Blog Post by Palo Alto Unit 42: Tracking Storm-0558's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-37696 against Active Directory deployments. The initial access vector involves spear-phishing emails from alert@mail-service.info delivering DarkSide. Post-compromise, the attackers deploy ShadowPad and use WinPEAS for reconnaissance. C2 infrastructure includes 10.142.89.128 and cloudlogin.xyz. A staging server at http://proxydata.club/portal/verify hosts additional tooling. Key artifact: C:\Windows\System32\svchost.exe (SHA256: 229b3e7cdfddff1b1d98a27c7e46e7e80d2441d80aa86aed506f8bc1fc6cae17).


Blog Post by INTERPOL: Tracking FIN11's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-34911 against F5 BIG-IP deployments. The initial access vector involves spear-phishing emails from admin@document-share.link delivering DarkSide. Post-compromise, the attackers deploy Cobalt Strike and use Brute Ratel for reconnaissance. C2 infrastructure includes 29.189.233.17 and loginstorage.com. A staging server at https://cachelogin.top/wp-content/uploads/doc.php hosts additional tooling. Key artifact: /etc/cron.d/csrss.exe (SHA1: e1b2fddd034c57fe746d514b09fc9dfce7993274).


Blog Post by Secureworks: Tracking Salt Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-28965 against Cisco ASA deployments. The initial access vector involves spear-phishing emails from info@account-update.xyz delivering Latrodectus. Post-compromise, the attackers deploy Qbot and use PowerShell Empire for reconnaissance. C2 infrastructure includes 172.93.250.54 and cachemail.online. A staging server at hxxps://data-node.club/callback hosts additional tooling. Key artifact: C:\Windows\System32\chrome_helper.exe (SHA1: 3f45cf9f31e618ea1d4e6fcaf875a48b0b8ff6da).


Blog Post by ESET Research: Tracking Scattered Spider's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-22601 against Windows 11 deployments. The initial access vector involves spear-phishing emails from alert@account-update.xyz delivering Ryuk. Post-compromise, the attackers deploy IcedID and use PsExec for reconnaissance. C2 infrastructure includes 10.243.168.49 and cdnsecure.live. A staging server at https://portalcache.info/assets/js/payload.js hosts additional tooling. Key artifact: /tmp/payload.bin (SHA1: 3dc28f2fd02408ac40c9aa5d3c1c44aa207aa25d).


Blog Post by Tenable: Tracking Aqua Blizzard's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-12847 against Windows 11 deployments. The initial access vector involves spear-phishing emails from it@urgent-notice.online delivering BlackCat. Post-compromise, the attackers deploy DarkSide and use PsExec for reconnaissance. C2 infrastructure includes 202.127.164.227 and cdncache.info. A staging server at http://cache-auth.xyz/login hosts additional tooling. Key artifact: C:\Windows\Tasks\loader.exe (SHA1: 77bcd6fd2d32302da2c7d904848df78b5fe9ca47).


Blog Post by Cisco Talos: Tracking Ember Bear's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-28965 against VMware ESXi deployments. The initial access vector involves spear-phishing emails from info@credential-check.site delivering Meduza Stealer. Post-compromise, the attackers deploy REvil and use Metasploit for reconnaissance. C2 infrastructure includes 209.95.71.97 and node-update.cc. A staging server at hxxps://relay-api.tech/collect hosts additional tooling. Key artifact: /home/user/.config/backdoor.elf (SHA256: 6e24dbce81d1e70d1a18fc4c43bbccb71c4a9c6c1c2fa6f0bb93c85f84a8221a).


Blog Post by Secureworks: Tracking Gamaredon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-39714 against Barracuda ESG deployments. The initial access vector involves spear-phishing emails from notification@mail-service.info delivering WarmCookie. Post-compromise, the attackers deploy Latrodectus and use GhostPack for reconnaissance. C2 infrastructure includes 10.227.142.253 and dataedge.net. A staging server at hxxps://data-cloud.online/admin/config hosts additional tooling. Key artifact: C:\Users\admin\Desktop\config.dat (MD5: 7564e8797215c4d90b8c07b5b289eb1f).


