Romania#Akamaiimpersonation#processmasquerading#commoditymalwareActorsSalty Spider · KuKuIOCf6 · i2 · d1 · u1MITRE32RegionsUSIndustriesRetail
FILEMembersJul 6, 2026, 19:21 (UTC+9)A 2008 Domain Wakes Up on a Contabo Asia IP
A certificate serial number is not supposed to outlive a decade of digital abandonment. But that is exactly what has happened to carltonbaggies.com, a domain registered through Bluehost Inc. back on 2008-02-19 — 6,698 days of registration history that included no meaningful hosting activity worth tracking, according to the record available to CTX Team.
#Silence#ContractCrew#WhisperSpider#domainreactivation#TLScertificateabuse#spearphishingattachment#drivermasquerading#ContaboAsiainfrastructureActorsSilence · Contract CrewIOCf7 · i2 · d6 · u2MITRE43
APTMembersJul 6, 2026, 18:48 (UTC+9)Stealer Hosting Cluster Grows: Two New IPs, Panels Span Two Providers
Two IP addresses — 196.251.107.104 and 196.251.107.130 — have just joined a five-node hosting cluster sitting on AS214351, registered to Femo IT Solutions Limited, a UK-listed shell address at 71-75 Shelton Street in London's Covent Garden. Both are new since CTX Team's earlier coverage of a StealC v2 campaign built around Chrome credential-store bypass tooling.
#StealCv2#RedLineStealer#Amadey#Carberp#clipboardhijacker#bulletproofhosting#APT28attribution#TLScertificateabuseActorsAPT28 · StrontiumIOCf8 · i7 · d0 · u15MITRE28RegionsJO
FILEMembersJul 6, 2026, 02:52 (UTC+9)Fake 'Elden Ring' Launcher Fools Sandboxes, Not 52 AV Engines
A binary calling itself "Elden Ring.exe" — and, in an alternate build, "Launcher Elden Ring.exe" — is not a cracked copy of a hit fantasy RPG. It is a dropper that static engines recognize almost immediately and dynamic sandboxes almost entirely miss, a split that is the real story here. Fifty-two of 75 antivirus engines flag the file (hash 32f34fb30fd47ab761e94306bc30432cd41d67309ab1e6b2599be2d70d3bd285) as malicious, carrying the label trojan.rancor/usblek26 along with community tags of…
#Snowglobe#AnimalFarm#babarbackdoor#Thailandtelecom#sandboxevasion#malwaredropper#koodgame.com#espionagemalwareActorsSnowglobe · Animal FarmIOCf3 · i0 · d1 · u0MITRE22RegionsTHIndustriesTelecommunications
C&CMembersJul 6, 2026, 02:41 (UTC+9)One TLS Certificate Ties Six IPs to a Phorpiex-Tagged C2 Set
A single TLS certificate — serial d3d9e9261c1c88d957e704d69617a469, issued by sslTrus (RSA) OV CA for the wildcard subject .2345.com with SANs covering .2345.cn and *.hao774.com — is currently being served from six separate IP addresses split across two carrier networks: China Telecom Shanghai (AS4811) and the Jiangsu Wuxi International IDC network (AS138950). That is not six independently provisioned servers behind six different operators.
#Phorpiex#commandandcontrol#ChinaTelecom#certificatereuse#adwarePUA#Kubernetesingress#codesigningabuse#ad-techinfrastructureIOCf3 · i24 · d0 · u0MITRE20RegionsTW
FILEMembersJul 5, 2026, 16:36 (UTC+9)One Softonic EV Signature, Two Unrelated Malware Installers
A single Sectigo EV code-signing certificate — issued to SOFTONIC INTERNATIONAL SA and timestamped 04:20 PM on 06/24/2025 — sits behind two structurally unrelated Windows installers now circulating under the names of Hamachi, Termux, a casual game called "bee-movie-game," and a reminder utility called "minireminder." The binaries, catalogued as 68e4a2bfe728081eb1a84369f7dbad74c12c06a306cd5ad974ded8df3283a2ad and e8c438babbc09306f7a903f6e8f78b59ed395c81d541417c1b009b45bdc77040, share the…
#code-signingabuse#SectigoEVcertificate#Softonic#adware.offercore#CloudFrontinfrastructure#installermasquerading#DustSquad#lummastealerActorsDustSquad · APTC34IOCf2 · i0 · d1 · u2MITRE16RegionsEC
C&CMembersJul 5, 2026, 11:49 (UTC+9)Decade-Old Corrupted PE Loader Still Evades 13 of 58 AV Engines
Forty-five of 58 antivirus engines flag a single Win32 executable tracked by CTX Team as part of a cluster linked to the malware family "ranapama" — a detection rate that sounds decisive until you notice which 13 engines still miss it. Alibaba, ClamAV, TrendMicro, TrendMicro-HouseCall, CAT-QuickHeal, and CMC, among others, return nothing at all.
