FILE
235 stories
FILEMembersJul 24, 2026, 21:34 (UTC+9)One Domain, a Disposable Cert, and an APT29 Label That Doesn't Fit
A domain called holzbrenzii.com went live on 2025-06-23 through registrar PDR Ltd. d/b/a PublicDomainRegistry.com, sat quietly on a single hosting record for over a year, then picked up a wildcard TLS certificate with an unusually tight 89-day validity window. That's the entirety of the corroborated evidence in a threat-feed entry that also carries an APT29 attribution and a Remcos malware tag — labels that, on closer inspection, are bolted onto a record with no file, no payload, and no…
#APT29#Remcos#phishinginfrastructure#disposabledomains#TLScertificateabuse#WHOISobfuscation#threatintelligenceattribution#commoditymalwareActorsAPT29 · MinidionisIOCf1 · i0 · d1 · u0MITRE28RegionsAU · BA · BG · ECIndustriesBusiness Associations · Commercial Services · Engineering
FILEMembersJul 24, 2026, 13:47 (UTC+9)2008-Signed Kernel Driver Still Evades Most Antivirus Engines
A driver signed nearly two decades ago — its entire certificate chain now flagged as time-invalid — has resurfaced in a small but sharply detailed record that puts vulnerable-driver tradecraft, not infrastructure, at the center of the story. The file is WinRing0.sys, a hardware-monitoring kernel driver, and it carries a signature chain minted in 2007~2008 that has since decayed into forensic wreckage: every intermediate certificate in the Authenticode chain, from signer Noriyuki MIYAZAKI…
#BYOVD#vulnerabledriver#WinRing0.sys#kerneldriverexploitation#Turla#AkamaiCDNinfrastructure#LOLDrivers#signedmalwarecertificateabuseActorsTurla · Iron HunterIOCf2 · i4 · d0 · u0MITRE7IndustriesEducation & Research
FILEMembersJul 23, 2026, 21:51 (UTC+9)Expired Certificate Still Trusted in Four-Named Bundler
A single Win32 binary has been submitted to detection platforms 11,721 times from 3,694 distinct sources while wearing four different disguises — packaged and distributed as a Resource Hacker installer, an XMEye VMS setup file, a KeyTweak utility, and a glogg build. The file, catalogued under the threat label `adware.bundler/cppinstaller with popular names bundler, cppinstaller, and installcore, is the kind of high-volume, low-sophistication artifact that rarely gets a deep look — until you…
#code-signingcertificateabuse#adwarebundler#sandboxevasion#installcore#Bumblebeemisattribution#Hostingerinfrastructure#Let'sEncryptabuse#falseattributionActorsPatchwork · ChinastratsIOCf3 · i3 · d3 · u3MITRE8IndustriesEnergy
FILEMembersJul 23, 2026, 13:47 (UTC+9)Fifth IP Joins Huawei-Spoofing Cert Cluster in Guangdong
The file side of this campaign has gone quiet — zero new signed installers have surfaced since the last snapshot, while fifteen previously tracked hashes have dropped out of view entirely. But the network layer tells a different story. A newly observed address, 119.147.128.39, has joined a cluster of four IPs already sharing an identical TLS certificate — serial 5ace246430093aa3ef595686 — bringing the cohort to five distinct hosts spread across two /21 netblocks in Guangdong province, all…
#SaltySpider#sality#adware.softcnapp#TLScertificateimpersonation#HuaweiAppGalleryspoofing#CHINANETGuangdong#codesigningabuse#HappyPictureinstallerActorsSalty Spider · KuKuIOCf10 · i8 · d0 · u0MITRE6
FILEMembersJul 21, 2026, 13:40 (UTC+9)Bright Data's EarnApp Signing Chain Split to Smuggle a Stealer
A Windows installer that presents itself as EarnApp — Bright Data Ltd's consumer bandwidth-sharing client — is circulating in at least three variants that all carry a valid Bright Data Ltd code-signing chain anchored to DigiCert. Two of those variants read clean or undetected. The third, a component named net_updater32.exe dropped inside the same Program Files\EarnApp path, is classified by the C2AE sandbox as a stealer, with the malware family tag PBot attached at 50% confidence.
#EarnApp#BrightDataLtd#codesigningabuse#PBotstealer#APT28attributionmismatch#supply-chainmasquerade#PUPdomainC2#certificateinfrastructureActorsAPT28 · StrontiumIOCf92 · i9 · d44 · u6MITRE4IndustriesCommercial Services
FILEMembersJul 20, 2026, 21:46 (UTC+9)vjw0rm Worm's Full Dropper Chain Resurfaces Five Years Later
Nine file indicators tied to the vjw0rm worm family let CTX Team reconstruct, almost stage by stage, how this decade-old commodity malware still moves through a target environment in 2026: a booby-trapped Windows shortcut hands off to a batch script, which drops an AutoIT-compiled payload dressed up as a core Windows process, which then calls home to a free dynamic-DNS domain.
