C&C
265 stories
C&CMembersNov 6, 2026, 17:41 (UTC+9)upWire analysis shows attempts to delete two named firewall rules
Two Windows process-creation events record commands to delete firewall rules named upWire and wire. Both invoke netsh.exe through cmd.exe, and both record the new process running at High integrity. The immediate question is not simply whether a firewall command ran, but what removing those particular rules would change: was this software maintaining its own network settings, or interfering with a host’s protection?
#WindowsFirewall#firewallruledeletion#netsh#processcreation#codesigning#serviceartifactActorsCactus · Cactus Ransomware GroupIOCf19 · i25 · d17 · u2MITRE20
C&CMembersNov 6, 2026, 01:37 (UTC+9)Matching TLS services across networks do not establish shared attack control
Two IP addresses in different autonomous systems expose the same HTTPS certificate and the same JARM service fingerprint. The pairing of 101.198.2.228 and 101.91.111.170 raises a useful question: does that match identify common attack infrastructure, or a shared service presentation? The records supplied to CTX Threat Intelligence support the narrower finding. They connect the addresses through specific TLS characteristics, rather than merely through geography or a telecommunications provider.
#TLScertificates#JARMfingerprints#HTTPSservices#Autonomoussystems#Sharedhosting#Server-nameindication#InfrastructureanalysisIOCf1 · i12 · d0 · u0MITRE29
C&CMembersNov 5, 2026, 09:39 (UTC+9)Same-hash executable ran as svchost.exe and gained a logon launch setting
A file recorded as C:\121972984215590\svchost.exe had the same SHA-256 as the executable under examination, appeared beneath that sample in a sandbox process tree, and was named in a registry setting for launch at logon. The combination changes the meaning of the familiar filename: this was not simply a reference to a Windows service host, but the examined executable’s content operating under that name. The same analysis also recorded an HTTP request to 185.215.113.10.
#Phorpiex/Botx#svchost.exedisguise#Runkeypersistence#HTTPrequests#Defenderpolicywrite#securitynotificationchangesIOCf8 · i2 · d0 · u13MITRE32RegionsPK
C&CMembersNov 4, 2026, 17:36 (UTC+9)DNS links two domains to IPs; TLS fingerprints add service context
reihtec.com resolves to 174.138.186.11, and both carry the same recorded JARM TLS-service fingerprint. A second pair, kalteng.net and 45.126.43.3, shows the same combination of an exact DNS relationship and matching fingerprints. These are concrete connections—but do they identify malicious infrastructure, or simply the services behind the names?
#DNSrecords#TLSservices#JARMfingerprints#Hostinginfrastructure#Digitalcertificates#WindowsexecutableActorsPinchy Spider · SodinokibiIOCf2 · i9 · d13 · u9RegionsUS
C&CMembersNov 4, 2026, 02:02 (UTC+9)Two Kryptex entry points converge on one address
Two Kryptex hostnames that appear to offer different entry points lead to the same recorded address. prl.kryptex.network and prl-eu.kryptex.network both resolve to 23.88.2.85, and their profiles contain the same TLS certificate and JARM service fingerprint. That overlap raises a practical question: does the wider collection describe separate servers, regional access points to a service, or a single connected attack infrastructure?
#Crypto-miningservices#DNSrecords#TLScertificates#Regionalendpoints#MiningscriptsIOCf37 · i5 · d9 · u0RegionsAR · BE · BH · BNIndustriesConstruction · Education & Research · Technology
C&CMembersNov 3, 2026, 09:38 (UTC+9)Commands targeted two named firewall rules, but deletion is unconfirmed
Two Windows process events record commands to delete firewall rules named wire and upWire. A separate file record identifies a Windows service location named wire. The shared names raise a concrete question: do these observations show software managing its own service and network settings, or an attempt to weaken a host’s defenses? The evidence supports the first, narrower description of the software’s role, without resolving its intent.
#Windowsfirewallrules#netshcommands#Windowsservices#processcreation#codesigning#serviceconfigurationActorsAPT28 · StrontiumIOCf6 · i20 · d30 · u3MITRE32
C&CMembersNov 2, 2026, 17:42 (UTC+9)Hostname resolves to two IPs; fingerprint match is only a lead
The hostname 1818706573.cdn.123clouddisk.com shares a recorded TLS service fingerprint with 61.174.8.171, yet its supplied DNS answers point to two different addresses. That mismatch raises the central question: does the fingerprint identify another destination for the hostname, or simply a service worth comparing? CTX Threat Intelligence’s records establish a DNS relationship to the two returned addresses and a separate fingerprint similarity to the listed IP.