#ranapama#processinjection#PEloaderevasion#Tordelivery#Let'sEncryptcertificates#C2infrastructure#staticdetectionbypass#commoditycrimewareIOCf1 · i37 · d0 · u5MITRE31RegionsUSIndustriesRetail
C&CMembersJul 4, 2026, 19:54 (UTC+9)Russian Hosting Tier Joins njRAT Campaign's Free-Cloud C2 Stack
Two IP addresses added to this record in the latest enrichment pass — 176.111.174.140 and 176.111.174.177 — sit inside the same /24 block, 176.111.174.0/24, registered to NUBES LLC under AS212136 in Russia. Both serve the identical delivery path, /bin/bot64.bin, directly by IP address rather than through a fronted domain. That is a meaningful departure from the campaign's earlier profile, which leaned almost entirely on free platform-as-a-service (PaaS) and CDN infrastructure — Render,…
#njRAT#Bladabindi#RedLineStealer#NUBESLLC#FortiGatespoofing#free-cloudfronting#dynamicDNSC2#UAEmanufacturingIOCf10 · i3 · d5 · u7MITRE45RegionsAEIndustriesManufacturing
C&CMembersJul 4, 2026, 03:47 (UTC+9)Four IPs, One ASN: Weak Link to Decade-Old Food-Lure Malware
Four IP addresses tucked inside a single /18 block, all registered to the same US carrier, are the most coherent piece of evidence in an otherwise threadbare threat record — and they are doing most of the analytical heavy lifting. The four nodes — 173.248.16.79, 173.248.20.145, 173.248.29.213, and 173.248.31.6 — all sit inside 173.248.0.0/18 under ASN 26472, registered to Mosaic Telecom, a Wisconsin-based carrier.
#MosaicTelecom#AS26472#command-and-controlinfrastructure#downloadermalware#foodandbeveragesector#packedexecutable#IPreputation#ItalyregionIOCf3 · i4 · d0 · u5MITRE13RegionsITIndustriesFood & Beverages
C&CMembersJul 3, 2026, 11:48 (UTC+9)Two Unrelated Trojans Share One Crypter's XOR Fingerprint
Two brand-new payloads dropped into this snapshot's file cohort are not, on paper, the same malware. VirusTotal's own labels split them cleanly — one reads trojan.stealer/bypassuac, the other trojan.phil/mint — and neither carries a matching imphash. Yet a UAC-bypass stealer identified by the crowdsourced YARA rule INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM (8cf4ae00be0fe987cc14ae74b0b64c188083b8bbe3b7397239cefd594492c6cd) and a second binary masquerading as core Windows processes both fire a…
#TA428#ThunderCats#CMSTPUACbypass#crypter#AS214351#processmasquerading#credentialstealer#C2infrastructureActorsTA428 · ThunderCatsIOCf2 · i3 · d0 · u6MITRE30RegionsCH · JOIndustriesFood & Beverages · Government · Support Services
APTMembersJul 1, 2026, 21:58 (UTC+9)TA505 Deploys Formbook via JS Dropper and Wildcard C2 in 35-Country Sweep
A seven-kilobyte RAR archive carrying a single JavaScript file — named to impersonate a routine trade document — is the opening move in an active credential-harvesting campaign that CTX Team has been tracking since early June 2026. The JavaScript dropper, weighing in at 71 KB and bearing the filename Swift_advise_40k$.js, invokes Windows Management Instrumentation for execution, deliberately stalls to outlast automated sandbox analysis, and then beacons over HTTPS to a disposable C2 domain…
#TA505#Formbook#JavaScriptdropper#WMIexecution#businessemailcompromise#wholesaleandmanufacturing#credentialharvesting#disposableC2infrastructureActorsTA505 · Hive0065IOCf3 · i0 · d1 · u2RegionsAE · AU · BG · CAIndustriesAgriculture · Government · Hospitality & Leisure
FILEPublicJul 1, 2026, 17:17 (UTC+9)NanoCore RAT Sample Adds Sandbox-Evasion Tricks, Beacons to Dead DuckDNS Domain
