TA505 ServHelper C2 Expands: Three DGA Domains, One Operator Fingerprint
Four new command-and-control domains and eight URLs have been added to the active ServHelper campaign tracked by CTX Team, with no new files. Three algorithmically generated .xyz domains share identical obfuscated WHOIS tokens, uniform 89-day Let's Encrypt certificates, and a common beacon path, while a structurally isolated .cn domain points to a possible second infrastructure tier.
Four new command-and-control domains and eight associated URLs have surfaced in the ongoing ServHelper campaign tracked by CTX Team, extending a C2 infrastructure cluster whose internal consistency is striking in its operational discipline. The new additions — three algorithmically generated .xyz domains and a structurally isolated .cn outlier — carry fingerprints that converge on a single provisioning workflow: identical obfuscated WHOIS registrant tokens, uniform nameserver delegation through…
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read