#vjw0rm#TA2541#OperationLayover#AutoITmalware#dynamicDNSabuse#processmasquerading#manufacturingsectorThailand#LNKdropperActorsTA2541 · Operation LayoverIOCf9 · i0 · d0 · u2RegionsTHIndustriesManufacturing
FILEPublicJul 20, 2026, 05:35 (UTC+9)Expired Certificate Still Signs Circulating UltraSurf-Branded Binary
A Win32 binary distributed under the UltraSurf and Ultrareach brand names — tools historically marketed as anti-censorship proxy utilities — carries a code-signing certificate from Ultrareach Internet Corp. that expired more than two years ago, yet the file was still circulating in submission traffic as recently as July 7, 2026.
#UltraSurf#Ultrareach#expiredcode-signingcertificate#UPXpacking#sandboxevasion#Toregress#HurricaneElectricAS6939#Glupteba2ActorsMuddyWater · TEMP.ZagrosIOCf1 · i4 · d0 · u0IndustriesWholesale
FILEMembersJul 19, 2026, 13:46 (UTC+9)'Shipping Advice' Phishing Chain Skips Fingerprints, Leans on Disposable Hosting
A phishing wave dressed up as a "shipping advice" notice is running a tight, four-step reconnaissance-and-drop chain before it ever touches a durable piece of infrastructure. The sequence — a RAR-wrapped JavaScript dropper that stages a font-disguised payload and then queries the victim's own external IP address before reaching out to a single, disposable web host — reads less like a bespoke intrusion tool and more like a lean, repeatable delivery kit.
#TA505#RockLoader#phishing#JavaScriptdropper#Namecheapinfrastructure#shippingadvicelure#IPreconnaissance#fontmasqueradingActorsTA505 · Hive0065IOCf3 · i1 · d1 · u1RegionsBD · CA · CH · DEIndustriesEnergy · Hospitality & Leisure · Support Services
FILEMembersJul 19, 2026, 05:47 (UTC+9)Reused Certificate Ties Two KMS Activators to One Build Pipeline
A pair of Windows licensing-bypass tools carrying an identical, cryptographically dead-end code-signing certificate has surfaced in a four-file cluster enriched for this feed — and the certificate is the strongest piece of evidence in the whole set. The x86 build, hashing to 50b277f770648c014924c5bf17ed94bfe149ec317a4f8b70129f3dd76e0d0a64, and its x64 counterpart, 3f2e66bbb2ed7be8655c258a2e0e43fb5bba482ae909c2c2e91865699d33b6bf, both carry a signature block naming "WZTeam" as signer, with a…
#KMSAuto++#WZTeamcertificate#codesigningabuse#WindowsDefenderevasion#UPXpacking#piracyluredomain#APT27misattribution#hacktool.kmsautoActorsAPT27 · TEMP.HippoIOCf4 · i0 · d1 · u1MITRE18IndustriesEnergy
FILEMembersJul 18, 2026, 13:56 (UTC+9)Certificate for signindat.com Labels Itself 'OU=C2' in Plain Text
Somewhere in the build pipeline behind a single command-and-control domain, an operator generated a self-signed TLS certificate and left its organizational-unit field reading, verbatim, "C2." The domain is signindat.com, resolving to a single address, 193.26.115.45, and the certificate — serial 50fb9fc33758894e18d8b6a0cb42d5044a75078a — carries issuer and subject fields of CN=signindat.com, O=Hermes, OU=C2, with subject alternative names covering both the hostname and its IP.
#UnfadingSeaHaze#doghousepower#signindat.com#self-signedcertificate#trojan.meterpreter#espionage#Switzerland#JordanActorsUnfading Sea HazeIOCf9 · i0 · d1 · u2MITRE25RegionsCH · JOIndustriesFood & Beverages · Government · Support Services
FILEMembersJul 17, 2026, 14:59 (UTC+9)Fireball/Elex Adware: 14 DLLs Built in a Four-Day Cycle
A cluster of fourteen unsigned Windows DLLs — plus one companion executable — compiled between January 23 and January 26, 2017 shares a builder fingerprint tight enough to read like a single production run. The modules carry deliberately mundane names: RegKey.dll, Skytech.dll, ClearLog.dll, Packet.dll, MIO.dll, Berserker.dll, Install.dll, Lancer.dll, At.dll, and a standalone WinTooll.exe. None are signed.
#Fireball#Elex#Sasquor#adware#YARArules#maliciousDLL#MSIinstaller#sinkholedC2ActorsBarium · Wicked SpiderIOCf27 · i0 · d3 · u0MITRE43RegionsBR · PK
FILEMembersJul 17, 2026, 13:37 (UTC+9)Pikabot Loader Keeps Its Slack-Mimicking C2 Disguise as Infrastructure Shrinks
Three command-and-control servers tied to a Pikabot-family loader are still answering on URL paths built to look like Slack's own Web API — /api/admin.conversations.getConversationPrefs, /api/apps.permissions.users.request, /api/admin.conversations.ekm.listOriginalConnectedChannelInfo — a naming discipline that has now held across two separate observation windows.