A 280-kilobyte Windows executable carrying the internal name En2m7acq.exe — tagged internally as product "Unemawermaq" — has surfaced with a detection profile that reads less like a novelty and more like a warning about how far anti-analysis engineering has trickled down into everyday commodity malware. Fifty-nine of 77 antivirus engines flag the file outright, and all three sandboxes that processed it — VMRay, C2AE, and Zenbox — converge on the same verdict: a NanoCore Remote Access Trojan,…
#NanoCoreRAT#Codoso#APT19#DuckDNS#sandboxevasion#dynamicDNSC2#commoditymalware#espionageattributionActorsCodoso · Sunshop GroupIOCf2 · i0 · d1 · u0MITRE17
C&CMembersJul 1, 2026, 14:51 (UTC+9)Nine Payloads, One Escape Hatch: Callbacks Skip the DNS Layer
A delivery wave of nine Windows binaries surfaced within a five-day window in June, and every payload built around it — a downloader, an infostealer, and two clipboard hijackers — makes the same operational choice: none of them resolve a domain to reach their controller. The IDS signature "POLICY-OTHER HTTP request by IPv4 address attempt" fires identically on three differently labelled samples — de05caad…87ec0 (flagged trojan.amadey/lumma), e78c9ae…8a41f93 (trojan.stealc/bazloader) and…
#Amadey#Stealc#ClipBanker#direct-IPC2#AS214351#Germanyhosting#WoodyRATmislabel#commoditycrimewareIOCf9 · i2 · d0 · u2MITRE21RegionsKW
C&CMembersJul 1, 2026, 06:15 (UTC+9)A Miner Wearing the Face of a Visual C++ Runtime
##A Miner Wearing the Face of a Visual C++ Runtime A packed .NET coinminer masquerading as the Microsoft Visual C++ runtime file msvcp110.exe has replaced the dropper payloads in a campaign CTX Team has been tracking since April, marking a clear pivot from delivery-stage malware to direct resource hijacking. The new primary binary — a 774 KB PE32+ assembly first submitted on 2026-04-17 — deploys into C:\Users\[user]\AppData\Roaming\msvcp110_win\msvcp110.exe, a user-writable path whose filename…
#coinminer#XMRig#msvcp110.exe#.NETpackedbinary#MSIL/Bobik#PureLogStealer#ContaboC2#IraqSouthKoreaTurkeyIOCf2 · i1 · d0 · u3MITRE36RegionsIQ · KR · TR
APTMembersJun 30, 2026, 19:33 (UTC+9)Kimsuky's Zero-Import 'svchow.dll' Evades Sandboxes in Espionage Campaign
A 112 KB Windows DLL carrying zero static imports — not a single function name visible in its import table — is circulating as "svchow.dll," a one-character typosquat of the legitimate svchost.dll, planted in the user-writable AppData\Local directory of compromised machines. The payload's combination of dynamic API resolution, debug-environment detection, and long-sleep delays split automated sandbox verdicts cleanly: one engine flagged it as malware, the other returned CLEAN.
#Kimsuky#DPRK#zero-importDLL#typosquatting#sandboxevasion#foodandbeverage#Jordan#espionageActorsKimsuky · Velvet ChollimaIOCf15 · i0 · d1 · u2MITRE26RegionsJOIndustriesFood & Beverages
APTMembersJun 30, 2026, 18:56 (UTC+9)StrongPity Cycles 44 New Files, Keeps Same C2 Domain
Forty-four new file hashes have joined the StrongPity/Patcher toolset tracked against Jordan's food and beverage sector since CTX Team's earlier look at this cluster — yet not one new domain, IP address, or URL appeared alongside them. Forty-three previously catalogued hashes dropped out of the same window. That lopsided arithmetic is the story here: a build pipeline generating and discarding binaries at volume while the delivery and tasking channel behind them sits completely still.