#DNSresolution#Arecords#CNAMErecords#TLScertificates#JARMfingerprints#Hosteddeliveryinfrastructure#Command-and-controlassessmentActorsUAC-0063 · TAG-110IOCf0 · i2 · d1 · u3MITRE10
C&CMembersNov 2, 2026, 01:38 (UTC+9)Update-request context complicates a Tofsee TLS fingerprint alert
A TLS fingerprint alert attached to a Windows executable identifies a connection as “Tofsee,” but its destination also appears in a sandbox report resolving armmf.adobe.com and retrieving MSI content. Does that make the address malware infrastructure—or show why a network signature needs the surrounding request evidence? The records reviewed by CTX Threat Intelligence support a narrower, more useful finding: the alert identifies a fingerprint match, while the sandbox supplies evidence…
#TLSfingerprinting#JA3#DNS#HTTPrequests#MSImanifests#rundll32.exe#process-linkednetworkactivityActorsSalty Spider · KuKuIOCf16 · i1 · d6 · u25RegionsTHIndustriesTelecommunications
C&CMembersNov 1, 2026, 09:49 (UTC+9)Bank-themed domain points web and mail records to one IP
spectratrustbank.com points to 66.29.156.99, names itself as its mail destination, and explicitly includes that same IP address in its email sender policy. The relationship raises a more useful question than the bank-themed name alone: does the evidence establish a working phishing service, or infrastructure configured to support web and mail services? CTX Threat Intelligence’s records establish the configuration, not its use.
#Phishingclassification#Bank-themeddomain#DNSconfiguration#Mailinfrastructure#SPFpolicy#TLScertificatesActorsCactus · Cactus Ransomware GroupIOCf0 · i20 · d123 · u14IndustriesFood & Beverages
C&CMembersOct 31, 2026, 17:35 (UTC+9)Amadey configuration matched observed POSTs to its HTTP endpoint
An executable’s extracted configuration pointed to http://185.156.72.8/rob75u9v/index.php. Sandbox records then supplied the more consequential evidence: HTTP POST requests to that exact address, including a recorded 200 response. This was not simply an IP address appearing inside a suspicious file. The configured endpoint was also used during analysis.
#Amadey#RedLineStealer#C2infrastructure#HTTPPOST#sandboxanalysis#scheduledtaskartifactIOCf39 · i2 · d1 · u8MITRE57RegionsUS
C&CMembersOct 30, 2026, 09:32 (UTC+9)Different extensions, same DLL in recorded regsvr32 commands
A file named auctbv.bcb in a Windows system directory appears in a sandbox report as the target of a regsvr32.exe command. A second command references a Desktop file ending in .dll.ocx. The names suggest different components, but the reported SHA-256 values are identical. Is this evidence of an additional payload, or of the same DLL being used under different names?
#WindowsDLL#regsvr32#SystemBinaryProxyExecution#sandboxanalysis#HTTPSrequests#command-and-controlinfrastructureActorsEmotet Group · TA542IOCf1 · i3 · d0 · u9MITRE27RegionsRO
C&CMembersOct 28, 2026, 11:10 (UTC+9)Executable queried TXT records across two .xyz domains via a resolver
A Windows executable asked a DNS-resolution service for TXT records beneath two related .xyz domains, using both the service’s hostname and a numeric IP address. In one sandbox report, those requests received HTTP 200 responses identified as JSON. The same file’s reports also recorded traffic to an address returned for down.zhangyaping.top.
#Windowsexecutable#TXTrecordlookups#HTTPDNSresolution#sandboxanalysis#SysWOW64execution#processcreationActorsGold Evergreen · Business ClubIOCf5 · i1 · d7 · u2RegionsUS
C&CMembersOct 27, 2026, 09:11 (UTC+9)Matching POST requests link two hosts in an installer workflow
Two hosts, os.baixakialtcdn.com and os2.baixakialtcdn.com, appear in a sandbox report with an unusually specific connection: each was addressed by HTTP POST requests using the same path and matching query parameters. The report also records temporary setup executables, a command with a progress-display argument, and a request for an executable hosted on Amazon S3. What role did the paired hosts play in that activity?
#sandboxanalysis#installerworkflow#HTTPPOSTrequests#temporaryexecutables#softwaredownloads#advertisingrequests#DNSrecordsIOCf7 · i1 · d3 · u2MITRE34RegionsBRIndustriesAgriculture
C&CMembersOct 24, 2026, 10:13 (UTC+9)Configured RedLine endpoint also appears in outbound and response alerts
The same address appears on both sides of network alerts associated with a Windows executable: 83.97.73.131:19071 is a destination in outbound detections and a source in response detections. The executable’s extracted configuration names that exact IP and port as command-and-control infrastructure. Together, those observations raise a more useful question than whether the address has a malicious reputation: what activity can actually be connected to it?
