APT
242 stories
APTMembersNov 7, 2026, 09:41 (UTC+9)DLL loader tests coincide with logger write, but attribution is unresolved
A sandbox report for a Windows DLL records a write of 0 to the Status value under Circular Kernel Context Logger. The same report shows a DLL-testing process launching rundll32.exe with named functions from the submitted file. That combination raises a consequential question: did the DLL interfere with system logging, or does the report contain two observations whose relationship remains unresolved?
#WindowsDLL#sandboxanalysis#DLLfunctioninvocation#registrymodification#systemlogging#possiblelogginginterferenceActorsSafePayIOCf1 · i3 · d0 · u8MITRE18RegionsPK
APTMembersNov 6, 2026, 17:41 (UTC+9)Registration calls wrote COM values despite a separate DLL error
Three COM class registrations were set to point to funoictl.dll on a sandbox desktop. In the same sandbox report, a separate invocation of that DLL produced a Windows error-reporting process. Did the component fail to do anything useful, or had it already made a consequential change? The evidence supports a more specific answer: the DLL’s registration-related invocations produced concrete registry writes, while a different invocation encountered an error.
#COMregistration#InprocServer32#registrywrites#DLLself-registration#sandboxanalysis#WindowsErrorReportingActorsInfy · Prince of PersiaIOCf22 · i7 · d1 · u0RegionsUSIndustriesRetail
APTMembersNov 6, 2026, 01:36 (UTC+9)Missing pages still reveal a recurring destination for a Windows executable
A Windows executable’s sandbox reports repeatedly recorded requests to area.wthelpdesk.com, using changing directory names and .htm filenames. Yet the responses differed sharply: one report showed missing pages, another redirects mixed with HTML responses, and a third a successful HTTP response with a cookie. What, exactly, was this host doing for the file? The evidence assembled by CTX Threat Intelligence establishes a recurring network destination, not a demonstrated command channel.
#Windowsexecutable#Sandboxanalysis#HTTPrequests#DNSresolution#WebcacheartifactsActorsRed Apollo · PotassiumIOCf1 · i0 · d1 · u7MITRE8RegionsMYIndustriesGovernment
APTMembersNov 5, 2026, 09:29 (UTC+9)Created SysWOW64 executable runs under services.exe at System integrity
An executable created under C:\Windows\SysWOW64 appears in a process-creation event with services.exe as its parent and System integrity. In sandbox reports for the submitted sample, requests also reach a resolver’s web interface to ask for TXT records beneath two .xyz domains. These observations raise a more useful question than whether the domains look suspicious: what does the executable actually establish on the host, and what information does it seek from DNS?
#SysWOW64execution#Service-contextexecution#DNSqueries#TXTrecords#Webresolver#SandboxanalysisActorsGold Evergreen · Business ClubIOCf5 · i1 · d7 · u2RegionsUS
APTMembersNov 3, 2026, 09:38 (UTC+9)WinAuthority run requests point to an activity-reporting endpoint
WinAuthority.exe sent an HTTP request describing its own activity: action=run, app=winauth and a module version matching the executable’s reported file version. Three sandbox reports captured the same request structure at s.91toolbox.com/winauth, with different identifier-like values. The question is not simply whether the utility contacted an external server, but what that exchange reveals about the server’s role.
#WinAuthority#Windowsexecutable#activityreporting#HTTPrequests#sandboxanalysis#browsercacheartifactsActorsAPT28 · StrontiumIOCf7 · i9 · d5 · u2MITRE22
APTMembersNov 2, 2026, 17:37 (UTC+9)Service path links a placed executable to auto-start execution
An executable named gbifebxy.exe appears beneath services.exe in a sandbox process tree. In the same report, a Windows service’s ImagePath points to that filename inside a newly named system-directory folder. The service-creation command gives it the display name “wifi support.” Is this simply a file being run, or an installation mechanism intended to keep it running? The records support the second interpretation.
#Windowsservices#Auto-startservices#Serviceinstallation#Sandboxanalysis#Mail-servercontact#OutboundtrafficActorsSmoky SpiderIOCf2 · i1 · d0 · u1MITRE33RegionsUSIndustriesRetail
APTMembersOct 31, 2026, 01:56 (UTC+9)Matching class ID links DLL’s browser setting to COM registration
A process loading Deals Plugin Extension.dll wrote a value named CrossriderApp0021806 beneath Windows’ Browser Helper Objects registry branch. The same class identifier appeared in COM registration keys recorded during the DLL’s sandbox analysis. That combination raises a more useful question than whether the file’s name looks suspicious: what role was this component configuring itself to play in the browser? The records examined by CTX Threat Intelligence support a specific answer.
