WoodyRAT C2 Expands With Ukrainian Node, Traefik Relay, and .biz Domain Pair

A new Ukrainian C2 node, two Dynadot-registered .biz domains, and a Traefik reverse-proxy relay have been added to the WoodyRAT-attributed infostealer campaign documented in a prior CTX Team report. A shared self-signed wildcard certificate cryptographically binds the Ukrainian node to the .biz domain pair, confirming a single operator is building a layered, geographically dispersed relay architecture. The stealer's collection loop has harvested Exodus wallet seed files and Pidgin credentials from at least one host across a 28-month window, with stolen logs distributed through Telegram bot channels consistent with a log-market resale model.