#Pikabot#SafePay#Contabohosting#C2infrastructure#SlackAPImimicry#loadermalware#commoditymalware#networkegressevasionActorsSafePayIOCf1 · i3 · d0 · u6MITRE13RegionsUSIndustriesRetail
FILEPublicJul 16, 2026, 21:47 (UTC+9)WinPEAS-Named Binary Flags Vault Credential Hooks, Splits Sandboxes
A binary distributed under the name winPEAS.exe — one of the most widely used open-source Windows privilege-escalation enumeration tools — has turned up carrying YARA hits for Windows Vault credential objects and confidential-data-store queries, alongside two sandboxes that can't agree on what it actually is. CAPE Sandbox classifies the payload as Rhadamanthys, a well-known credential-stealing malware-as-a-service family; Zenbox instead labels it "PEASS HackTool" and flags it as a…
#WinPEAS#Rhadamanthys#APT29#WindowsVault#credentialtheft#YARAdetection#FastlyCDN#privilegeescalationActorsAPT29 · MinidionisIOCf1 · i1 · d0 · u0MITRE42RegionsCHIndustriesTechnology
FILEMembersJul 16, 2026, 13:50 (UTC+9)Cert-Mill Hides Inside Chinese Adware Supply Chain
Seventeen of nineteen enriched binaries in a newly mapped cluster of Chinese PC-utility software carry a code-signing certificate issued through the identical "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" chain — yet the certificates were issued to at least five differently named Chinese companies, none of which appear to share ownership on paper.
#Ludashi#Chinad#Polarwind#code-signingabuse#DigiCertcertificatechain#ChinaMobileAS9808#PubNubRAT#adware/PUAsupplychainActorsAPT23 · KeyBoyIOCf37 · i4 · d4 · u2MITRE8
FILEMembersJul 15, 2026, 21:56 (UTC+9)Four Signers, One Playbook: Stolen Certs Mask VPN Trojans
A trojan-tagged VPN utility called upWire.exe carries a fully valid EV code-signing chain from WEILAI NETWORK TECHNOLOGY CO., LIMITED, chained through GlobalSign GCC R45 EV CodeSigning CA 2020 — and still draws 29 of 74 engine detections. That contradiction sits at the center of a file set CTX Team has been tracking: nine dossiers, at least four distinct commercial signing identities, and a consistent trick underneath all of them — wrap a PUA or trojan dropper in a legitimate-looking VPN,…
#code-signingabuse#EVcertificatefraud#VPNtrojandropper#BrightData#WEILAINETWORKTECHNOLOGY#AS24429infrastructure#PBotstealer#supplychaintrustexploitationActorsCactus · Cactus Ransomware GroupIOCf49 · i9 · d33 · u8MITRE34
FILEMembersJul 15, 2026, 05:36 (UTC+9)Fake RDR2 Crack Installer Feeds DBatLoader Chain to Recycled Hosting
Two "setup.exe" installers claiming to be a FitGirl-style repack of Red Dead Redemption 2 have quietly become one of the more efficient initial-access vectors observed on public malware-sharing telemetry this year — not because the lure is novel, but because of what happens after a victim runs it. Both installers trigger a DBatLoader sandbox verdict [T1204], and one of them has been submitted 14,889 times from 3,664 unique sources, a distribution footprint that reads less like a targeted…
#DBatLoader#crackedsoftwarelure#MSILloader#VoidArachne#SilverFox#maliciousinfrastructurereuse#coinminer#IDSsignatureoverlapActorsVoid Arachne · Silver FoxIOCf10 · i4 · d2 · u0RegionsBR · PT
FILEMembersJul 13, 2026, 21:51 (UTC+9)Valid 360 EV Certificate Still Gets Flagged by AV, Trips IDS
Four Windows binaries branded as a "游戏助手" (game assistant) utility package carry a fully valid Extended Validation code-signing chain from Beijing Qihu Technology Co., Ltd. — the entity behind the 360 security and gaming ecosystem — chained through GlobalSign GCC R45 EV CodeSigning CA 2020 under certificate serial 77 D9 12 68 10 B4 7A D8 41 65 66 51. That should be the strongest trust signal a Windows binary can carry.
#Qihu360#EVcode-signingabuse#GameAssistant#adware#PUA#Steamcrackmalware#CDNcertificatesharing#misattributionActorsSnowglobe · Animal FarmIOCf10 · i7 · d0 · u0MITRE18
FILEMembersJul 13, 2026, 05:44 (UTC+9)APT33-Tagged File Catalog Is Mostly Public Webshell Kits
A record tagged to APT33 and carrying twenty file indicators turns out, on close reading, to be dominated not by a bespoke intrusion toolkit but by a corpus of long-public penetration-testing webshells — the same php-backdoor.php, cmdasp.asp, and cmd.jsp files that have circulated on GitHub archives like Webshells-main, fuzzdb-webshell, and Laudanum for well over a decade.
#APT33#webshells#YARAdetection#Laudanumtoolkit#netcat#OWASPZAP#falsepositiveattribution#AWSS3infrastructureActorsAPT33 · MagnalliumIOCf29 · i0 · d1 · u2MITRE7
FILEMembersJul 12, 2026, 21:58 (UTC+9)Free KMS Activator Ships With a Windows Defender Kill-Switch
A single cracked-software binary — sold to casual users as a free Windows activation tool — is quietly stacking four distinct evasion techniques into one package: a code-signing certificate that traces to a root nobody trusts, a UPX-packed payload that dumps itself at the original entry point, a named registry indicator for disabling Windows Defender, and anti-debug stalling behavior.