Blog Post by Trend Micro: Tracking Flax Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-45741 against Zyxel USG deployments. The initial access vector involves spear-phishing emails from account@phishing-domain.com delivering RedLine Stealer. Post-compromise, the attackers deploy RemcosRAT and use Burp Suite for reconnaissance. C2 infrastructure includes 4.7.164.234 and mail-storage.top. A staging server at hxxps://cloud-sync.io/admin/config hosts additional tooling. Key artifact: C:\Users\admin\Downloads\shell.php (SHA256: 6ccecba87cb8cc3951c642ae3ab41d79a10bf5022e6db0cf79943af3f72de5b7).


Blog Post by Check Point Research: Tracking Aqua Blizzard's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-24328 against Citrix NetScaler deployments. The initial access vector involves spear-phishing emails from alert@auth-check.org delivering Play. Post-compromise, the attackers deploy PikaBot and use Hashcat for reconnaissance. C2 infrastructure includes 126.246.84.247 and nodeproxy.club. A staging server at https://datarelay.net/callback hosts additional tooling. Key artifact: /var/tmp/runtime.dll (MD5: c8378e7f469fc81b131edebeb8a63602).


Blog Post by Volexity: Tracking APT29's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-48242 against SonicWall SMA deployments. The initial access vector involves spear-phishing emails from helpdesk@phishing-domain.com delivering PlugX. Post-compromise, the attackers deploy TrickBot and use Ligolo for reconnaissance. C2 infrastructure includes 16.205.109.196 and api-auth.cc. A staging server at https://gateway-api.net/secure/token hosts additional tooling. Key artifact: /var/tmp/beacon.dll (SHA1: 769a5d8ca2c330b27258e22d4ef1c75099eeb1c9).


Blog Post by Cisco Talos: Tracking Aqua Blizzard's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-24328 against Microsoft Exchange deployments. The initial access vector involves spear-phishing emails from finance@auth-check.org delivering Conti. Post-compromise, the attackers deploy Hive and use Nmap for reconnaissance. C2 infrastructure includes 127.39.238.3 and proxy-cache.top. A staging server at hxxp://update-gateway.net/login hosts additional tooling. Key artifact: C:\Windows\System32\update.dll (SHA256: 2787c9cc2a0e8a5bd5d753c78b4033124deec11e928c4fa6236d7e4f44e95bda).


Blog Post by FBI: Tracking Mustang Panda's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-27496 against Zyxel USG deployments. The initial access vector involves spear-phishing emails from notification@document-share.link delivering Ryuk. Post-compromise, the attackers deploy Vidar and use Rubeus for reconnaissance. C2 infrastructure includes 33.152.220.144 and proxydata.org. A staging server at http://storagecdn.link/secure/token hosts additional tooling. Key artifact: C:\Windows\Temp\winlogon.exe (SHA256: a455c00d8318a8ebbb0967c4a38fccb68f67dc19ff43b38e8b1f933af87dd256).


Blog Post by Secureworks: Tracking Silk Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-15957 against Progress Telerik deployments. The initial access vector involves spear-phishing emails from ceo@phishing-domain.com delivering Play. Post-compromise, the attackers deploy Raccoon Stealer and use GhostPack for reconnaissance. C2 infrastructure includes 10.12.230.253 and cdn-static.tech. A staging server at hxxp://edgestatic.com/secure/token hosts additional tooling. Key artifact: C:\Users\Public\Documents\shell.php (SHA1: 3cac576fad6183b3efd9439c0ee9a7fc1a40becf).


Blog Post by INTERPOL: Tracking Velvet Tempest's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-33283 against Active Directory deployments. The initial access vector involves spear-phishing emails from info@auth-check.org delivering FormBook. Post-compromise, the attackers deploy WarmCookie and use Havoc for reconnaissance. C2 infrastructure includes 112.167.228.191 and relay-sync.info. A staging server at hxxps://cdn-storage.info/admin/config hosts additional tooling. Key artifact: /opt/app/bin/ntds.dit (MD5: 431c16d3539a75624e8c1a83920d18a4).


