StrongPity Cycles 44 New Files, Keeps Same C2 Domain
New CTX Team tracking of the StrongPity/Patcher cluster against Jordan's food and beverage sector shows 44 file hashes added and 43 dropped since the last look, while the operation's sole tagged domain, apn-state-upd2.com, saw zero change. The split points to a build pipeline outpacing enrichment, not a new operation or infrastructure shift.
Forty-four new file hashes have joined the StrongPity/Patcher toolset tracked against Jordan's food and beverage sector since CTX Team's earlier look at this cluster — yet not one new domain, IP address, or URL appeared alongside them. Forty-three previously catalogued hashes dropped out of the same window. That lopsided arithmetic is the story here: a build pipeline generating and discarding binaries at volume while the delivery and tasking channel behind them sits completely still.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read