#StrongPity#Patchermalware#APT-C-41#Promethium#Jordan#foodandbeveragesector#command-and-controlinfrastructure#trojanizedinstallerActorsPromethium · StrongPityIOCf78 · i0 · d1 · u3MITRE30RegionsJOIndustriesFood & Beverages
FILEMembersJun 30, 2026, 10:01 (UTC+9)Decade-Old njRAT Stub Pair Resurfaces as 'Black Atlas' Campaign
Two unsigned Windows executables sharing an identical import-table hash and an identical compile timestamp are the spine of a njRAT cluster that a threat feed has only just begun surfacing under the label "Operation Black Atlas" — despite the underlying files dating to October 2014. The binaries, catalogued as c81b26e4b7cc5d3b3ab7aedb9da06b6b1cf863a2d475ac12f590b5b2a18e515a (internally named Stub.exe, 96KB) and b85913770053b4ac5ba69766924f6aab10e1ccc346bfb09571debdbd1bf37727 (internally named…
#njRAT#OperationBlackAtlas#dynamicDNS#No-IP#retailsector#malwarecluster#commandandcontrol#imphashanalysisActorsOperation Black AtlasIOCf5 · i0 · d1 · u0MITRE33RegionsUSIndustriesRetail
FILEMembersJun 29, 2026, 21:46 (UTC+9)Dormant Domain Wakes Days Before New Invoice-Lure Malware Wave
Seven months after a Namecheap registrant quietly stood up xingtialai.com, the domain's operators finally bothered to secure it: a Let's Encrypt certificate was issued for the site on 2026-06-23, and the origin server behind it picked up its own certificate two days earlier, on 2026-06-21. Within a week, on 2026-06-29, two brand-new files — an invoice-themed .NET loader and the RAR archive that appears to have delivered it — surfaced carrying anti-sandbox timers and debugger checks.
#credentialtheft#browsersecretsstealer#invoicelure#anti-sandboxevasion#xingtialai.com#OVHinfrastructure#KeyLogger#MicroClipIOCf21 · i1 · d1 · u0MITRE38RegionsAU · CN · DE · HUIndustriesSupport Services · Telecommunications
APTPublicJun 29, 2026, 17:09 (UTC+9)TigerRAT's Five-Layer Anti-Analysis Stack Splits Sandbox Verdicts
A 304-kilobyte Windows executable carrying a PE compile timestamp of October 24, 1998 — a date that predates the x86-64 processor architecture the binary actually requires to run — encapsulates the operational philosophy behind the latest TigerRAT sample tied to Silent Chollima (Andariel). The falsified timestamp is not the most sophisticated trick in the sample's arsenal, but it is the most emblematic: every layer of this implant has been deliberately engineered to mislead, delay, or defeat…
#SilentChollima#Andariel#TigerRAT#custompacker#sandboxevasion#C2infrastructure#DPRKthreatactors#defenseandgovernmenttargetingActorsSilent Chollima · AndarielIOCf1 · i1 · d0 · u1MITRE7
C&CMembersJun 29, 2026, 09:09 (UTC+9)KMSAuto Crack Lure Delivers Five-Stage Crimeware Chain From One Workbench
A trojanized KMSAuto Lite v1.6.5 Windows activation crack is circulating as the delivery vehicle for a tightly assembled five-component crimeware toolkit — one whose most distinctive feature is not the individual payloads it carries, but the build discipline that holds them together. Three of the five payload components share an identical expired Microsoft Windows Publisher leaf certificate, two others share a self-signed WZTeam certificate applied on the same day, and the PS2EXE toolchain used…
#Amadey#ClipBanker#AZORult#KMSAutolure#PS2EXE#certificatespoofing#cryptocurrencytheft#RussiaIOCf7 · i1 · d0 · u3MITRE43RegionsUG
FILEPublicJun 29, 2026, 05:56 (UTC+9)Dormant Domain Aged Three Years to Target Iraq's Auto Sector
##A Three-Year Wait to Strike: How a Dormant Domain Became the Gateway for Iraq's Automotive Sector Attack Sometime in July 2023, an operator registered datausercenterphx.com through Namecheap and then, apparently, did nothing with it. No certificate was issued. No payload was staged. The domain sat parked against Namecheap's own forwarding nameservers — dns1.registrar-servers.com and dns2.registrar-servers.com — accumulating age and, with it, the kind of passive domain reputation that…
#domainaging#Iraq#automotivesector#processinjection#datadestruction#sandboxevasion#Contaboinfrastructure#downloaderIOCf11 · i2 · d1 · u2MITRE26RegionsIQIndustriesAutomotive
C&CMembersJun 29, 2026, 05:23 (UTC+9)Lumma Stealer Hides Behind Iranian ISP and Seychelles Shell in Domainless C2
Four raw IP addresses. No domains. One hardcoded path. That is the entirety of the network-layer architecture behind a Lumma Stealer campaign that has been circulating since October 2025 under the filename "BTC CRACKER.exe" — a lure aimed squarely at cryptocurrency users who believe they are downloading a wallet-cracking utility.