#RedLine#Amadey#C2communications#temporaryexecutables#Defenderpolicychanges#RunOncecleanup#scheduledtaskActorsTortoiseshell · Imperial KittenIOCf9 · i1 · d0 · u1MITRE3RegionsPK
C&CMembersOct 21, 2026, 04:50 (UTC+9)Dropped AppData executable linked to scheduled execution and HTTP requests
A Windows Schedule-service process appears as the parent of two synchost.exe processes running from a user’s AppData directory. In the same sandbox report, that path is written to disk and a synchost.job task file is recorded. The question is not simply whether a suspicious executable ran, but how that executable relates to the submitted sample—and whether the task activity provides a mechanism for running it beyond the original launch.
#Amadey#scheduledtasks#AppDataexecution#executabledeployment#HTTPC2#WindowsIOCf52 · i4 · d0 · u4RegionsCA · DO · FR · USIndustriesRetail
C&CMembersOct 20, 2026, 09:44 (UTC+9)Tool-labelled executable delivered a distinct Setup payload
A program recorded as Open Bullet.exe launched two processes named Setup.exe from a temporary directory. The filename alone could describe an ordinary installer helper. But the sandbox also recorded the dropped file’s hash, linking it to a separately analyzed executable whose reports contain script execution, an Explorer-named payload and registry settings intended to run commands at logon. What was the tool-labelled program actually delivering?
#sandboxanalysis#payloaddelivery#scriptexecution#registrypersistence#HTTPrequests#DNSresolutionIOCf14 · i1 · d1 · u1MITRE24RegionsBR
C&CMembersOct 19, 2026, 18:17 (UTC+9)DNS and certificate records link qh88eu.com to its backdoor subdomain
backdoor.qh88eu.com and qh88eu.com have the same recorded IP addresses and HTTPS certificate. Two other domains share their TLS service fingerprint but have different addresses and certificates. That contrast raises the central question: how much of this apparent infrastructure cluster is actually connected? The records supplied to CTX Threat Intelligence support a specific relationship between the qh88eu.com parent domain and its backdoor subdomain. The wider grouping is less tightly linked.
#DNSrecords#TLScertificates#JARMfingerprint#Cloudflarenameservers#Infrastructureanalysis#C2investigationIOCf52 · i0 · d7 · u3RegionsUSIndustriesRetail
C&CMembersOct 19, 2026, 03:33 (UTC+9)Matching executable copies appear at two paths with Run entries
A Windows executable left matching copies of itself in both the user profile and Windows directory, with registry launch settings pointing to each location. In a sandbox report for the same sample, requests to two remote IP addresses received HTTP 404 responses. That combination raises a consequential question: does an unsuccessful request for remote content mean the executable failed to establish a foothold? The records examined by CTX Threat Intelligence support a more specific answer.
#Windowsexecutable#Runregistrykeys#Persistence#Direct-IPHTTP#Security-statusregistrychangesIOCf1 · i2 · d0 · u8MITRE13RegionsRO
C&CMembersOct 17, 2026, 17:37 (UTC+9)DNS links domain to IP; matching TLS fingerprints corroborate
dfkjgoi3.info points to 213.108.199.215 in the supplied DNS record, and the two profiles report matching HTTPS certificates and JARM service fingerprints. Together, these observations answer a concrete question: is the IP merely another suspicious indicator, or does it have a documented relationship to the domain? CTX Threat Intelligence’s records support the latter. The IP is an infrastructure pivot for investigating the domain, not just a nearby entry in an indicator collection.
#DNS#IPinfrastructure#TLScertificates#JARMfingerprinting#Command-and-controlclassification#Windowsexecutable#AutostartartifactActorsSalty Spider · KuKuIOCf9 · i1 · d2 · u37MITRE46RegionsUA
C&CMembersOct 16, 2026, 23:24 (UTC+9)Configured Stealc endpoint draws POSTs; shared loader host remains unobserved
An executable sent an HTTP POST to 196.251.107.130/16b022998f754137b60a.php, and a sandbox recorded an HTTP 200 response. A different executable listed the same IP address in its extracted configuration—but with /api.php as the path. That overlap raises a more useful question than whether the address is suspicious: does it connect two programs in an attack chain, or identify a host with distinct, separately evidenced roles? CTX Threat Intelligence’s records support the second reading.