#KMSactivator#crackedsoftware#WindowsDefenderbypass#UPXpacking#code-signingcertificateabuse#GamaredonGroup#ad-frontedinfrastructure#malwareloaderreuseActorsGamaredon Group · CTIGIOCf11 · i1 · d0 · u0MITRE19IndustriesDefense
FILEMembersJul 12, 2026, 05:55 (UTC+9)Same XMRig Miner Build Resurfaces Under New Names Since 2019
A single compiled Windows binary — identified by the import-table fingerprint imphash 91ae93ed3ff0d6f8a4f22d2edd30a58e — has been circulating since June 2019, and a fresh copy of the same build turned up again as recently as June 17, 2025. Six files share that imphash, an identical rich PE header hash (50dce46bb94bc57fb0152942a792d7e2), the same PE compile timestamp (2018-09-04) and the same entry point (31187).
#XMRig#cryptominingmalware#PyInstaller#UPXpacking#RampantKittenmisattribution#commoditymalware#living-off-the-landmasquerading#malwareclusteringActorsRampant KittenIOCf8 · i1 · d0 · u0MITRE8IndustriesConsulting
FILEMembersJul 11, 2026, 21:46 (UTC+9)Trojanized Ultrasurf Sample Wraps Genuine Signature in UPX Packer
A copy of Ultrasurf — the anti-censorship proxy client used for over two decades by activists and ordinary internet users to route around national firewalls — is circulating in a UPX-packed form that nineteen of 74 engines now flag as trojan or PUA activity, even though the file still carries a genuine Ultrareach Internet Corp. code-signing chain.
#Ultrasurf#codesigningabuse#UPXpacking#MuddyWater#SilentChollima#Glupteba#TorC2#circumventiontoolsActorsMuddyWater · TEMP.ZagrosIOCf4 · i1 · d1 · u1MITRE20IndustriesGovernment
FILEMembersJul 9, 2026, 19:04 (UTC+9)Same Femo IT Hosting Block Swaps Phishing for Amadey-Stealc Crimeware
The AS214351 hosting block operated out of Femo IT Solutions Limited's German netblocks has appeared in CTX Team's tracking before, tied to rapid certificate rotation behind phishing infrastructure. This snapshot shows the same three IPs — 62.60.226.159, 196.251.107.104, and 196.251.107.130 — still live, but every one of the nine files riding them is new. The ASN hasn't moved.
#AS214351#FemoITSolutions#Amadey#Stealcv2#clipboardhijacker#Rhadamanthys#KuCointyposquat#credentialtheftIOCf9 · i3 · d0 · u10MITRE48RegionsVNIndustriesTelecommunications
FILEMembersJul 9, 2026, 10:53 (UTC+9)Fleet of Look-Alike Domains Shares One WE1 Certificate Pipeline
Five domains in a seven-domain delivery fleet — cartmask.xyz, fluxautomation.cc, microlsireqjn.com, rabbitsbird.info and silversongs.info — were issued certificates by the same Google Trust Services intermediate, "WE1," inside a roughly one-month window running from June 6 to July 7, 2026. That kind of certificate-issuance cadence, layered on top of a shared Namecheap registration workflow across three of those domains, is the signature of tooling, not coincidence — an operator standing up…
#Lummastealer#ClipBanker#KMSpicocracklure#domainfleet#GoogleTrustServicesWE1#Namecheapregistration#code-signingspoofing#cryptocurrencyclipperIOCf5 · i1 · d7 · u14MITRE52RegionsCH · KE · USIndustriesHospitality & Leisure · Technology
FILEMembersJul 8, 2026, 10:45 (UTC+9)2008-Vintage Pushdo Downloader Resurfaces With Named C2 Signatures
A Win32 downloader carrying an eighteen-year-old compile timestamp surfaced in detection feeds eleven days ago, and once it started talking, it said something specific: named Snort and Emerging Threats signatures identify its outbound traffic as Pushdo botnet check-in behaviour, not generic malware noise. The binary's PE header reads 2008-09-12; its first appearance in detection telemetry is 2026-06-27 — a gap of roughly eighteen years that is consistent with a decade-old Cutwail/Pushdo builder…
#Pushdo#Cutwail#botnetdownloader#packedPEmalware#HIVELOCITYAS29802#threatintelligencemislabeling#IDSsignaturedetection#C2beaconingActorsPinchy Spider · SodinokibiIOCf3 · i9 · d10 · u7RegionsDE
FILEPublicJul 8, 2026, 02:52 (UTC+9)One Domain Runs Both Ends of a SWIFT-Themed Malware Chain
A domain named to evoke SWIFT bank-transfer messaging, registered through Dynadot Inc on 2022-06-10, has been quietly running both ends of an intrusion chain from one machine. swift-be.com is not fronting a CDN, is not split across a constellation of look-alike names, and is not hiding behind a bulletproof host. Instead, the same domain serves a PHP check-in script at swift-be.com/roks4/gate.php and a directly named executable payload at swift-be.com/roks4/shit.exe — both sitting under the…
#GorgonGroup#Subaat#swift-be.com#gate.phpC2#commoditydropper#Let'sEncryptcertificateabuse#manufacturingsectorBangladesh#PEpackerevasionActorsGorgon Group · SubaatIOCf2 · i0 · d1 · u2RegionsBDIndustriesManufacturing
FILEMembersJul 7, 2026, 18:55 (UTC+9)Batch-Registered Domains Mimic Baixaki to Push COMODO-Signed Adware
Three domains registered in the same transaction, at the same registrar, at the same second, are doing the work of an entire distribution network for a low-detection installer campaign. The apex domain, baixakialtcdn.com, and its two operational subdomains — os.baixakialtcdn.com and os2.baixakialtcdn.com — were all created through PDR Ltd.