#LummaStealer#Diamotrix#bulletproofhosting#cryptocurrencytheft#domainlessC2#FarahooshDenaPLC#OmegatechLTD#credentialharvestingIOCf1 · i4 · d0 · u8MITRE33RegionsUS
FILEMembersJun 29, 2026, 01:36 (UTC+9)Same LummaStealer Build Reused Twice Across Two-Month Gap
An unsigned LummaStealer binary — identical import table, identical structural hash, identical PE compile timestamp — has surfaced twice in two months from the same fake Snapchat-mod-APK download site, first in May under the VirusTotal-derived label aco4cpki and again in July as millenium/milnmrat. The reuse is not a stylistic echo; it is the same build.
#LummaStealer#crimeware#stealermalware#VBScriptlauncher#TelegramC2#cryptowallettheft#maliciousAPKlure#UpatredownloaderIOCf20 · i0 · d1 · u10MITRE57RegionsMG · US
C&CMembersJun 29, 2026, 01:09 (UTC+9)Layered Windows Trojan Campaign Hits India With Zero-Detection Loader
Six unsigned Windows executables and DLLs, all carrying copyright strings dated decades into the future, have surfaced across a three-week window targeting India — the product of a disciplined build operation that deploys three structurally distinct payload layers, beacons to a Dynu dynamic-DNS node over deliberately malformed HTTP requests, and has achieved complete evasion of all 76 antivirus engines for its most recently submitted loader stage.
#ABMRisk#Kepavll#UPX-packedDLL#PEiDloader#dynamicDNSC2#sandboxevasion#India#WindowstrojanIOCf6 · i2 · d14 · u0MITRE22RegionsIN
APTMembersJun 28, 2026, 17:04 (UTC+9)Emotet's Canadian Campaign Hides Behind Three-Layer Evasion Stack
A 141-kilobyte Word document circulating in phishing email against Canadian targets carries more infrastructure engineering behind it than its modest file size suggests. The malicious document — an Emotet e2 epoch loader first submitted to VirusTotal on 15 October 2020 and still active in this campaign — sits at the front end of a three-layer hosting architecture that combines Cloudflare origin-masking, automated 89-day TLS certificate rotation, and a dedicated command-and-control node…
#Emotet#TA542#MummySpider#Wordmacrodropper#PowerShelldownloader#compromisedWordPressinfrastructure#Canada#CloudflareevasionActorsEmotet Group · TA542IOCf3 · i1 · d3 · u5RegionsCA
APTMembersJun 28, 2026, 16:53 (UTC+9)Decade-Old German Domains Reactivated as Emotet C2 Backbone Targeting Philippines
Six command-and-control domains now active in an Emotet campaign targeting the Philippines share a striking infrastructure characteristic: four of them were registered between 2005 and 2012 through a single German registrar, Cronon GmbH, and have been sitting dormant — or at least benign-facing — for years, accumulating the kind of domain-age legitimacy that reputation-based defences routinely reward with a pass.
#Emotet#TA542#Philippines#CrononGmbH#domainaging#C2infrastructure#macromalware#credentialharvestingActorsEmotet Group · TA542IOCf4 · i0 · d6 · u11RegionsPH
C&CMembersJun 28, 2026, 10:02 (UTC+9)2345Pinyin Pipeline Grows Fallback Channel as Fuzhou IP Breaks Brand Pattern
Two newly observed IP addresses have extended the confirmed update-and-configuration infrastructure behind the 2345Pinyin input-method editor to five distinct Chinese carrier networks — and one of those IPs presents a TLS certificate that sits entirely outside the established brand ecosystem the pipeline has relied on for years.
#2345Pinyin#IMEadware#C2infrastructure#TLScertificateabuse#Chinacarriernetworks#ad-injection#supplychaindelivery#certfallback.comIOCf44 · i5 · d0 · u0MITRE24RegionsCN
C&CMembersJun 28, 2026, 06:04 (UTC+9)Aged Vietnamese Domain Reissued as C2 Behind Evasive .NET Loader
A three-year-old Vietnamese domain, canhtrang.com, has resurfaced with a freshly issued 89-day TLS certificate and a self-signed administrative host that binds directly to a single evasive Windows loader — a pattern that looks less like a new campaign standing up infrastructure from scratch than an old, ordinary-looking licensing backend being quietly repurposed for command-and-control. The domain's free., lic., and ping.