#Stealcv2#command-and-control#HTTPPOST#sharedinfrastructure#scheduledtasks#registrypersistenceActorsAPT28 · StrontiumIOCf29 · i4 · d0 · u10MITRE22RegionsUSIndustriesRetail
C&CMembersOct 16, 2026, 07:50 (UTC+9)Firewall-disable command anchors a broader defense-interference attempt
A sandbox process tree records netsh.exe issuing netsh firewall set opmode disable. Elsewhere in the same report, Windows Security Center notification settings were written alongside a policy value governing User Account Control (UAC). The combination raises a more useful question than whether the executable looked suspicious: was it trying to change the host’s defenses, suppress their warnings, or both?
#Defenseinterference#Firewallconfiguration#Securitynotificationsettings#UACpolicy#Sandboxanalysis#WindowsActorsSalty Spider · KuKuIOCf11 · i1 · d2 · u29MITRE50RegionsUA
C&CMembersOct 14, 2026, 23:12 (UTC+9)Sandbox reports trace executable’s request to configuration-shaped URL
Two sandbox reports record a Windows executable requesting the same resource: http://udo.jxwan.com/index/getcfg?id=59522. Both resolve the hostname to the same pair of IP addresses, and one records an HTTP 200 response. The request raises a more useful question than whether the destination appears on a threat list: what role did this service actually play in the executable’s behavior?
#Windowsexecutable#sandboxanalysis#HTTPrequest#configurationretrieval#networktraffic#processactivity#TLSinfrastructureIOCf21 · i8 · d28 · u2RegionsUSIndustriesRetail
C&CMembersOct 14, 2026, 07:14 (UTC+9)Different extensions, identical DLL content in sandbox report
A Windows DLL appeared under two very different filenames in a sandbox report: one on the desktop with a .dll.ocx suffix, the other beneath SysWOW64 with a .tsu extension. Both were targets of recorded regsvr32.exe commands. Were these separate components, or the same content taking different forms in the execution record? Their matching SHA-256 answers the content question: the two files were identical.
#WindowsDLL#regsvr32#system-binaryproxyexecution#sandboxanalysis#SysWOW64#HTTPStrafficActorsEmotet Group · TA542IOCf1 · i4 · d0 · u8MITRE27RegionsRO
C&CMembersOct 13, 2026, 15:19 (UTC+9)Written AppData file named in Windows executable-open command
A Windows executable wrote sidebar.exe beneath the current user’s AppData directory and changed the user’s .exe open command to point to that same file. The new command placed sidebar.exe /START before the executable being opened and its arguments. That raises a more consequential question than whether the sample contacted a suspicious address: was it positioning its own code in the path used to launch other programs? The CAPE Sandbox record supports that interpretation of the setting.
#Windows#AppData#executable-openredirection#registrymodification#droppedexecutable#processexecution#HTTPPOSTrequestsActorsGamaredon Group · CTIGIOCf12 · i1 · d0 · u9RegionsUSIndustriesRetail
C&CMembersOct 12, 2026, 23:15 (UTC+9)One signed updater, several application-named service locations
A Bright Data-signed updater is associated with Windows service locations whose names refer to three different applications: Epic Pen, Bright VPN and drvhub. Two other signed updater files share the Bright VPN service name. That recurring footprint raises a more useful question than whether a file called net_updater.exe is suspicious: what component does the record identify, and what does it show that component doing?
#BrightSDK#BrightData#Windowsservices#signedsoftware#softwareupdater#sandboxclassificationActorsSpace Pirates · WebwormIOCf18 · i35 · d29 · u9MITRE19
C&CMembersOct 12, 2026, 07:19 (UTC+9)Firewall deletion commands targeted names also reported as services
Two Windows firewall rules named upWire and wire were targeted for deletion in sandbox events associated with an upWire executable. Those same names appear separately as service-registry locations reported for two distinct files. The correspondence raises a more useful question than whether a firewall alert fired: was the software managing its own service-related network settings, or trying to remove a security restriction?
#Windowsfirewall#Firewallruledeletion#Serviceregistry#Netsh#Processcreation#CodesigningActorsSpace Pirates · WebwormIOCf19 · i17 · d6 · u2MITRE19
C&CMembersOct 11, 2026, 15:50 (UTC+9)upWire analysis shows attempted deletion of two named firewall rules
Two Windows command-shell events in an analysis associated with upWire launched netsh.exe with instructions to delete firewall rules named upWire and wire. A separate file identified as wire.exe has a reported registry location under Services\wire. Together, these observations raise a more specific question than whether a suspicious executable used a Windows administration tool: do the matching names reveal how related software manages its presence on the host?
