Expired UltraSurf Certificate Powers Stealthy C2 Campaign Against Finance
A UPX-packed Windows executable trojanising the UltraSurf censorship-circumvention tool — signed with a two-year-lapsed Ultrareach Internet Corp. certificate — is establishing covert tunnels to freshly stood-up Hurricane Electric infrastructure. The layered evasion stack, including sandbox-timing delays and debugger detection, leaves 52 of 76 AV engines blind to the threat while the financial services sector is the explicitly tagged target.
A UPX-packed Windows executable masquerading as the UltraSurf censorship-circumvention tool — signed with a GlobalSign-issued code-signing certificate that expired in June 2024 but still carries enough historical trust to fool the majority of the antivirus ecosystem — is being used to establish covert command-and-control tunnels toward freshly stood-up infrastructure on Hurricane Electric's network.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read