Decade-Old Dynu DDNS Pool Found Feeding Live AgentTesla C2
Eleven Dynu-registered domains — some dormant since 2015 — form a durable dynamic-DNS reservoir behind a ConfuserEx-packed .NET dropper sandboxed as AgentTesla. A freshly registered Discord-themed WebSocket endpoint and a certificate pivot to an unrelated Polish IP suggest the infrastructure extends well beyond what's currently visible.
Eleven domains, all registered through the same free dynamic-DNS registrar, all resolving through the same nameserver block — and some of them have sat dormant since 2015. That's the picture emerging from a fresh piece of C2 infrastructure that CTX Team has been tracking since mid-June: a Dynu Systems Incorporated domain reservoir that stretches across two historical registration waves and one very recent addition, feeding a ConfuserEx-packed .NET dropper that a sandbox has tagged as…
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read