#commandandcontrol#Vietnamhostinginfrastructure#TLScertificateabuse#loadermalware#.NETpacker#softwarelicensingabuse#sandboxevasion#domainrepurposingIOCf3 · i2 · d1 · u9MITRE23
C&CMembersJun 28, 2026, 05:50 (UTC+9)Cridex C2 Pool Spans Seven Nodes Across Four Continents on One Encoded Path
At least seven command-and-control nodes spread across Indonesia, Brazil, Thailand, Mexico, and three additional unattributed locations are currently bound by a single hardcoded encoded URI path — /VJuPpCAAA/Vxi22CAAA/AHYe — embedded in a Cridex banking trojan payload that first surfaced in October 2012 and continues to generate active threat-feed hits.
#Cridex#Zbot#bankingtrojan#C2infrastructure#invoicelure#multi-noderesilience#Indonesia#MexicoIOCf3 · i4 · d0 · u12MITRE25
FILEMembersJun 28, 2026, 02:17 (UTC+9)Trojanised BitTorrent Installer Evades 74 of 75 AV Engines in 33-Country Campaign
A 4.3 MB Windows executable presenting full BitTorrent branding — product name "BT® Classic," version 51.1054.0.0, copyright "©2026 BitTorrent Limited" — is circulating as a trojanised installer that achieves a 1-in-75 detection rate while routing harvested credentials to a colocation block in Iceland whose servers answer with a *.utorrent.com TLS certificate.
#trojanisedinstaller#credentialharvesting#WebView2credentialstores#Icelandcolocationinfrastructure#CloudFrontC2#governmentandtelecomtargeting#BobSoftpacker#BitTorrentlureIOCf53 · i5 · d2 · u0MITRE70RegionsAD · AR · AT · BAIndustriesGovernment · Media · Technology
C&CMembersJun 28, 2026, 02:03 (UTC+9)One Plesk Cert Ties Four Lumma Stealer .su Domains Together
Four freshly minted .su domains — bendavo.su, conxmsw.su, narroxp.su and squeaue.su — all resolve to the same Russian-hosted IP address, share the same pair of nameservers, and present, byte for byte, an identical TLS certificate. That last detail is the tell: the certificate's subject alternative name literally hard-codes the hosting IP address into its hostname, a fingerprint that exposes what looks like four independent command-and-control domains as a single rotating front end sitting…
#LummaStealer#commandandcontrolinfrastructure#Pleskpanel#Proton66#domainrotation#VBAmacromalware#Wextractmasquerading#commodityinfostealerIOCf18 · i2 · d5 · u9RegionsCL · RO
APTMembersJun 28, 2026, 01:25 (UTC+9)Shared Imphash Ties Four 'Different' Stealers to One Builder Stub
Four Windows executables carrying four unrelated antivirus labels — AgentTesla, Bobik, "Reline," and an unnamed loader named pctool.exe — turn out to share the same import-table fingerprint, imphash f34d5f2d4577ed6d9ceec516c1f5a744, and the same PEiD packer signature. That single build lineage is the most durable and reproducible signal in an 18-file, 6-domain cluster CTX Team has been tracking: a commodity builder-and-stub layer that antivirus vendors are classifying as though it produced four…
#RedlineStealer#AgentTesla#Bobik#Socelars#Fabookie#LazarusGroup#pay-per-installdistribution#imphashclusteringActorsLazarus Group · Hastati GroupIOCf18 · i3 · d6 · u17RegionsFR
APTPublicJun 27, 2026, 21:07 (UTC+9)Donot Team Hides Cryptominer Behind Tor C2 and Anti-VM Evasion
A single 7,149-kilobyte Windows executable — packed, obfuscated, and deliberately named to impersonate a core Windows process — encapsulates one of the more analytically provocative payload configurations CTX Team has observed in a recent APTC-35 dataset. The binary, classified as trojan.dekimine and bearing the meaningful installation path %APPDATA%\pwo6\svchost.exe, does not merely steal data or open a remote shell.
