No Domain, No Problem: Amadey Loader Cluster Skips DNS Entirely
A commodity Amadey/Stealc/Lumma loader campaign routes every stage of delivery and command-and-control through bare IPv4 addresses, with all 13 catalogued indicators resolving to dotted-quad hosts and zero domains. The design choice trades DNS-based takedown exposure for durability, letting operators rotate faster than reputation-based blocking can catch up.
Six files and three IP addresses make up this record, and not one of them ever needed a hostname. Every network indicator in the set — thirteen URLs in total — resolves to a bare dotted-quad address rather than a domain, a detail confirmed by the indicator catalog itself: the domains table carries a header row and nothing beneath it. That is the most concrete signal in this campaign, and it is not incidental.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read