#DealPly#PUP#Baixakiimpersonation#AzionCDN#COMODOcodesigning#domainsquatting#Brazil#bundledinstallerIOCf8 · i2 · d3 · u5MITRE34RegionsBR
FILEMembersJul 7, 2026, 11:09 (UTC+9)Six-Year-Old Emotet Macro Doc Still Evades a Third of AV Engines
A macro-enabled Word document that first surfaced in October 2020 is still doing exactly what it was built to do: get opened, auto-run its embedded VBA project, and quietly hand off to a follow-on payload — while nearly a quarter of the antivirus industry either misses it outright or can't parse the file at all. The sample, carrying the threat label "downloader.w97m/emotet," draws 46 flags out of 77 engines and a unanimous 3-for-3 malicious verdict across three separate sandboxes.
#Emotet#macrodownloader#VBAmalware#phishingattachment#sandboxdetection#GoDaddyhosting#Microsoft365#TA542ActorsEmotet Group · TA542IOCf4 · i0 · d2 · u4RegionsAT
FILEMembersJul 6, 2026, 19:21 (UTC+9)A 2008 Domain Wakes Up on a Contabo Asia IP
A certificate serial number is not supposed to outlive a decade of digital abandonment. But that is exactly what has happened to carltonbaggies.com, a domain registered through Bluehost Inc. back on 2008-02-19 — 6,698 days of registration history that included no meaningful hosting activity worth tracking, according to the record available to CTX Team.
#Silence#ContractCrew#WhisperSpider#domainreactivation#TLScertificateabuse#spearphishingattachment#drivermasquerading#ContaboAsiainfrastructureActorsSilence · Contract CrewIOCf7 · i2 · d6 · u2MITRE43
FILEMembersJul 6, 2026, 02:52 (UTC+9)Fake 'Elden Ring' Launcher Fools Sandboxes, Not 52 AV Engines
A binary calling itself "Elden Ring.exe" — and, in an alternate build, "Launcher Elden Ring.exe" — is not a cracked copy of a hit fantasy RPG. It is a dropper that static engines recognize almost immediately and dynamic sandboxes almost entirely miss, a split that is the real story here. Fifty-two of 75 antivirus engines flag the file (hash 32f34fb30fd47ab761e94306bc30432cd41d67309ab1e6b2599be2d70d3bd285) as malicious, carrying the label trojan.rancor/usblek26 along with community tags of…
#Snowglobe#AnimalFarm#babarbackdoor#Thailandtelecom#sandboxevasion#malwaredropper#koodgame.com#espionagemalwareActorsSnowglobe · Animal FarmIOCf3 · i0 · d1 · u0MITRE22RegionsTHIndustriesTelecommunications
FILEMembersJul 5, 2026, 16:36 (UTC+9)One Softonic EV Signature, Two Unrelated Malware Installers
A single Sectigo EV code-signing certificate — issued to SOFTONIC INTERNATIONAL SA and timestamped 04:20 PM on 06/24/2025 — sits behind two structurally unrelated Windows installers now circulating under the names of Hamachi, Termux, a casual game called "bee-movie-game," and a reminder utility called "minireminder." The binaries, catalogued as 68e4a2bfe728081eb1a84369f7dbad74c12c06a306cd5ad974ded8df3283a2ad and e8c438babbc09306f7a903f6e8f78b59ed395c81d541417c1b009b45bdc77040, share the…
#code-signingabuse#SectigoEVcertificate#Softonic#adware.offercore#CloudFrontinfrastructure#installermasquerading#DustSquad#lummastealerActorsDustSquad · APTC34IOCf2 · i0 · d1 · u2MITRE16RegionsEC
FILEPublicJul 1, 2026, 17:17 (UTC+9)NanoCore RAT Sample Adds Sandbox-Evasion Tricks, Beacons to Dead DuckDNS Domain
A 280-kilobyte Windows executable carrying the internal name En2m7acq.exe — tagged internally as product "Unemawermaq" — has surfaced with a detection profile that reads less like a novelty and more like a warning about how far anti-analysis engineering has trickled down into everyday commodity malware. Fifty-nine of 77 antivirus engines flag the file outright, and all three sandboxes that processed it — VMRay, C2AE, and Zenbox — converge on the same verdict: a NanoCore Remote Access Trojan,…
#NanoCoreRAT#Codoso#APT19#DuckDNS#sandboxevasion#dynamicDNSC2#commoditymalware#espionageattributionActorsCodoso · Sunshop GroupIOCf2 · i0 · d1 · u0MITRE17
FILEMembersJun 30, 2026, 10:01 (UTC+9)Decade-Old njRAT Stub Pair Resurfaces as 'Black Atlas' Campaign
Two unsigned Windows executables sharing an identical import-table hash and an identical compile timestamp are the spine of a njRAT cluster that a threat feed has only just begun surfacing under the label "Operation Black Atlas" — despite the underlying files dating to October 2014. The binaries, catalogued as c81b26e4b7cc5d3b3ab7aedb9da06b6b1cf863a2d475ac12f590b5b2a18e515a (internally named Stub.exe, 96KB) and b85913770053b4ac5ba69766924f6aab10e1ccc346bfb09571debdbd1bf37727 (internally named…
#njRAT#OperationBlackAtlas#dynamicDNS#No-IP#retailsector#malwarecluster#commandandcontrol#imphashanalysisActorsOperation Black AtlasIOCf5 · i0 · d1 · u0MITRE33RegionsUSIndustriesRetail
FILEMembersJun 29, 2026, 21:46 (UTC+9)Dormant Domain Wakes Days Before New Invoice-Lure Malware Wave
Seven months after a Namecheap registrant quietly stood up xingtialai.com, the domain's operators finally bothered to secure it: a Let's Encrypt certificate was issued for the site on 2026-06-23, and the origin server behind it picked up its own certificate two days earlier, on 2026-06-21. Within a week, on 2026-06-29, two brand-new files — an invoice-themed .NET loader and the RAR archive that appears to have delivered it — surfaced carrying anti-sandbox timers and debugger checks.