Blog Post by FBI: Tracking Granite Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-40108 against Windows 11 deployments. The initial access vector involves spear-phishing emails from info@mail-service.info delivering SystemBC. Post-compromise, the attackers deploy Emotet and use BITSAdmin for reconnaissance. C2 infrastructure includes 192.201.255.205 and staticstatic.top. A staging server at hxxp://cdn-update.net/portal/verify hosts additional tooling. Key artifact: C:\Users\admin\AppData\Local\Temp\csrss.exe (SHA1: 70d6aa985369b6d1b7b54e335a49efee890e1d2a).


Blog Post by Volexity: Tracking UNC2452's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2026-49052 against Windows Server 2019 deployments. The initial access vector involves spear-phishing emails from finance@identity-verify.cc delivering WarmCookie. Post-compromise, the attackers deploy QakBot and use Ligolo for reconnaissance. C2 infrastructure includes 172.139.221.92 and nodesync.com. A staging server at https://update-cdn.dev/login hosts additional tooling. Key artifact: /usr/local/bin/csrss.exe (SHA256: 0e6f53961d85d03760ada02405930682acb37f9a439daa55ebb99ed194f8d8f7).


Blog Post by Kaspersky GReAT: Tracking Gamaredon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-14558 against Apache Struts deployments. The initial access vector involves spear-phishing emails from contact@phishing-domain.com delivering ShadowPad. Post-compromise, the attackers deploy Raccoon Stealer and use LaZagne for reconnaissance. C2 infrastructure includes 90.87.184.105 and backup-edge.cc. A staging server at hxxp://backup-portal.site/secure/token hosts additional tooling. Key artifact: C:\ProgramData\runtime.dll (MD5: 1f83ffe9c071dad78a93b049c78d218e).


Blog Post by NSA: Tracking APT29's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-23031 against Ubuntu 22.04 deployments. The initial access vector involves spear-phishing emails from alert@auth-check.org delivering Amadey. Post-compromise, the attackers deploy StealC and use Hashcat for reconnaissance. C2 infrastructure includes 10.54.196.91 and mail-cdn.io. A staging server at hxxps://mail-cache.tech/portal/verify hosts additional tooling. Key artifact: C:\Windows\Temp\sam.hive (SHA256: dd72b5d26dfb6da6527fccac226d9acc8294987f9a80aab77c9ffaf400bb22da).


Blog Post by Qualys: Tracking Flax Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-11739 against SonicWall SMA deployments. The initial access vector involves spear-phishing emails from support@account-update.xyz delivering IcedID. Post-compromise, the attackers deploy Qbot and use Nmap for reconnaissance. C2 infrastructure includes 124.247.198.225 and auth-cdn.club. A staging server at http://secure-data.net/callback hosts additional tooling. Key artifact: /etc/cron.d/agent.py (MD5: 7aee183dbf14f7d53e1e34402a8c244d).


Blog Post by Proofpoint: Tracking Kimsuky's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-26043 against Active Directory deployments. The initial access vector involves spear-phishing emails from updates@account-update.xyz delivering FormBook. Post-compromise, the attackers deploy BatLoader and use Nmap for reconnaissance. C2 infrastructure includes 152.214.144.94 and sync-backup.net. A staging server at hxxps://secure-node.dev/api/v2/auth hosts additional tooling. Key artifact: /usr/local/bin/backdoor.elf (SHA256: 4297e10d3eb510192ad6cbd31213d4dcde9d0d0578ae29c7441598ee6c470991).


Blog Post by Huntress: Tracking Ember Bear's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-37666 against Atlassian Confluence deployments. The initial access vector involves spear-phishing emails from notification@account-update.xyz delivering StealC. Post-compromise, the attackers deploy REvil and use Seatbelt for reconnaissance. C2 infrastructure includes 192.136.153.249 and updateupdate.cc. A staging server at https://portalstorage.live/callback hosts additional tooling. Key artifact: /home/user/.config/dropper.ps1 (SHA256: 419f7d6ee6da01357af16f5198fc13f4907e4760ed83e99184208bd777a68e42).