#upWire#wire.exe#Windowsservices#firewallruledeletion#netsh#codesigning#hostconfigurationActorsSpace Pirates · WebwormIOCf16 · i18 · d21 · u6MITRE18
C&CMembersOct 11, 2026, 00:28 (UTC+9)UninstallerTray requests reveal a corroborated activity-reporting endpoint
An executable named UninstallerTray.exe appeared in a sandbox process tree while the same report recorded HTTP requests describing application activity: action=run and action=nowork. The requests went to s.jyrich.com/deep, carried a module version matching the file’s version, and included two identifier fields. Was this an isolated reporting mechanism, or did it resemble the behavior already documented for WinAuthority? The comparison is substantive.
#activityreporting#HTTPrequests#signedsoftware#publishercertificate#sandboxanalysis#internetcache#LSASSimageloadActorsGroup123 · Venus 121IOCf10 · i3 · d2 · u1MITRE52
C&CMembersOct 10, 2026, 07:26 (UTC+9)Firewall-rule deletion attempts targeted reported service names
Two recorded Windows commands targeted firewall rules named upWire and wire for deletion. Those names also appear in reported service autostart locations associated with two distinct signed executables. The match raises a more useful question than whether either file carries a suspicious label: what connects these programs’ service footprint to changes in the host’s network controls?
#Windowsfirewall#Firewall-ruledeletion#Windowsservices#Serviceautostart#Codesigning#Processcreation#SandboxanalysisActorsCactus · Cactus Ransomware GroupIOCf22 · i17 · d11 · u4MITRE16
C&CMembersOct 9, 2026, 15:34 (UTC+9)One executable appeared behind several application names
A Windows executable appeared in a sandbox’s file outputs under both a CUAssistant launcher path and a Chrome installer path—with exactly the same SHA-256 as the file submitted for analysis. That raises a more useful question than the filenames alone can answer: were these separate software components, or was one executable’s content being placed behind several application-related names? The records support the latter interpretation for several outputs.
#Renamermalware#Windowsexecutables#software-directorywrites#fileplacement#sandboxanalysis#registrymodificationActorsSalty Spider · KuKuIOCf41 · i4 · d3 · u1MITRE17RegionsID
C&CMembersOct 8, 2026, 23:52 (UTC+9)DNS links flagged domain to IP with matching TLS fingerprints
The DNS record for dfkjgoi3.info points to 213.108.199.215, and the two indicators carry matching recorded HTTPS certificates and JARM service fingerprints. That combination raises a more useful question than whether either address has a malicious reputation: how firmly does the evidence identify a common service, and what activity can actually be attached to it? CTX Threat Intelligence’s records support a concrete domain-to-IP relationship, reinforced by matching TLS characteristics.
#Command-and-controlinfrastructure#DNSmapping#TLScertificates#JARMfingerprinting#NetherlandshostingActorsSalty Spider · KuKuIOCf13 · i1 · d2 · u46MITRE48RegionsUA
C&CMembersOct 8, 2026, 07:32 (UTC+9)WinAuthority’s run-labelled request points to a specific endpoint
A signed Windows executable sent an HTTP request that described its own activity as action=run, identified the application as winauth, and supplied a version matching the file’s reported version. What was the receiving server doing: collecting application activity, delivering instructions, or serving some other purpose? The sandbox records examined by CTX Threat Intelligence support a specific answer: WinAuthority.exe made a run-labelled request to s.91toolbox.com, while leaving…
#WinAuthority#Windowsexecutable#HTTPrequest#launchreporting#sandboxanalysis#localapplicationstate#DNSinfrastructureIOCf6 · i1 · d5 · u2MITRE48
C&CMembersOct 7, 2026, 15:12 (UTC+9)Named firewall-rule deletion requests leave the outcome unresolved
The Windows command in the sandbox record targets a specific firewall rule: netsh advfirewall firewall delete rule name="upWire". Another recorded command targets a rule named wire. Those names also appear in reported Windows service locations associated with two signed executable samples. The question is what that overlap establishes: software managing its own network-related settings, or a deliberate attempt to weaken protection?
#WindowsFirewall#firewallruledeletion#processcreation#Windowsservices#codesigning#sandboxanalysisActorsEvilnum · DeathStalkerIOCf9 · i9 · d12 · u4MITRE20
C&CMembersOct 6, 2026, 23:15 (UTC+9)Install switches and service artifacts point to an updater, not a proven install
A Windows executable appeared in a sandbox with three installation- or loading-style command lines: software.exe -install, software.exe /install and software.exe /load. Its file record also identified updater-named Windows service locations. Together, these observations raise a concrete question: does the record show an updater establishing a persistent service, or only the entry points and artifacts associated with that role?