#credentialtheft#browsersecretsstealer#invoicelure#anti-sandboxevasion#xingtialai.com#OVHinfrastructure#KeyLogger#MicroClipIOCf21 · i1 · d1 · u0MITRE38RegionsAU · CN · DE · HUIndustriesSupport Services · Telecommunications
FILEPublicJun 29, 2026, 05:56 (UTC+9)Dormant Domain Aged Three Years to Target Iraq's Auto Sector
##A Three-Year Wait to Strike: How a Dormant Domain Became the Gateway for Iraq's Automotive Sector Attack Sometime in July 2023, an operator registered datausercenterphx.com through Namecheap and then, apparently, did nothing with it. No certificate was issued. No payload was staged. The domain sat parked against Namecheap's own forwarding nameservers — dns1.registrar-servers.com and dns2.registrar-servers.com — accumulating age and, with it, the kind of passive domain reputation that…
#domainaging#Iraq#automotivesector#processinjection#datadestruction#sandboxevasion#Contaboinfrastructure#downloaderIOCf11 · i2 · d1 · u2MITRE26RegionsIQIndustriesAutomotive
FILEMembersJun 29, 2026, 01:36 (UTC+9)Same LummaStealer Build Reused Twice Across Two-Month Gap
An unsigned LummaStealer binary — identical import table, identical structural hash, identical PE compile timestamp — has surfaced twice in two months from the same fake Snapchat-mod-APK download site, first in May under the VirusTotal-derived label aco4cpki and again in July as millenium/milnmrat. The reuse is not a stylistic echo; it is the same build.
#LummaStealer#crimeware#stealermalware#VBScriptlauncher#TelegramC2#cryptowallettheft#maliciousAPKlure#UpatredownloaderIOCf20 · i0 · d1 · u10MITRE57RegionsMG · US
FILEMembersJun 28, 2026, 02:17 (UTC+9)Trojanised BitTorrent Installer Evades 74 of 75 AV Engines in 33-Country Campaign
A 4.3 MB Windows executable presenting full BitTorrent branding — product name "BT® Classic," version 51.1054.0.0, copyright "©2026 BitTorrent Limited" — is circulating as a trojanised installer that achieves a 1-in-75 detection rate while routing harvested credentials to a colocation block in Iceland whose servers answer with a *.utorrent.com TLS certificate.
#trojanisedinstaller#credentialharvesting#WebView2credentialstores#Icelandcolocationinfrastructure#CloudFrontC2#governmentandtelecomtargeting#BobSoftpacker#BitTorrentlureIOCf53 · i5 · d2 · u0MITRE70RegionsAD · AR · AT · BAIndustriesGovernment · Media · Technology
FILEPublicJun 27, 2026, 14:07 (UTC+9)ZBot Dropper Targets Italy's Food Sector in Espionage Campaign
A 191-kilobyte Windows executable named to look like a scanned document attachment has been circulating against Italian food and beverage companies, carrying a layered evasion stack that walks past automated analysis environments before injecting a PandaBanker payload into a legitimate host process. The file — submitted to VirusTotal under the name Allegato_02,Allegato_01.Tif.exe, where allegato is Italian for "attachment" — exploits the double-extension convention to make a Win32 executable…
#BambooSpider#PandaBanker#ZBot#VBInject#foodandbeveragesector#Italy#processinjection#sandboxevasionActorsBamboo SpiderIOCf2 · i0 · d0 · u0MITRE37RegionsITIndustriesFood & Beverages
FILEMembersJun 27, 2026, 10:16 (UTC+9)One Stolen Microsoft Cert Binds Four-Malware Toolkit Targeting Farms
A financially motivated operator has assembled a four-component malware toolkit — Azorult credential stealer, ClipBanker cryptocurrency hijacker, a KillAV module, and an Andromeda dropper — and stamped every piece with the same stolen or forged Microsoft Corporation code-signing certificate, serial number 33 00 00 01 87 72 17 72 15 59 40 C7 09 00 00 00 00 01 87, signing date 2020-07-20.