#BrowserHelperObjects#COMregistration#Windowsregistry#browserextensions#NSISinstaller#sandboxanalysis#DNSlookupActorsDarkHotel · Fallout TeamIOCf51 · i0 · d2 · u9RegionsCA
APTMembersOct 30, 2026, 09:31 (UTC+9)DLL traffic and sandbox alerts converge on reported C2 endpoints
A sandbox report for a Windows DLL records an HTTPS GET to 162.244.80.68:443/rXpAvLRK and an HTTP 200 response. A separate analysis of the same file records TCP traffic to that endpoint, while a network alert identifies the destination as a Feodo Tracker–reported command-and-control server. Together, these observations raise a more useful question than the file’s application-style name: how much of its role can be established from the execution and traffic records?
#WindowsDLL#sandboxanalysis#DLLloading#regsvr32#HTTPStraffic#command-and-controlalertsActorsLazarus Group · Hastati GroupIOCf1 · i5 · d0 · u6MITRE25RegionsRO
APTMembersOct 28, 2026, 14:49 (UTC+9)VAUX-COM package extraction accompanies UAC-policy write
A Windows executable associated with a VAUX-COM software package appears in a sandbox record that sets the User Account Control policy value EnableLUA to zero. Other records show files being unpacked into a VAUX-COM directory and network alerts involving two web addresses ending in logo.gif. That combination raises a more useful question than whether the installer’s name looks suspicious: how much of the observed activity can ordinary package extraction explain?
#Windowsexecutable#RARself-extractingarchive#UACpolicy#registrymodification#filevisibilitysettings#Sality-relatedsignatures#networkalertsActorsTA505 · Hive0065IOCf30 · i2 · d4 · u16MITRE51RegionsES · GB · RO · RS
APTMembersOct 28, 2026, 11:10 (UTC+9)Spreadsheet drops executable content disguised as a document
An Excel spreadsheet’s sandbox report records a file called System.doc in a user-profile .templates directory. Despite its document extension, the file is a Windows executable—and its SHA-256 matches a separately analysed sample called System Manager.exe. The same spreadsheet report records an HTTP request to offlineearthquake.com, a hostname also used in the executable’s independent analysis.
#spreadsheetanalysis#executablemasquerading#droppedfile#hashmatching#HTTPrequests#sandboxanalysisActorsOilRig · APT34IOCf4 · i0 · d1 · u1MITRE10RegionsUSIndustriesRetail
APTMembersOct 27, 2026, 09:10 (UTC+9)Text-suffixed path appears in service setting and execution argument
A process named Remote Data.exe was launched by a Windows service host with a numbered .txt file as its argument. The process metadata identified its original filename as RUNDLL32.EXE, while a separate registry event pointed the “Remote Data” service’s ServiceDll setting at the same text-suffixed path. The question is not simply whether the filename looks suspicious: what role was this apparent document playing in service-related execution?
#Windowsservices#ServiceDll#Rundll32-styleexecution#Runkeypersistence#Configurationextraction#SpreadsheetfilecreationActorsAPT28 · StrontiumIOCf24 · i2 · d0 · u0MITRE35RegionsUSIndustriesRetail
APTMembersOct 26, 2026, 10:19 (UTC+9)Archive analysis links extracted EXE to standalone sample by hash and launch
Three HTTPS POST requests went to three IP addresses on nonstandard ports, using paths that looked like application-management APIs. All three received HTTP 502 responses. What connects those requests to AEDT.zip, an archive whose sandbox report shows an executable being unpacked and launched? The strongest answer is not a shared filename or a malware label. The archive produced an AEDT.exe whose SHA-256 exactly matches the separately analyzed executable that generated the HTTP records.
#malwareanalysis#archiveextraction#executableexecution#outboundHTTPSrequests#networkindicators#sandboxanalysisActorsSafePayIOCf2 · i3 · d0 · u8MITRE12RegionsJO · PKIndustriesGovernment
APTMembersOct 25, 2026, 05:30 (UTC+9)Serviceamd10 launcher drops and starts a separate XMRig executable
A Windows executable placed three files in C:\Windows\Serviceamd10\: another executable, a configuration file and a WinRing0 driver. Sandbox process trees recorded the new executable running as its child. The important question is not simply whether “Serviceamd10” is a miner, but what the original file puts into operation—and whether the accompanying driver remains on disk or is actually loaded. The records examined by CTX Threat Intelligence support a concrete answer.