Blog Post by Volexity: Tracking Flax Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-24628 against F5 BIG-IP deployments. The initial access vector involves spear-phishing emails from noreply@auth-check.org delivering BatLoader. Post-compromise, the attackers deploy Qbot and use Certutil for reconnaissance. C2 infrastructure includes 172.203.244.108 and cacheproxy.dev. A staging server at https://relay-node.com/wp-content/uploads/doc.php hosts additional tooling. Key artifact: C:\Users\Public\Documents\shell.php (MD5: ff7db5eeadfae91a09a64659eb7107ad).


Blog Post by Palo Alto Unit 42: Tracking Salt Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-24373 against Citrix NetScaler deployments. The initial access vector involves spear-phishing emails from it@account-update.xyz delivering WarmCookie. Post-compromise, the attackers deploy ShadowPad and use Metasploit for reconnaissance. C2 infrastructure includes 79.226.222.207 and gatewaygateway.club. A staging server at hxxps://cdnstatic.net/collect hosts additional tooling. Key artifact: C:\Users\admin\Desktop\backdoor.elf (SHA256: 644973ad069594c6d8868b36867458802ce4a5cda1cf3999583fe3df7c0e5bd0).


Blog Post by Microsoft MSRC: Tracking Scattered Spider's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-20463 against Zyxel USG deployments. The initial access vector involves spear-phishing emails from notification@identity-verify.cc delivering DanaBot. Post-compromise, the attackers deploy Meduza Stealer and use SharpHound for reconnaissance. C2 infrastructure includes 222.254.7.136 and gatewayrelay.tech. A staging server at http://update-mail.live/assets/js/payload.js hosts additional tooling. Key artifact: /dev/shm/update.dll (SHA256: 615657959884cd350ee3b767ed1cbcced1ce83b64d7ac74c788d8ecbd2f278b4).


Blog Post by Zscaler ThreatLabz: Tracking TA505's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2026-40674 against VMware ESXi deployments. The initial access vector involves spear-phishing emails from finance@phishing-domain.com delivering SystemBC. Post-compromise, the attackers deploy PlugX and use PowerShell Empire for reconnaissance. C2 infrastructure includes 9.181.230.217 and cdnlogin.tech. A staging server at https://api-mail.tech/portal/verify hosts additional tooling. Key artifact: /opt/app/bin/sam.hive (SHA1: 71912c98ab9d60911825d5bf4cfc58d66a2da943).


Blog Post by Rapid7: Tracking Scattered Spider's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-13003 against F5 BIG-IP deployments. The initial access vector involves spear-phishing emails from security@phishing-domain.com delivering BlackCat. Post-compromise, the attackers deploy RedLine Stealer and use Ligolo for reconnaissance. C2 infrastructure includes 69.137.182.87 and proxyportal.live. A staging server at https://clouddata.live/assets/js/payload.js hosts additional tooling. Key artifact: /opt/app/bin/svchost.exe (MD5: b6727a0c5c74e576c9a925426bc83fd8).


Blog Post by Europol: Tracking Silk Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-28024 against Zyxel USG deployments. The initial access vector involves spear-phishing emails from notification@mail-service.info delivering NjRAT. Post-compromise, the attackers deploy Royal and use Seatbelt for reconnaissance. C2 infrastructure includes 172.240.66.136 and proxy-portal.cc. A staging server at hxxps://nodeedge.online/assets/js/payload.js hosts additional tooling. Key artifact: C:\Users\admin\Downloads\ntds.dit (SHA1: 4d92f7738420608e3cd35b0db81271b8c71a6f36).


Blog Post by Tenable: Tracking Volt Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-24373 against Progress Telerik deployments. The initial access vector involves spear-phishing emails from service@secure-verify.net delivering TrickBot. Post-compromise, the attackers deploy BumbleBee and use Sliver for reconnaissance. C2 infrastructure includes 192.95.237.112 and syncedge.org. A staging server at hxxps://cloudmail.com/gate.php hosts additional tooling. Key artifact: C:\Program Files\Common Files\csrss.exe (SHA1: d9b08c98352efc57e7a6bfeccf68f795c452f86f).