#Windowsservices#autostartartifacts#installswitches#codesigning#sandboxanalysis#UDPport53#TLSfingerprintActorsAPT15 · ROYALAPTIOCf11 · i2 · d5 · u2MITRE3IndustriesHealthcare · Telecommunications
C&CMembersOct 2, 2026, 14:39 (UTC+9)Expired Signature Still Fooled Users Two Years Later
A Win32 installer tagged to the commodity PUP family "orcinius" surfaced on VirusTotal on 2015-12-13 carrying a full three-tier code-signing chain — "Premium Installer; VeriSign Class 3 Code Signing 2010 CA; VeriSign" — and a verification status that reads, verbatim, "A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file." The leaf certificate issued to "Premium Installer" was valid from 1:00 AM on 7/13/2013…
#orcinius#PUP#code-signingabuse#C2infrastructure#VeriSigncertificate#retailsector#installermalware#domainregistrationIOCf1 · i0 · d2 · u2MITRE13RegionsUSIndustriesRetail
C&CMembersOct 2, 2026, 06:40 (UTC+9)Old Emotet Loader's TLS Fingerprint Still Trips Dridex C2 Rules
A 494-kilobyte Emotet loader DLL first catalogued in April 2022 is still showing up in intrusion-detection logs today — not because the file is new, but because the TLS handshake it performs when it calls home still matches signatures built to track an entirely different banking trojan. Six IDS rule hits fire on this binary (hash 6bdac750fd1885696ffaf5dd38806c8f7bff2c8bc706421c9b4f0c2b0a9d8520, popularly tagged "mint" and "zard" alongside its Emotet label): three separate "ET CNC Feodo Tracker…
#Emotet#Dridex#TA542#JA3fingerprint#FeodoTracker#Let'sEncryptcertificates#C2infrastructure#loader-as-a-serviceActorsEmotet Group · TA542IOCf1 · i4 · d0 · u6MITRE24
C&CMembersOct 1, 2026, 22:49 (UTC+9)StealC v2 Learns to Pick Chromium's App-Bound Encryption Lock
The newest file wave added to this campaign's tracking includes a StealC v2 build pair that now trips the same YARA rule used to catch tooling built specifically to defeat Chromium's hardened credential store — a capability jump that matters more than any single indicator count added this cycle. A 767KB sample internally labeled as the stealer-loader "marte" variant (0215f734…53624) and a 2.9MB build shipped under the name SilverBulletPro1.5.exe and tracked as "cymulate" (1465e9ea…b5660) both…
#StealCv2#ChromiumApp-BoundEncryption#BYOVD#UACbypass#AS214351#FemoITSolutions#credentialtheft#C2infrastructureIOCf10 · i5 · d3 · u13MITRE55RegionsUSIndustriesTechnology
C&CMembersOct 1, 2026, 06:31 (UTC+9)Cert-Rotation Pattern, Not APT27, Links PC-Repair Lure Domains
Two lookalike PC-repair domains, registered five months apart through entirely different registrars, were issued near-identical certificates by the same Let's Encrypt authority shortlisted under the CA short-name "YR2" — both carrying 89-day validity windows, both stamped with wildcard subject names pointing at secondary lure brands. mypchub.net, registered through NameCheap, Inc.
#APT27#LuckyMouse#Rhadamanthys#LummaStealer#njrat#Let'sEncryptcertificates#commoditycrimeware#domaininfrastructureActorsAPT27 · TEMP.HippoIOCf5 · i1 · d2 · u2MITRE35RegionsBD · INIndustriesFood & Beverages
C&CMembersSep 30, 2026, 22:37 (UTC+9)Five-Day-Old Domain Found Hosting Full SQL Server Intrusion Kit
A domain registered through Namecheap on September 25 and still just five days old when it was captured is hosting a complete, ready-to-run intrusion kit — not a single payload, but an entire toolchain: packed executables, batch and VBS launchers, a SQL Server data dump, and plaintext files labeled simply "user" and "pass." The domain, vietnam852.com, resolves to one IP address, 8.230.28.79, and serves everything from a single path: site.vietnam852.com/sql/.