#XMRig#WinRing0#Windows#minerlauncher#driverload#sandboxanalysisActorsSalty Spider · KuKuIOCf8 · i1 · d1 · u7MITRE13RegionsUS
APTMembersOct 23, 2026, 19:09 (UTC+9)Two payloads, not a numbered sequence, emerge from sandbox records
Two temporary executables appear as sibling processes beneath the same submitted file. One is connected to a running TiWorker.exe; the other is connected by its hash to svhost.exe in a user’s Startup folder. The important question is not simply whether those names look suspicious, but whether they represent separate programs, renamed copies, or successive steps in one execution chain.
#sandboxanalysis#payloadinstallation#Startupfolderpersistence#Run-keypersistence#system-likefilenames#processrelationshipsActorsSnowglobe · Animal FarmIOCf3 · i2 · d0 · u1MITRE43RegionsGB · ZAIndustriesGovernment
APTMembersOct 23, 2026, 06:22 (UTC+9)Configured C2 address also appears in a separate sample’s HTTP POST
A sandbox recorded an HTTP POST to http://host-host-file8.com/, a URL also identified as a command-and-control endpoint in configuration extracted from a different executable. That overlap raises a concrete question: was the address merely present in malware configuration, or did an analyzed program actually use it? The records supplied to CTX Threat Intelligence support the latter, at the level of the sandbox report.
#SmokeLoader-familyconfiguration#HTTPPOST#C2configuration#DNSresolution#AppDatafilewrite#Remote-threadcreationActorsBarium · Wicked SpiderIOCf19 · i0 · d4 · u2MITRE20RegionsPK
APTMembersOct 22, 2026, 09:29 (UTC+9)Netsh commands target firewall rules matching wire and upWire service names
Two recorded Windows process-creation events invoke netsh to delete firewall rules named wire and upWire. Separately, the associated file profiles report Windows service locations bearing those same names. The match raises a more specific question than a generic firewall alert: was software managing its own network rules, or was an unauthorized change being made to the host’s controls?
#firewall-ruledeletion#netsh#Windowsservices#processcreation#codesigning#certificaterevocationActorsCactus · Cactus Ransomware GroupIOCf11 · i14 · d6 · u1MITRE17IndustriesEducation & Research · Government
APTMembersOct 21, 2026, 17:36 (UTC+9)AppPatch svchost.exe execution is tied to a Winlogon launch setting
A process named svchost.exe ran from C:\Windows\AppPatch\svchost.exe, with another svchost.exe in a Downloads directory recorded as its parent. A separate registry event placed the AppPatch executable’s path alongside userinit.exe in a Winlogon setting. The combination raises a more consequential question than whether a filename looks suspicious: was this system-looking location also being made a future launch point?
#processmasquerading#Winlogonregistrymodification#logonpersistence#AppPatchexecutable#HTTPrequests#DNScorroborationActorsEmotet Group · TA542IOCf2 · i3 · d56 · u16MITRE27RegionsUSIndustriesRetail
APTMembersOct 20, 2026, 09:35 (UTC+9)Mail hostname has a historical HTTPS footprint, not a malware link
The hostname turing.lru.li appears in two different roles in records reviewed by CTX Threat Intelligence: as a mail exchanger for lru.li, and as the name on an HTTPS certificate observed at 49.12.115.177. That match gives the IP a specific investigative context. But does it identify a mail server used by the malicious executable supplied alongside these records? The evidence supports a narrower finding.
#Mailinfrastructure#MXrecords#HTTPScertificates#DNS#Maliciousexecutable#InfrastructureanalysisActorsLazarus Group · Hastati GroupIOCf67 · i9 · d5 · u0RegionsUSIndustriesRetail
APTMembersOct 19, 2026, 18:16 (UTC+9)Dropped-file hash links outer installer to an executed inner installer
An executable running as setup.exe wrote update.exe into a Downloads directory and appeared as its parent in a sandbox process tree. The important detail was not the update-themed filename: the written file’s SHA-256 matched a second executable that had been analysed independently as an installer. Was this merely a bundle of similarly named files, or could the records show how one installer operated inside another? CTX Threat Intelligence’s records support the latter.
#Nestedinstallers#Droppedexecutables#Processtrees#Hashmatching#Temporaryexecutables#MSIpackages#Mining-poollookupActorsVoid Arachne · Silver FoxIOCf16 · i4 · d2 · u1RegionsBR
APTMembersOct 19, 2026, 03:02 (UTC+9)Dropped-file hash links two samples beyond a shared HTTP endpoint
Two executable samples produced HTTP POST requests to the same IP address and PHP path in sandbox analyses. That overlap could have been just a shared destination. But the file records reveal a stronger relationship: analyses of one executable recorded a dropped file whose SHA-256 exactly matches the other. What role did that delivered code play—and how much of its operation can the records actually reconstruct?