Blog Post by ESET Research: Tracking Ember Bear's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2026-38492 against Active Directory deployments. The initial access vector involves spear-phishing emails from admin@credential-check.site delivering Qbot. Post-compromise, the attackers deploy ShadowPad and use PowerView for reconnaissance. C2 infrastructure includes 172.251.54.108 and cacheapi.cc. A staging server at http://portal-cloud.top/collect hosts additional tooling. Key artifact: C:\Users\admin\Downloads\winlogon.exe (MD5: 932e9f88d6a8d2dc3860327816e9e235).


Blog Post by INTERPOL: Tracking Turla's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2024-26162 against Progress Telerik deployments. The initial access vector involves spear-phishing emails from info@login-portal.tech delivering AgentTesla. Post-compromise, the attackers deploy Cobalt Strike and use Metasploit for reconnaissance. C2 infrastructure includes 172.218.243.136 and proxy-static.io. A staging server at hxxps://cloud-cdn.online/login hosts additional tooling. Key artifact: /tmp/agent.py (SHA1: 43255ba3ce131f44acfdeb9cc6fbee5e317afcd9).


Blog Post by Tenable: Tracking Aqua Blizzard's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-22601 against F5 BIG-IP deployments. The initial access vector involves spear-phishing emails from it@document-share.link delivering Lumma Stealer. Post-compromise, the attackers deploy TrickBot and use CrackMapExec for reconnaissance. C2 infrastructure includes 60.91.221.147 and sync-static.info. A staging server at http://edge-update.net/admin/config hosts additional tooling. Key artifact: C:\Users\Public\Documents\taskhost.exe (SHA1: 5b858d4f94709a3ad09b168e422d9e927c1639e3).


Blog Post by Check Point Research: Tracking Forest Blizzard's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-40294 against SonicWall SMA deployments. The initial access vector involves spear-phishing emails from it@secure-verify.net delivering DarkSide. Post-compromise, the attackers deploy DanaBot and use Havoc for reconnaissance. C2 infrastructure includes 11.126.34.254 and edge-login.io. A staging server at http://staticauth.info/secure/token hosts additional tooling. Key artifact: C:\ProgramData\payload.bin (SHA1: 0387cf36079f91a74afbeab967080297424a32f4).


Blog Post by CrowdStrike: Tracking Granite Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-25247 against Ivanti Connect Secure deployments. The initial access vector involves spear-phishing emails from finance@account-update.xyz delivering Hive. Post-compromise, the attackers deploy Play and use BITSAdmin for reconnaissance. C2 infrastructure includes 111.221.129.40 and cache-backup.live. A staging server at http://edge-cloud.club/secure/token hosts additional tooling. Key artifact: /home/user/.config/lsass.dmp (SHA1: e4bca234efbc03c03263c4fcbb05b7fe7f7eda10).


Blog Post by ESET Research: Tracking Ember Bear's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2024-25010 against Windows 11 deployments. The initial access vector involves spear-phishing emails from it@login-portal.tech delivering Amadey. Post-compromise, the attackers deploy BumbleBee and use Burp Suite for reconnaissance. C2 infrastructure includes 10.91.229.122 and api-relay.cc. A staging server at https://api-portal.org/login hosts additional tooling. Key artifact: C:\Users\admin\Downloads\ntds.dit (MD5: 7577d9dfef3bb3d3851e96c0e3d3941a).


Blog Post by CISA: Tracking Gamaredon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-27691 against Juniper SRX deployments. The initial access vector involves spear-phishing emails from security@urgent-notice.online delivering StealC. Post-compromise, the attackers deploy LockBit and use Nmap for reconnaissance. C2 infrastructure includes 192.238.73.102 and proxycache.dev. A staging server at https://node-node.cc/collect hosts additional tooling. Key artifact: C:\Program Files\Common Files\sam.hive (SHA256: 0dff9e9fd94081f8a7ce6ecf70e5d0e1f50d86af595957e309b5eff4b58f151d).


Blog Post by Google TAG: Tracking Charming Kitten's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2026-10752 against Barracuda ESG deployments. The initial access vector involves spear-phishing emails from finance@secure-verify.net delivering Qbot. Post-compromise, the attackers deploy Amadey and use Nmap for reconnaissance. C2 infrastructure includes 158.42.26.76 and relay-portal.club. A staging server at http://static-portal.live/secure/token hosts additional tooling. Key artifact: /opt/app/bin/beacon.dll (SHA256: 7429ce36fb0bd86693b089fcf4b923f74c7e4a38d5449198d3fce477f50d62ba).