#Azorult#ClipBanker#Andromeda#KillAV#code-signingcertificateabuse#agriculturesector#BrazilColombiaItaly#PS2EXEIOCf9 · i2 · d0 · u2MITRE43RegionsBR · CO · ITIndustriesAgriculture
FILEMembersJun 27, 2026, 09:45 (UTC+9)Ten-Year-Old ranapama Injector Still Harvesting US Retail Credentials in 2026
A Win32 injector compiled in June 2015 and first submitted to public malware repositories that same month is running active credential-theft operations against US retail targets in 2026 — not as a curiosity or a legacy artifact, but as a functional, evasion-engineered payload routing traffic through a 51-node relay pool spanning at least ten autonomous systems across Eastern Europe, the Caucasus, and Western Europe.
#ranapama#processhollowing#credentialharvesting#USretail#sandboxevasion#LeaseWebNetherlands#EasternEuroperelayinfrastructure#packedinjectorIOCf1 · i51 · d0 · u8MITRE30RegionsUSIndustriesRetail
FILEMembersJun 27, 2026, 05:44 (UTC+9)One lolMiner Kit, Repackaged 20 Ways, Beats Static Detection
Twenty of the forty-three file indicators feeding this campaign are not independent malware samples — they are one dropped cryptomining toolkit, copied and renamed across batch scripts, shell scripts, a VBA-tagged loader pair, a ZIP archive and a single compiled Windows binary. Every one of them shares the identical directory scaffold resources/bin/lolminer/1.98a/ and duplicated install paths under %ProgramFiles%\CommonProgramFiles(x86)\microsoft shared\{bc4eaae6|71d5719f}\lolminer\1.98a\.
#lolMiner#cryptojacking#batchscriptmalware#dynamicDNSinfrastructure#unsignedbinaries#multi-coinmining#Dynu#ContabohostingIOCf43 · i2 · d2 · u2MITRE48RegionsAU · BE · BR · CAIndustriesConstruction · Media · Retail
FILEMembersJun 26, 2026, 22:27 (UTC+9)njRAT Campaign Hides C2 Behind Free Cloud Platforms for Three Years
An njRAT operator running a build pipeline that has remained functionally intact since at least February 2023 has systematically routed command-and-control traffic through Cloudflare Pages, Netlify, and Render — three free-tier hosting platforms whose shared wildcard TLS certificates make per-subdomain blocking operationally impractical without disrupting entire legitimate services.
#njRAT#Bladabindi#free-tierPaaSabuse#AES-encrypteddelivery#.NETReactor#UACbypass#DDNSinfrastructure#VietnamhostingIOCf7 · i1 · d5 · u4MITRE32RegionsUS
FILEPublicJun 26, 2026, 18:17 (UTC+9)Fake Chinese PDF App Delivers ValleyRAT to Jordan's Food Sector
A 1,649-kilobyte Windows executable named kvipgui.exe — dressed as "极光PDF" (Aurora PDF), a plausible Chinese productivity application — has been circulating as a ValleyRAT shellcode runner targeting food and beverage organisations in Jordan, according to CTX Team analysis. The binary's most immediate deception is structural: it carries a DigiCert-rooted code-signing certificate issued to Shanghai entity 茉柏枘（上海）软件科技有限公司 that expired on 30 May 2024, yet the PE timestamp reads 29 April 2024 and…
#VoidArachne#ValleyRAT#foodandbeveragesector#Jordan#code-signingcertificateabuse#shellcoderunner#C2infrastructure#sandboxevasionActorsVoid Arachne · Silver FoxIOCf2 · i1 · d0 · u0MITRE26RegionsJOIndustriesFood & Beverages
FILEMembersJun 26, 2026, 10:15 (UTC+9)A ZIP, a Batch Script, a Fake PDF Previewer: Inside a Staged Malware Chain
A cluster of 24 file indicators submitted between June 1 and June 24, 2026 traces a delivery pattern that looks less like a single tailored intrusion and more like an assembly line: an archive carrying one batch script, a MSIL loader wearing the metadata of a document-preview utility, and a separate stealer sample whose YARA hits span everything from ransomware command detection to crypto-wallet browser extension harvesting.
#AgentTesla#XWorm#commoditymalware#MSILloader#ZIParchivedelivery#browsercredentialtheft#sandboxevasion#builder-kitmalwareIOCf24 · i1 · d0 · u1MITRE38RegionsBR · EG · ES · GBIndustriesAutomotive · Consulting · Education & Research
FILEMembersJun 26, 2026, 02:43 (UTC+9)EV Certificate Held 13 Months Before Signing Four Malicious Payloads
Four Windows executables and an MSI installer, all bearing a valid Sectigo Extended Validation code-signing certificate issued to a company called "ORYON TECH LIMITED," began circulating through cracked-software distribution channels in April 2026 — but the certificate that makes them look legitimate to Windows SmartScreen and most endpoint defences was acquired more than a year before the first payload ever appeared.