#Amadey-associatedpayload#sandboxanalysis#dropped-filedelivery#HTTPcommandandcontrol#Run-keypersistence#scheduled-taskmodificationActorsTA505 · Hive0065IOCf10 · i1 · d0 · u2MITRE38RegionsPK
APTMembersOct 18, 2026, 09:36 (UTC+9)Recurring C# source links local compilation across malware analyses
A process reported as Microsoft’s MSBuild.exe launched Chrome with headless mode, remote debugging on port 9223, and the browser’s existing Default profile selected. In the same malware sample’s analysis record, MSBuild also appears in outbound connection events to an address recovered from memory as a command-and-control endpoint. Why is a build tool appearing at both the browser and network boundaries?
#Windows.NET#C#compilation#MSBuild#headlessbrowser#remotedebugging#C2configuration#malwareanalysisActorsScully Spider · TA547IOCf13 · i1 · d0 · u2MITRE18RegionsPK
APTMembersOct 15, 2026, 15:24 (UTC+9)Different filenames hide one executable in launcher process tree
A program recorded as 0CA02BB80457.exe produced a file named conhost.exe in a Windows Error Reporting temporary directory. The sandbox’s process tree placed that file beneath the original program—and placed an AppData svchost.exe beneath conhost.exe. Were these separate components, or the same executable operating under different names? The hashes change the interpretation.
#Windowsmalware#launcher#processmasquerading#Runkeypersistence#sandboxanalysis#DNSlookupActorsAPT27 · TEMP.HippoIOCf10 · i1 · d4 · u8
APTMembersOct 14, 2026, 23:12 (UTC+9)Startup report, not just a Telegram connection
A Windows executable recorded in a CAPE sandbox report made a Telegram API request announcing “[CLIPPER STARTED]” and carrying details of its execution environment. The message described a “FIRST RUN” and claimed “STEALTH MODE ACTIVE.” But what did the program actually do beyond announcing itself? The records supplied to CTX Threat Intelligence give a more concrete answer than those self-descriptions.
#Windowsexecutable#TelegramAPI#startupreporting#Runkeypersistence#scheduledtask#firewallrule#eventlogclearingActorsComment Crew · Byzantine CandorIOCf4 · i1 · d1 · u0MITRE19RegionsSG
APTMembersOct 14, 2026, 07:13 (UTC+9)Three DLL C2 URLs share a path, but not evidence of contact
Three web addresses extracted from a Windows DLL end in the same path, /8/forum.php, and all are designated as command-and-control endpoints. That gives the addresses a concrete relationship: they belong to one sample’s configuration. But do they also describe three servers that the malware reached, or even three services operating together? The evidence reviewed by CTX Threat Intelligence supports a more specific finding.
#WindowsDLL#HTTPC2#malwareconfiguration#DNSinfrastructure#JARMfingerprint#sandboxanalysisActorsTA511 · MAN1IOCf1 · i0 · d3 · u6RegionsRO
APTMembersOct 13, 2026, 15:19 (UTC+9)Configured domains appear in POST requests, alongside local file changes
A Windows executable contacted two domains named in its extracted configuration, while a separate sandbox report tied an unusual file suffix to README files, an icon and Windows file-association settings. Those observations raise a more useful question than whether the sample is malicious: how do its outward communications relate to the changes it makes locally? The records examined by CTX Threat Intelligence support two complementary roles.
#DarkSide#ransomware#HTTPSPOSTrequests#command-and-controlconfiguration#Windowsfileassociations#VolumeShadowCopyActorsDarkside · Gold WaterfallIOCf87 · i0 · d1 · u3MITRE37RegionsRO
APTMembersOct 12, 2026, 23:15 (UTC+9)A familiar process name becomes a specific logon target
The path %WINDIR%\rss\csrss.exe appears in several roles in the analysis record: as a file on disk, an execution target, a logon launch setting and the target of a scheduled-task creation command. The Windows Defender exclusion writes also reference the rss directory and the name csrss.exe. Why does this particular path recur across otherwise different kinds of activity? The strongest answer is that it anchors an attempted foothold, rather than merely giving a suspicious file a familiar name.
#system-processmasquerading#logonpersistence#scheduledtasks#Defenderexclusions#auxiliaryexecutable#TorarchiverequestActorsBarium · Wicked SpiderIOCf5 · i0 · d2 · u0MITRE46RegionsSA
APTMembersOct 10, 2026, 23:13 (UTC+9)Sandbox links written executable to logon target, records port-25 contacts
A sandbox report records daxixreameam.exe being written into a Windows user profile and a user-logon registry entry pointing to that same path. That relationship makes the filename more than an incidental artifact: it was both a recorded file-write destination and the target of a launch setting. But what was the executable being positioned to do? Separate network observations for the submitted sample show outbound contacts on TCP port 25, the port used by SMTP servers.