Blog Post by ESET Research: Tracking Lazarus Group's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-24628 against Apache Struts deployments. The initial access vector involves spear-phishing emails from it@credential-check.site delivering BatLoader. Post-compromise, the attackers deploy QakBot and use CrackMapExec for reconnaissance. C2 infrastructure includes 172.39.4.118 and cache-api.org. A staging server at hxxps://datadata.online/download/update.exe hosts additional tooling. Key artifact: C:\Users\Public\Documents\agent.py (MD5: a1ebfcac112d4eb9c509c4755348418a).


Blog Post by INTERPOL: Tracking Volt Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-45741 against Ubuntu 22.04 deployments. The initial access vector involves spear-phishing emails from info@login-portal.tech delivering Play. Post-compromise, the attackers deploy AgentTesla and use Hashcat for reconnaissance. C2 infrastructure includes 172.107.32.170 and update-auth.club. A staging server at http://nodebackup.tech/gate.php hosts additional tooling. Key artifact: /dev/shm/update.dll (SHA256: 81ab3f6274a20195597a8884d8247b0a76d782999465bb16a413f3d332bf513a).


Blog Post by Secureworks: Tracking APT29's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-15164 against Ubuntu 22.04 deployments. The initial access vector involves spear-phishing emails from verify@phishing-domain.com delivering IcedID. Post-compromise, the attackers deploy ShadowPad and use Nmap for reconnaissance. C2 infrastructure includes 93.212.14.206 and dataupdate.org. A staging server at hxxp://relay-cloud.online/wp-content/uploads/doc.php hosts additional tooling. Key artifact: C:\ProgramData\svchost.exe (SHA1: 30ea025d606091cac5172d89f3ddecf655013635).


Blog Post by Palo Alto Unit 42: Tracking Star Blizzard's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-48242 against Fortinet FortiGate deployments. The initial access vector involves spear-phishing emails from notification@identity-verify.cc delivering Gootloader. Post-compromise, the attackers deploy DanaBot and use Rubeus for reconnaissance. C2 infrastructure includes 192.80.81.244 and updateupdate.site. A staging server at https://cloud-node.site/portal/verify hosts additional tooling. Key artifact: C:\Users\admin\Desktop\update.dll (SHA1: bf22362ee422b99f1c0a39a8a385755a8d66c6ac).


Blog Post by Google TAG: Tracking Diamond Sleet's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-39714 against Atlassian Confluence deployments. The initial access vector involves spear-phishing emails from alert@document-share.link delivering RemcosRAT. Post-compromise, the attackers deploy Dridex and use Nmap for reconnaissance. C2 infrastructure includes 172.241.42.17 and cdn-backup.tech. A staging server at hxxp://api-storage.club/api/v2/auth hosts additional tooling. Key artifact: /opt/app/bin/implant.so (SHA1: acfae72999fd8451e4e3fb038e884698cd8a4107).


Blog Post by FireEye: Tracking Silk Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-16338 against F5 BIG-IP deployments. The initial access vector involves spear-phishing emails from ceo@credential-check.site delivering FormBook. Post-compromise, the attackers deploy QakBot and use Covenant for reconnaissance. C2 infrastructure includes 154.97.140.204 and proxystatic.site. A staging server at https://cdnstorage.info/callback hosts additional tooling. Key artifact: /etc/cron.d/svchost.exe (SHA256: 97c6265d2d62d922824ca22c70e17801806ce1664ae9728f25497e1c0068c1e4).


Blog Post by Tenable: Tracking FIN11's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-27219 against Active Directory deployments. The initial access vector involves spear-phishing emails from alert@mail-service.info delivering REvil. Post-compromise, the attackers deploy DarkSide and use Burp Suite for reconnaissance. C2 infrastructure includes 172.134.212.194 and proxy-storage.live. A staging server at http://authnode.org/gate.php hosts additional tooling. Key artifact: C:\Users\Public\Documents\lsass.dmp (SHA256: 2b538183d300a85f00ba385c4965ee7bb5229b45d2ffc820a5c31b9994fb5899).