#ORYONTECHLIMITED#Microleaves#Legionadware#LummaStealer#EVcertificateabuse#pay-per-install#sandboxevasion#RomaniaIOCf20 · i1 · d5 · u13MITRE29RegionsSRIndustriesRetail · Telecommunications
FILEMembersJun 25, 2026, 22:43 (UTC+9)Single Obfuscation Builder Links BAT Stager and MSIL Dropper in 19-Country Campaign
An 8-kilobyte DOS batch file and an 85-kilobyte .NET executable — separated by file type, detection rate, and apparent purpose — turn out to share a single obfuscation fingerprint that binds them into a deliberately engineered attack chain. The YARA rule SUSP_PS1_JAB_Pattern_Jun22_1, authored by Florian Roth of Nextron Systems and drawn from the Neo23x0 signature-base, co-fires on both components: the batch stager (SHA-256 02af6b5d…) and the MSIL dropper (SHA-256 d35dbfec…).
#MSILdropper#BATstager#PowerShelldownloader#Bitviseimpersonation#content-typespoofing#sandboxevasion#technologysector#multi-countrycampaignIOCf9 · i0 · d1 · u2MITRE30RegionsAT · BD · CA · CHIndustriesAgriculture · Education & Research · Media
FILEMembersJun 25, 2026, 18:28 (UTC+9)Salty Spider Hides Expiro in Adobe's Own Sandbox Temp Path
A 60-kilobyte GZIP archive, first submitted to VirusTotal on 22 March 2025, sits at the centre of an evasion architecture that has so far produced zero detections across 78 scanning engines. The file's distinguishing feature is not its contents — those remain opaque without a sandbox verdict — but where it lives: every observed submission path resolves to C:\Users\user\AppData\Local\Temp\acrocef_low\, the low-integrity process temp directory belonging to Adobe Acrobat's Chromium Embedded…
#SaltySpider#Expiro#AdobeAcrobatCEFsandbox#CDNcertificatemasquerade#AkamaiTLSspoofing#DigiRomaniaASN8708#enterpriseendpointevasion#fileinfectorActorsSalty Spider · KuKuIOCf55 · i1 · d0 · u0MITRE29
FILEMembersJun 25, 2026, 14:18 (UTC+9)Gorgon Group Wraps Commodity Stealers in Four-Layer Evasion Stack
A GZIP archive bearing the filename "RFQ Number QUO19009852.exe" is the outermost layer of a credential-theft operation that CTX Team has been tracking against Windows endpoints. The file is unremarkable at first glance — a compressed archive mimicking a supplier quotation request, the kind of attachment that moves through purchasing inboxes without triggering much suspicion.
#GorgonGroup#ponystealer#predator_pain#PEiDpacking#spear-phishing#credentialtheft#anti-forensictimestamp#procurementlureActorsGorgon Group · SubaatIOCf7 · i0 · d0 · u0MITRE41
FILEMembersJun 25, 2026, 10:07 (UTC+9)LummaStealer Campaign Hides Nine C2 Domains Behind One Server
Nine command-and-control domains provisioned in a single week in December 2025 form the backbone of an active LummaStealer campaign targeting India — and the infrastructure's construction reveals an operator who planned for partial takedown from the outset. Eight of those domains share a single self-signed TLS certificate serial and, in seven cases, a single resolving IP address, meaning the elaborate domain pool amounts to DNS-level wallpaper over one physical server.
#LummaStealer#AutoItdropper#C2infrastructure#India#credentialtheft#self-signedTLS#malware-as-a-service#infrastructurecompartmentalisationIOCf10 · i0 · d9 · u17MITRE31RegionsIN
FILEMembersJun 23, 2026, 22:05 (UTC+9)WZTeam KMS Trojan Stacks Five Evasion Layers Behind 23-Year Cert
##A 23-Year Certificate and Five Stacked Evasion Layers: Inside the WZTeam KMS Trojan Chain Three UPX-packed Windows executables presenting as KMSAuto++ activation tools have been circulating with a self-issued code-signing certificate that carries a validity window stretching to the year 2039 — a deliberate, long-lived signing identity engineered to pass casual inspection at the moment a user decides whether to run a crack.
#WZTeam#KMSAuto#Koadic#PowerShelldownloader#code-signingabuse#Mexico#Philippines#defenseevasionActorsAPT27 · TEMP.HippoIOCf9 · i1 · d0 · u2RegionsMX · PH
FILEMembersJun 23, 2026, 06:07 (UTC+9)Fake uTorrent Installers Pair Valid Code Signing With CDN Impersonation
A cluster of Windows installers dressed up as the BitTorrent and uTorrent clients is circulating alongside a supporting network layer that borrows something rarely seen in commodity adware distribution: wildcard TLS certificates minted for someone else's brand. Three unrelated hosting providers — Digi Romania S.A. (AS8708, Romania), Advania Island ehf (AS50613, Iceland), and a Singapore-registered network called ACE (AS139341) — each present certificates whose subject lines point to major CDN…
#BitTorrent#uTorrent#code-signingcertificate#CDNimpersonation#wildcardTLScertificate#CloudFront#adware#bundlewareinstallerIOCf28 · i4 · d2 · u0MITRE46RegionsBR · CA · CG · CHIndustriesEducation & Research · Technology · Telecommunications