#Windowsexecutable#Runkey#User-logonpersistence#OutboundSMTPconnections#HTTPPOST#DNSlookupActorsPinchy Spider · SodinokibiIOCf2 · i4 · d10 · u11RegionsDE · USIndustriesRetail
APTMembersOct 10, 2026, 07:26 (UTC+9)Matching subdomains point to different CNAME targets
Two domains carry the same pair of subdomain labels: yzzcommon and 69f335c8397887d4. That repeated structure raises a concrete question: were the domains interchangeable routes to the same destination? DNS records supplied to CTX Threat Intelligence support a parallel naming scheme, but not a single demonstrated backend. The distinction matters because a useful infrastructure link can otherwise become an unsupported claim about redundancy or malware delivery.
#DNS#CNAMErecords#subdomains#nameservers#infrastructureanalysisActorsGold Evergreen · Business ClubIOCf5 · i1 · d7 · u2RegionsUSIndustriesRetail
APTMembersOct 8, 2026, 23:52 (UTC+9)Executable’s batch file launched multiple PowerShell script requests
A Windows executable launched a temporary batch file whose child PowerShell processes named several remote script URLs. In a separate analysis, a Windows shortcut launched the same PowerShell command aimed at one of those URLs, http://marketprice.pk/zxcvb.ps1, and its sandbox recorded a DNS lookup for the domain. What connects the two files: a direct handoff, or a shared way of retrieving and executing code?
#Windowsexecutable#Windowsshortcuts#PowerShell#batchfiles#scriptretrieval#commandobfuscation#DNSlookupActorsPatchwork · ChinastratsIOCf12 · i0 · d5 · u6MITRE31RegionsUSIndustriesRetail
APTMembersOct 8, 2026, 07:20 (UTC+9)Loader drops two distinct programs disguised as Windows processes
A loader placed two executables named svchost.exe and conhost.exe on disk, and sandbox records show both running from a Windows Error Reporting temporary directory. Their familiar names raise a practical question: were these Windows components participating in an application’s execution, or separate programs borrowing Windows identities? The evidence collected by CTX Threat Intelligence supports the second interpretation.
#loader#Windowsprocessmasquerading#droppedexecutables#temporary-directoryexecution#AppDataexecution#RunkeypersistenceActorsAPT27 · TEMP.HippoIOCf9 · i1 · d0 · u0MITRE43RegionsBR · CO · EG · FRIndustriesRetail
APTMembersOct 6, 2026, 23:14 (UTC+9)Matching hash gives update.exe a second location—and Startup significance
A Windows executable appears in a sandbox report at %USERPROFILE%\AppData\Local\Start\update.exe, with exactly the same SHA-256 as the file submitted for analysis. A registry event associated with that sample records another important change: the user’s Startup folder is set to %USERPROFILE%\AppData\Local\Start. Why put the executable there? The folder’s role in the user’s configuration offers a more consequential explanation than its ordinary-looking name.
#Windows#logonpersistence#Startupfolder#registrychanges#Explorersettings#sandboxanalysisActorsSalty Spider · KuKuIOCf17 · i1 · d2 · u5MITRE23RegionsAU · IT · TR
APTMembersOct 5, 2026, 15:15 (UTC+9)Named firewall-rule deletion commands match two service artifacts
Two recorded Windows processes were launched with instructions to delete firewall rules named upWire and wire. Those same names appear in service-registry artifacts associated with two executables that share a code-signing certificate. The connection raises a more specific question than whether a firewall alert fired: was software managing rules associated with its own service components, or changing protections for another purpose?
#Windowsfirewallrules#ruledeletioncommands#service-registryartifacts#code-signingcertificate#processcreation#configurationchangesActorsSpace Pirates · WebwormIOCf20 · i9 · d6 · u2MITRE18
APTMembersOct 4, 2026, 10:53 (UTC+9)Sandbox records IP lookup and requests for two server-hosted text files
A Windows executable’s sandbox report records requests to an external-IP lookup service and to two text-file paths on 178.16.54.109. The distinction matters: one destination has an identifiable address-discovery role, while the other is a concrete source of requested remote resources. What, exactly, did the program seek from that IP-hosted server—and does the report connect those requests to the executable files written locally?
