Cert-Rotation Pattern, Not APT27, Links PC-Repair Lure Domains
Two lookalike PC-repair domains registered months apart through different registrars both received 89-day Let's Encrypt certificates from the same CA short-name, tying the cluster together far more convincingly than the feed's APT27 attribution or the mismatched AV labels on its shared malware build.
Two lookalike PC-repair domains, registered five months apart through entirely different registrars, were issued near-identical certificates by the same Let's Encrypt authority shortlisted under the CA short-name "YR2" — both carrying 89-day validity windows, both stamped with wildcard subject names pointing at secondary lure brands. mypchub.net, registered through NameCheap, Inc.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read