#vietnam852.com#SQLServer#credentialtheft#imphash#UPXpacking#ConfuserEx#retailsector#ingresstooltransferIOCf18 · i1 · d2 · u10RegionsBD · BR · EG · INIndustriesRetail
C&CMembersSep 30, 2026, 06:30 (UTC+9)Wizard Spider Cluster Adds CMSTP Bypass as Loader Cohort Hits Five
The freshest wave of indicators tied to this cluster doesn't expand the target list or spin up new command posts — it thickens the payload layer with a defense-evasion technique that wasn't visible in the earlier build. Two newly logged samples that share no import-table hash, no signer, and no vendor label between them — a file flagged as trojan.filerepmalware/misc (338458ce…) and one carrying a "Curiositystream by D3v.exe" filename and tagged trojan.cymulate (60b1267c…) — both trip the same…
#WizardSpider#CMSTPUACbypass#loadercohort#Injuke#Stealc#Clipbanker#C2infrastructure#vulnerabledriverActorsWizard Spider · Grim SpiderIOCf18 · i5 · d3 · u13MITRE59RegionsBE · VN
C&CMembersSep 29, 2026, 22:38 (UTC+9)Shared Beacon String Links Clipbankers, a Stealer, and a Rogue Driver
Three separate rule-level fingerprints, not a single named family, are what make this cluster worth a second look. A signed-but-expired Windows driver built to terminate security processes fires Elastic's "Windows_VulnDriver_ProcessMonitorDriver" detection on one sample; a UAC-bypass rule tied to the CMSTP COM interface [T1218.003] co-fires on two nominally unrelated loaders; and a Florian Roth YARA signature for a single-byte XOR-obfuscated "Mozilla/5.0" string turns up in three files that…
#BYOVD#CMSTPUACbypass#clipbanker#RedLineStealer#dynamicDNSabuse#AS214351#processmasquerading#commoditycrimewareActorsWizard Spider · Grim SpiderIOCf18 · i3 · d2 · u6MITRE24RegionsBE
C&CMembersSep 29, 2026, 14:44 (UTC+9)One Build, Four AV Labels: Inside a Stealer Masquerade Pipeline
Four files carrying four different antivirus threat labels — trojan.injuke/hrgx, trojan.clipbanker/hrgz, trojan.stealc/stealer, and trojan.mikey/clipbanker — turn out, on closer inspection, to be the same binary wearing different clothes. All four share an identical import-table hash (75c410d3cdd17cf4a33ccaf94384484f) and an identical rich PE header hash (dee6ab558f324ac40038942e3c424ed4), a level of structural identity that has nothing to do with coincidence and everything to do with a single…
#StealC#ClipBanker#Amadey#BYOVD#CMSTPUACbypass#processmasquerading#AS214351#WizardSpiderattributionActorsWizard Spider · Grim SpiderIOCf18 · i5 · d3 · u13MITRE20RegionsBE
C&CMembersSep 28, 2026, 22:44 (UTC+9)A Three-Year-Old Packer Fingerprint Still Feeds the Same Amadey Panel
A Windows binary called ReverseHoo.exe, first catalogued in July 2022, and a same-family binary called ReverseHoo Checker.exe, submitted more than three years later in October 2025, fire an identical five-rule packer signature: HKTL_NET_NAME_AsStrongAsFuck, SUSP_NET_NAME_ConfuserEx, and three separate INDICATOR_EXE_Packed_* rules covering ConfuserEx, dotNetProtector, Dotfuscator, Goliath and Babel.
#Amadey#LummaStealer#ConfuserExpacker#DiamotrixC2panel#OmegatechLTD#FarahooshDena#loadermalware#GermanyNetherlandsIraninfrastructureIOCf5 · i4 · d0 · u10MITRE37RegionsDE
C&CMembersSep 28, 2026, 06:32 (UTC+9)A Log Shop That Never Reboots Its Servers
Eighteen of the forty-seven files CTX Team has tracked against this collection point turned over in the most recent sweep — new stolen-data artifacts rotating in, old ones rotating out — while every piece of network infrastructure behind the operation stayed exactly where it was. The domain, the IP, and the seven URLs tied to this cluster show zero change.
