Cracked-Software Lure Network Runs on Expired EV Cert, Shared Hosting
Three packed files posing as scanner, activator, and WhatsApp tools — one still wearing an expired EV code-signing chain — trace to five keygen-themed domains sharing a Dynadot registration channel and Cloudflare DNS pivot. The 'Lockbit Gang/espionage' label attached to the record doesn't match any of the actual tradecraft.
Three files sitting in the same threat record advertise themselves as ordinary utility software — a network scanner, a product activator, a WhatsApp data-transfer tool — and all three are wrapped in commercial anti-analysis packing strong enough to blunt most of the engines that inspect them. That combination, not the actor label attached to the record, is the actual story here.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read