Twenty Throwaway .xyz Domains Funnel Into One Kronos Panel Path
Twenty algorithmically-named .xyz domains all resolve to the identical '/kronos/connect.php' checkout path, revealing a single reused control-panel template rather than independent infrastructure. The one instrumented payload tied to the cluster is a six-year-old Kronos banking trojan wrapped in a packed .NET loader.
Twenty domains in this record — every one an algorithmically-generated string of consonant clusters under the .xyz top-level domain — resolve, wherever resolution data survives, to the identical checkout path /kronos/connect.php. That is not a coincidence of naming; it is the fingerprint of a single command-and-control panel template stamped across disposable infrastructure rather than the work product of twenty independent operators standing up their own C2.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read