#Windowsmalware#sandboxanalysis#HTTPrequests#remoteresources#droppedexecutable#registrychanges#security-policytamperingActorsTurla · Iron HunterIOCf24 · i3 · d3 · u1RegionsUSIndustriesRetail
APTMembersOct 1, 2026, 14:27 (UTC+9)2017 NSA Leak Still Builds a Working Kill Chain in 2024
Twenty files anchor this record, and on paper they should belong in a digital history archive rather than a live detection feed: EternalBlue exploitation code, the DoublePulsar kernel implant, and its sturdier successor DarkPulsar, all pulled from the Equation Group toolkit that the ShadowBrokers dumped onto the public internet in April 2017. These are not forensic curiosities sitting dormant in a vendor's sample library.
#EternalBlue#DoublePulsar#DarkPulsar#ShadowBrokers#masscan#APT40#APT39#RaspiteActorsRaspite · LeafminerIOCf50 · i0 · d1 · u2MITRE59RegionsUSIndustriesRetail
APTMembersSep 30, 2026, 22:26 (UTC+9)Fake 'Jerusalem Brochure' PDF Hides Anti-Debug Spyware Dropper
A Windows dropper built to look like a conference handout — internally named "Brochure-Jerusalem_26082019_pdf.exe" — checks whether anyone is watching it before it does anything else, and only then reaches out to a domain registered ten weeks before the sample was analyzed. The file (284a0c5c…dbd01) carries a matching PDF resource path inside it, reads the CPU clock directly to spot a sandbox, installs itself to survive a reboot, and calls out over WMI to spread to other machines on the same…
#AridViper#DesertFalcons#MICROPSIA#WMIpersistence#sandboxevasion#telecomsector#Palestinianterritories#disposableC2infrastructureActorsAPTC23 · Two-tailed ScorpionIOCf4 · i1 · d1 · u1MITRE36RegionsPSIndustriesTelecommunications
APTMembersSep 29, 2026, 22:28 (UTC+9)Pikabot Loader Wears a Revoked Bitdefender Certificate
A Pikabot infection chain built around a single ZIP archive and its embedded executable is offering a clean look at how one loader family stages, disguises, and calls home in the same breath. The archive — 623KB, delivered under the filename pattern 557390-1743605714.zip — sits and waits: its own behavioral tags mark it as something that "waits for user interaction before running" before it unpacks a single Portable Executable weighing in at 1,459,816 uncompressed bytes.
#Pikabot#SafePay#Bitdefenderspoofing#revokedEVcertificate#Jordangovernment#Let'sEncryptrotation#TrickBotJA3signatures#commodityloaderActorsSafePayIOCf2 · i5 · d0 · u12MITRE12RegionsJOIndustriesGovernment
APTMembersSep 28, 2026, 14:28 (UTC+9)A 2010 Worm Still Trips a Live Tofsee Fingerprint — and Now It's Hauling a Miner
A Sality-lineage dropper that first surfaced in mid-2010 is still active enough to trip a live malicious-JA3 detection tied to Tofsee command-and-control infrastructure, and in the same indicator set it turns up alongside a matched XMRig mining kit — an executable and its configuration file staged through identical randomized-hex Temp folders — plus two low-detection payloads disguised as image files.
#Salityworm#Tofsee#XMRig#SaltySpider#cryptomining#malxmr#hostinginfrastructure#masqueradingActorsSalty Spider · KuKuIOCf26 · i5 · d4 · u3RegionsUSIndustriesRetail
APTMembersSep 27, 2026, 22:41 (UTC+9)Hidden Excel4 Macro Resurfaces, Drops Emotet Loader with Dridex-Linked JA3
A hidden-macrosheet spreadsheet submitted just eight days before this analysis, on 2026-09-19 (f2f0b898…), reconfirms one of the oldest tricks still working in commodity malspam: burying an Excel4 auto-open macro inside a sheet the workbook itself keeps hidden from the user. What makes this snapshot notable isn't the delivery mechanism — that has been documented in this campaign before — but what it hands off to.
#Emotet#Excel4macros#Zenpak#DridexJA3#hiddenmacrosheet#USretail#loadermalware#TA542ActorsEmotet Group · TA542IOCf5 · i3 · d1 · u6RegionsUSIndustriesRetail
APTMembersSep 27, 2026, 06:30 (UTC+9)Six Droppers, One Codebase: The Masquerade Behind FreeEIM and RuntimeBroker
A cluster of six Windows binaries surfacing under names like "RuntimeBroker" and "FreeEIM" turns out to be the same Gh0st RAT-lineage codebase wearing five different vendor labels — farfli, zegost, mulinex, dump, and killmbr — a fragmentation that has less to do with new malware and more to do with how detection taxonomy handles a code family that refuses to die.