#diamotrix.world#credentialtheft#stealerlogs#gatak#Exoduswallet#FileZilla#Telegram#C2infrastructureIOCf47 · i2 · d1 · u7MITRE55RegionsUSIndustriesMedia
C&CMembersSep 26, 2026, 22:34 (UTC+9)Identical TLS Certificate Links Manila Server to Bytedance-Registered US IP
Two servers with nothing obvious in common — one sitting inside Zenlayer's Philippine address space, the other inside a block registered to Bytedance Inc. in the United States — are presenting the exact same TLS certificate. Not a similar one: byte-identical. The certificate at 156.59.113.130 (AS21859, Zenlayer Inc, Philippines) and the one at 71.18.106.229 (AS396986, Bytedance Inc., United States) share serial number 1acf3e37b37910d932ea64e6bb27615d6484c07d, an identical thumbprint, and the…
#certificateabuse#codesigning#APT28#PBotstealer#BrightDataSDK#Let'sEncrypt#loadermalware#infrastructuresprawlActorsAPT28 · StrontiumIOCf133 · i12 · d26 · u3MITRE25
C&CMembersSep 25, 2026, 06:46 (UTC+9)Revoked Certs, Live Trojans: VPN Malware Signs On Anyway
A revoked EV certificate does not usually stop working the moment a certificate authority pulls it — Windows still launches the binary, users still click through the warning dialog if one even appears, and the software keeps installing exactly as it did the day it was minted. That quiet mechanical fact is the throughline connecting three unrelated Windows codebases surfacing in the same indicator set: a VPN trojan signed by WEILAI NETWORK TECHNOLOGY CO., LIMITED whose GlobalSign EV certificate…
#codesigningabuse#certificaterevocation#VPNtrojan#proxyware#BrightData#PBotstealer#graywaredistribution#threatattributionActorsCactus · Cactus Ransomware GroupIOCf16 · i9 · d12 · u0MITRE16
C&CMembersSep 24, 2026, 14:37 (UTC+9)One Wildcard Certificate Ties APT28 Infrastructure Across Six Nations
Eighteen IP addresses scattered across the United States, Hong Kong, Vietnam, South Korea, Malaysia and Thailand are all presenting the identical TLS certificate — a wildcard issued for a domain whose name gives away its purpose: certfallback.com. The certificate carries serial number 6696262f452fcf46b79266a8, was issued by GlobalSign GCC R46 OV TLS CA 2025 to an organization listed as Alibaba (China) Technology Co., Ltd. in Hangzhou, Zhejiang, and runs from 2026-07-30 through 2027-02-14.
#APT28#FancyBear#wildcardcertificate#AlibabaCloud#commandandcontrol#educationsector#phishing#espionageActorsAPT28 · StrontiumIOCf0 · i21 · d8 · u1MITRE2IndustriesEducation & Research
C&CMembersSep 21, 2026, 22:29 (UTC+9)Two Shell Firms, One DigiCert Root: Adware's Signing Trick Repeats
AloneTrayServer.exe and MLPrivacy.exe — two installers newly added to a long-running Chinese adware-distribution cluster — both carry valid, chained code-signing certificates issued to a company calling itself 成都星汉云科科技有限公司. That in itself would be unremarkable. What makes it worth a second look is that this is now the second shell identity CTX Team has traced back to the exact same intermediate certificate authority — DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 — after an earlier…
#code-signingabuse#shellcompanies#DigiCert#adware#Ludashi#T1553.002#sideloading#China-basedinfrastructureIOCf9 · i3 · d4 · u1MITRE45
C&CPublicSep 21, 2026, 06:50 (UTC+9)A Two-Tier Certificate Strategy Behind a Freshly Rotating C2 Cluster
Four IP addresses and three domains now tracked under a single command-and-control cluster show something that rarely shows up this cleanly in raw infrastructure data: two entirely different levels of operational care, running side by side on the same campaign. On one tier, listener IPs are still wearing the certificates they shipped with — an OpenSSL install default, a Chinese vendor's untouched template — the kind of TLS hygiene nobody bothers to fix on infrastructure meant to be thrown away.
#command-and-controlinfrastructure#TLScertificatehygiene#wildcardcertificates#dynamicDNS#DGAdomains#unattributedthreatcluster#certificatetransparency#networkinfrastructureanalysisIOCf0 · i4 · d3 · u0MITRE10IndustriesContainers & Packaging
C&CPublicSep 20, 2026, 22:49 (UTC+9)Emotet 'C2 Servers' Entry Bundles 3 Unrelated IPs, No Shared Fingerprint
A feed entry logged at 00:03 UTC on September 20 groups nine indicators under the category "c2-servers" — a single Emotet loader DLL and three IP addresses spread across Malaysia, Ghana and South Korea. The label implies a working command-and-control triangle behind a live banking-trojan campaign. The evidence inside the record says something closer to the opposite: none of the three IPs share an autonomous system, a certificate, or a registrant record with each other or with the file, and two…
#Emotet#C2infrastructure#bankingtrojan#threatintelligencefeeds#certificatestaleness#Malaysia#Ghana#SouthKoreaIOCf6 · i3 · d0 · u6RegionsUSIndustriesRetail