#APTC-35#DonotTeam#dekimine#cryptomining#TorC2#sandboxevasion#Poland#UPXpackingActorsAPTC35 · Donot TeamIOCf58 · i1 · d0 · u0MITRE29RegionsPL
APTMembersJun 27, 2026, 16:55 (UTC+9)Seven Hostnames, One Timestamp: Mapping the yazanboss Dynamic-DNS Block
Seven near-identical hostnames — 1yazanboss.no-ip.biz through 6yazanboss.no-ip.biz, plus a bare yazanboss.no-ip.biz — were all created at the exact same second, 2001-11-22T23:09:02Z, under a single Vitalwerks Internet Solutions, LLC / No-IP.com account, with matching admin and billing contacts listed out of Reno, Nevada on every WHOIS record.
#yazanboss#DynamicDNS#No-IP.com#Sality#SaltySpider#USB-autorun#polymorphicpacker#retailsectorActorsSalty Spider · KuKuIOCf6 · i0 · d7 · u0MITRE49RegionsUSIndustriesRetail
FILEPublicJun 27, 2026, 14:07 (UTC+9)ZBot Dropper Targets Italy's Food Sector in Espionage Campaign
A 191-kilobyte Windows executable named to look like a scanned document attachment has been circulating against Italian food and beverage companies, carrying a layered evasion stack that walks past automated analysis environments before injecting a PandaBanker payload into a legitimate host process. The file — submitted to VirusTotal under the name Allegato_02,Allegato_01.Tif.exe, where allegato is Italian for "attachment" — exploits the double-extension convention to make a Win32 executable…
#BambooSpider#PandaBanker#ZBot#VBInject#foodandbeveragesector#Italy#processinjection#sandboxevasionActorsBamboo SpiderIOCf2 · i0 · d0 · u0MITRE37RegionsITIndustriesFood & Beverages
FILEMembersJun 27, 2026, 10:16 (UTC+9)One Stolen Microsoft Cert Binds Four-Malware Toolkit Targeting Farms
A financially motivated operator has assembled a four-component malware toolkit — Azorult credential stealer, ClipBanker cryptocurrency hijacker, a KillAV module, and an Andromeda dropper — and stamped every piece with the same stolen or forged Microsoft Corporation code-signing certificate, serial number 33 00 00 01 87 72 17 72 15 59 40 C7 09 00 00 00 00 01 87, signing date 2020-07-20.
#Azorult#ClipBanker#Andromeda#KillAV#code-signingcertificateabuse#agriculturesector#BrazilColombiaItaly#PS2EXEIOCf9 · i2 · d0 · u2MITRE43RegionsBR · CO · ITIndustriesAgriculture
FILEMembersJun 27, 2026, 09:45 (UTC+9)Ten-Year-Old ranapama Injector Still Harvesting US Retail Credentials in 2026
A Win32 injector compiled in June 2015 and first submitted to public malware repositories that same month is running active credential-theft operations against US retail targets in 2026 — not as a curiosity or a legacy artifact, but as a functional, evasion-engineered payload routing traffic through a 51-node relay pool spanning at least ten autonomous systems across Eastern Europe, the Caucasus, and Western Europe.
#ranapama#processhollowing#credentialharvesting#USretail#sandboxevasion#LeaseWebNetherlands#EasternEuroperelayinfrastructure#packedinjectorIOCf1 · i51 · d0 · u8MITRE30RegionsUSIndustriesRetail
C&CMembersJun 27, 2026, 09:20 (UTC+9)36 'sslsecure' Domains Mask a Templated Adware Pipeline
Thirty-six hostnames sit behind an indicator set that VirusTotal enrichment and registrar records tie to a single naming convention: sslsecure<N>.com, reproduced apex-for-apex with an identical api.v2., track.v2., and staticrr. subdomain triplet bolted onto each one. The pattern runs from sslsecure2.com through sslsecure10.com, and it isn't cosmetic — it's a templated hosting fabric built to look, at a glance, like generic SSL or security infrastructure rather than adware plumbing.
#domaiq#PUP/adware#domaininfrastructure#registrarabuse#codesigningabuse#USretailsector#ztomy.comnameservers#masqueradingIOCf2 · i1 · d36 · u0MITRE29RegionsUSIndustriesRetail
FILEMembersJun 27, 2026, 05:44 (UTC+9)One lolMiner Kit, Repackaged 20 Ways, Beats Static Detection
Twenty of the forty-three file indicators feeding this campaign are not independent malware samples — they are one dropped cryptomining toolkit, copied and renamed across batch scripts, shell scripts, a VBA-tagged loader pair, a ZIP archive and a single compiled Windows binary. Every one of them shares the identical directory scaffold resources/bin/lolminer/1.98a/ and duplicated install paths under %ProgramFiles%\CommonProgramFiles(x86)\microsoft shared\{bc4eaae6|71d5719f}\lolminer\1.98a\.