#SaltySpider#Gh0stRAT#FreeEIM#RuntimeBroker#farfli#rootkitdriver#certificateblocklist#USretailActorsSalty Spider · KuKuIOCf19 · i1 · d0 · u0MITRE35RegionsUSIndustriesRetail
APTMembersSep 26, 2026, 14:33 (UTC+9)A Decade-Old Fareit/Pony Stealer Still Fires the Same Signatures
A Windows executable flagged by 67 of 76 engines checks in over HTTP using traffic patterns that intrusion-detection vendors have signatured for more than ten years — not because the operators built something new, but because they didn't need to. The file (hash prefix 8feae039…) carries the threat label trojan.fareit/tepfer and the popular names fareit, tepfer, and stealer, and it fires three named YARA rules, including Elastic Security's Windows_Trojan_Pony_d5516fe8 and the Malpedia signature…
#GorgonGroup#Subaat#Fareit#Ponystealer#credentialtheft#sandboxevasion#domaindrop-catching#RomaniaActorsGorgon Group · SubaatIOCf2 · i0 · d5 · u2MITRE27RegionsRO
APTMembersSep 26, 2026, 06:30 (UTC+9)Same AutoIT Toolkit Links 2021 Droppers to 2024 Excel Lures
A dropper wave built in mid-2021 and an Excel-lure campaign built in October 2024 have almost nothing in common on the surface — different file formats, different lure themes, three years of separation — except that both fire the same YARA rule for AutoIT scripting. That single recurring signature, tying a 2021 downloader (164e93724abba0dd…) to a 2024 Office add-in (7acc59a5ff51435e…), is the most durable thread running through a file set that CTX Team has been tracking under the tag Operation…
#OperationBlackAtlas#RedLineStealer#ClipBanker#AutoIT#DiscordCDNabuse#SingNetinfrastructure#credentialtheft#malwaremasqueradingActorsOperation Black AtlasIOCf18 · i3 · d3 · u8RegionsUS
APTMembersSep 24, 2026, 15:31 (UTC+9)Decade-Old Tofsee Payload Masquerades as Windows Driver partmgr.sys
A 10,878-kilobyte Win32 executable circulates under the file path of a legitimate Windows disk-partition driver — c:\windows\system32\drivers\partmgr.sys — while its delivery names rotate through disposable installer strings such as 89UlgiO5LXmpwSOaII.exe and 8krHNSKndIeDU5GFnJECrkOs.exe. VirusTotal resolves the binary (456d4a6d6f…, hereafter the partmgr.sys impersonator) to trojan.tofsee/dump, and 65 of 76 antivirus engines currently flag it.
#Tofsee#Smokeloader#masquerading#sandboxevasion#wormpropagation#AS132825#Let'sEncryptcertificate#commoditymalwareActorsSmoky SpiderIOCf2 · i1 · d0 · u1MITRE33RegionsCH · NLIndustriesSupport Services · Technology
APTMembersSep 23, 2026, 14:28 (UTC+9)Russian-Registered AS213010 Has Hosted C2 Since 2019
The most durable artifact in this record isn't a binary or a certificate — it's a network. Autonomous System 213010, registered to an entity RIPE lists as "Gening Nikita Dmitrievich," has hosted at least two IP addresses that anchor domains registered three years apart: 87.251.75.204, which carries a domain first registered on 2023-09-20 (poolfreshstep.com), and 80.66.76.210, which is fronting a domain that was only 14 days old when this record closed (bunnysecurityrelay.com, created…
#VoidArachne#SilverFox#CobaltStrike#AS213010#NICENIC#Cloudflare#piratedsoftwarelure#infrastructurereuseActorsVoid Arachne · Silver FoxIOCf17 · i3 · d4 · u2RegionsBRIndustriesEngineering
APTMembersSep 21, 2026, 06:32 (UTC+9)Cracked-Software Lure Network Runs on Expired EV Cert, Shared Hosting
Three files sitting in the same threat record advertise themselves as ordinary utility software — a network scanner, a product activator, a WhatsApp data-transfer tool — and all three are wrapped in commercial anti-analysis packing strong enough to blunt most of the engines that inspect them. That combination, not the actor label attached to the record, is the actual story here.
#crackedsoftwarelures#codesigningabuse#VMProtectpacking#maliciousdomaininfrastructure#CloudflareDNSpivot#attributionmismatch#AdvancedIPScannerimpersonation#certificaterotationActorsLockbit GangIOCf3 · i0 · d5 · u0MITRE6IndustriesContainers & Packaging
APTPublicSep 20, 2026, 22:41 (UTC+9)Fake Skype Installer Ran a Full Espionage Chain for a Decade
A Win32 executable that calls itself Skype.exe, carries Skype's product name and a "© 2003-2012 Skype and/or Microsoft" copyright string, and still ships completely unsigned has been circulating in low volumes for more than a decade — first submitted for scanning in October 2014, most recently as March 2025. The file (b6ca1211…8f518a403) is flagged by 61 of 78 engines, a strong consensus that has held steady across its long life.
#Molerats#GazaCybergang#AridViper#Skypemasquerade#trojanizedinstaller#anti-analysisevasion#DNSbeacon#espionagemalwareActorsMolerats · Gaza CybergangIOCf1 · i0 · d1 · u1MITRE9RegionsCN · HKIndustriesRetail
APTMembersSep 20, 2026, 14:29 (UTC+9)Fake WebView2 DLL Stalls Sandboxes to Outwait Detection
A DLL calling itself WebView2Loader.dll — the file Microsoft's own browser-embedding runtime uses on tens of millions of Windows machines — turns out to be a 3,544KB Win32 payload that checks for an attached debugger, stalls execution for long stretches, waits for a human to actually touch the keyboard, and probes the BIOS before doing anything else.
#WebView2masquerade#SalatStealer#Vidar#Snowglobe#Varistpacker#sandboxevasion#Let'sEncryptcertificaterotation#retailsectortargetingActorsSnowglobe · Animal FarmIOCf45 · i2 · d1 · u2RegionsUSIndustriesRetail
APTMembersSep 20, 2026, 06:28 (UTC+9)VPN Trojan Trio Shares Revoked EV Signature, Clears Sandbox Despite Flags
Three Windows binaries branded as pieces of a consumer VPN client — a small stub called wire.exe, a much larger DLL called wire.dll, and a standalone installer called upWire.exe — all carry the identical publisher chain: WEILAI NETWORK TECHNOLOGY CO., LIMITED, chained up through GlobalSign GCC R45 EV CodeSigning CA 2020 to GlobalSign's root.
#Cactus#ramnitActorsCactus · Cactus Ransomware GroupIOCf33 · i5 · d9 · u2MITRE20
APTMembersSep 19, 2026, 22:37 (UTC+9)Same Packer, Four Years: Gh0st RAT Toolchain Refuses to Retool
Three Farfli/Gh0st droppers submitted four years apart — one first seen in April 2022, two more that surfaced fresh on September 18, 2026 — carry the identical PEiD packing signature and trip the same Elastic-authored detection logic, a rule called Windows_Trojan_Generic_9e4bb0ce. That kind of toolchain stasis, more than any single new sample, is the story in this cluster: an operator that built a packer wrapper and a Gh0st-derivative payload once and has evidently seen no operational need to…
#SaltySpider#Gh0stRAT#Farfli#rootkitdriver#code-signingcertificateabuse#sandboxevasion#credentialdumping#commandandcontrolinfrastructureActorsSalty Spider · KuKuIOCf14 · i0 · d1 · u3MITRE30RegionsUSIndustriesRetail
APTMembersSep 18, 2026, 23:05 (UTC+9)Aged 2018 Domain Repointed to Fresh Emotet C2 in Turkey
A domain registered back in April 2018 — long enough to have aged out of any registrar-freshness scrutiny — currently resolves to a command-and-control IP that was flagged for the first time on 2026-09-18. The domain is atici.net, and its single A-record points to 185.15.196.157, a Turkish address on AS201520 (Dedicated Telekomunikasyon Teknoloji Hiz. Tic. San. LTD. STI., Istanbul) that carries a Let's Encrypt certificate minted only weeks earlier.
#Emotet#TA542#Excel4macro#command-and-controlinfrastructure#Let'sEncryptcertificates#domainagelaundering#Turkishhosting#retailsectortargetingActorsEmotet Group · TA542IOCf1 · i2 · d3 · u2RegionsUSIndustriesRetail
APTMembersSep 17, 2026, 06:29 (UTC+9)One Blank TLS Certificate Links Four Unrelated Cloud Networks
Thirteen IP addresses spread across a hyperscale social-media company's own network, a discount VPS reseller with points of presence on four continents, and two little-known hosting shells registered in Russia all present the exact same self-signed TLS certificate — serial 1acf3e37b37910d932ea64e6bb27615d6484c07d, with both its issuer and subject fields rendered as the literal string "NONE." That certificate, valid from March 2024 through March 2034, is not the kind of artefact that shows up…
#WireVPN#VPNMaster#codesigningabuse#sandboxevasion#Zenlayer#Bytedanceinfrastructure#self-signedcertificate#commoditymalwaredistributionActorsSpace Pirates · WebwormIOCf70 · i22 · d4 · u0MITRE22