#lolMiner#cryptojacking#batchscriptmalware#dynamicDNSinfrastructure#unsignedbinaries#multi-coinmining#Dynu#ContabohostingIOCf43 · i2 · d2 · u2MITRE48RegionsAU · BE · BR · CAIndustriesConstruction · Media · Retail
C&CPublicJun 27, 2026, 05:28 (UTC+9)Amadey Credential Stealer Slips Past Sandbox Despite 60/79 AV Flags
Sixty of seventy-nine antivirus engines call it outright malicious. Feed the same file to a sandbox, and it comes back clean — "undetected," classified only as UNKNOWN_VERDICT, zero out of one dynamic runs flagging anything at all. That is the story sitting inside a single Amadey-linked credential-stealer DLL, tracked internally as cred.dll, and it is a more useful data point than most of the noisier campaign narratives this desk sees in a given week: a textbook illustration of how a passive…
#Amadey#credentialstealer#DLLmalware#sandboxevasion#C2infrastructure#Russia#YARAdetection#PleskhostingIOCf2 · i1 · d0 · u1MITRE10RegionsBG
C&CMembersJun 27, 2026, 05:07 (UTC+9)A 2012 Domain Registration Still Feeds a Fake Firefox Installer Today
Three domains bulk-registered on a single day in October 2012 are still actively serving software downloads today, and CTX Team's infrastructure mapping ties the pair of IP addresses behind their apparent callback layer to a shared TLS certificate spanning two European countries under one Brazilian CDN provider's autonomous system.
#DealPly#PUPdistribution#Baixaki#AzionTechnologies#code-signingbypass#Firefoximpersonation#CDNinfrastructure#BrazilIOCf7 · i2 · d3 · u1MITRE34RegionsBRIndustriesTechnology
FILEMembersJun 26, 2026, 22:27 (UTC+9)njRAT Campaign Hides C2 Behind Free Cloud Platforms for Three Years
An njRAT operator running a build pipeline that has remained functionally intact since at least February 2023 has systematically routed command-and-control traffic through Cloudflare Pages, Netlify, and Render — three free-tier hosting platforms whose shared wildcard TLS certificates make per-subdomain blocking operationally impractical without disrupting entire legitimate services.
#njRAT#Bladabindi#free-tierPaaSabuse#AES-encrypteddelivery#.NETReactor#UACbypass#DDNSinfrastructure#VietnamhostingIOCf7 · i1 · d5 · u4MITRE32RegionsUS
APTMembersJun 26, 2026, 20:56 (UTC+9)APT29's 2013 MiniDuke Implant Still Beaconing via Aftermarket Domain in 2026
Sixty-three of 76 antivirus engines correctly identify the 326-kilobyte Windows executable bearing SHA-256 05e4224d4dd4e5fbd381ed33edb5bf847fbc138fbe9f57cb7d1f8fc9fa9a382d as a MiniDuke Stage 3 trojan — yet one of only two sandboxes that processed it returned a 97-percent-confidence verdict of harmless. That split is not a data anomaly. It is the point.
#APT29#MiniDuke#HongKong#sandboxevasion#C2infrastructure#espionage#aftermarketdomain#dynamicanalysisevasionActorsAPT29 · MinidionisIOCf1 · i0 · d1 · u34MITRE12RegionsHK
FILEPublicJun 26, 2026, 18:17 (UTC+9)Fake Chinese PDF App Delivers ValleyRAT to Jordan's Food Sector
A 1,649-kilobyte Windows executable named kvipgui.exe — dressed as "极光PDF" (Aurora PDF), a plausible Chinese productivity application — has been circulating as a ValleyRAT shellcode runner targeting food and beverage organisations in Jordan, according to CTX Team analysis. The binary's most immediate deception is structural: it carries a DigiCert-rooted code-signing certificate issued to Shanghai entity 茉柏枘（上海）软件科技有限公司 that expired on 30 May 2024, yet the PE timestamp reads 29 April 2024 and…
#VoidArachne#ValleyRAT#foodandbeveragesector#Jordan#code-signingcertificateabuse#shellcoderunner#C2infrastructure#sandboxevasionActorsVoid Arachne · Silver FoxIOCf2 · i1 · d0 · u0MITRE26RegionsJOIndustriesFood & Beverages