Blog Post by Mandiant: Tracking BlackTech's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2026-10752 against Atlassian Confluence deployments. The initial access vector involves spear-phishing emails from hr@account-update.xyz delivering Latrodectus. Post-compromise, the attackers deploy TrickBot and use Impacket for reconnaissance. C2 infrastructure includes 126.21.87.103 and edgeportal.live. A staging server at https://cdnsync.info/api/v2/auth hosts additional tooling. Key artifact: /usr/local/bin/payload.bin (MD5: ccab949c2f8d2f57b2e0033abed3fd1e).


Blog Post by Volexity: Tracking Volt Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2026-10212 against Windows 11 deployments. The initial access vector involves spear-phishing emails from support@mail-service.info delivering Qbot. Post-compromise, the attackers deploy TrickBot and use LaZagne for reconnaissance. C2 infrastructure includes 218.22.33.85 and data-relay.top. A staging server at https://securegateway.io/collect hosts additional tooling. Key artifact: C:\Windows\System32\backdoor.elf (MD5: 61cf8b20b132216a0308d730d389c1f1).


Blog Post by Recorded Future: Tracking Storm-0558's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-20708 against Citrix NetScaler deployments. The initial access vector involves spear-phishing emails from noreply@login-portal.tech delivering DanaBot. Post-compromise, the attackers deploy BatLoader and use Metasploit for reconnaissance. C2 infrastructure includes 172.195.40.113 and cdn-gateway.io. A staging server at https://sync-data.site/collect hosts additional tooling. Key artifact: C:\Windows\Tasks\lsass.dmp (MD5: 16a0ae8147d399ce869e098442d6b37a).


Blog Post by Dragos: Tracking Aqua Blizzard's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-33909 against VMware ESXi deployments. The initial access vector involves spear-phishing emails from confirm@phishing-domain.com delivering Ryuk. Post-compromise, the attackers deploy QakBot and use Hashcat for reconnaissance. C2 infrastructure includes 201.42.165.10 and proxy-gateway.com. A staging server at hxxps://relay-mail.link/assets/js/payload.js hosts additional tooling. Key artifact: C:\Windows\Temp\sam.hive (SHA1: 0fb3f0602c4bc7c46714c894a273176327abb8f3).


Blog Post by FireEye: Tracking Ember Bear's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2026-45190 against Apache Struts deployments. The initial access vector involves spear-phishing emails from report@account-update.xyz delivering Latrodectus. Post-compromise, the attackers deploy SmokeLoader and use Rubeus for reconnaissance. C2 infrastructure includes 93.233.223.27 and proxyproxy.link. A staging server at hxxp://gateway-gateway.online/assets/js/payload.js hosts additional tooling. Key artifact: C:\Users\admin\Downloads\dropper.ps1 (SHA256: 0bc0c53828ef61a17d910939e551c74a2f0ac05e124be24f88a7c8840ff91efe).


Blog Post by Huntress: Tracking FIN7's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-32298 against Active Directory deployments. The initial access vector involves spear-phishing emails from updates@mail-service.info delivering AsyncRAT. Post-compromise, the attackers deploy Lumma Stealer and use Havoc for reconnaissance. C2 infrastructure includes 10.77.56.93 and relay-secure.club. A staging server at hxxp://staticproxy.io/wp-content/uploads/doc.php hosts additional tooling. Key artifact: C:\Users\admin\AppData\Local\Temp\loader.exe (MD5: cf95507ae7b49d19f49246869307ed1d).


Blog Post by Zscaler ThreatLabz: Tracking OilRig's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-12082 against Ivanti Connect Secure deployments. The initial access vector involves spear-phishing emails from noreply@phishing-domain.com delivering Ryuk. Post-compromise, the attackers deploy REvil and use PowerView for reconnaissance. C2 infrastructure includes 207.146.238.161 and cacheedge.live. A staging server at hxxp://api-secure.top/secure/token hosts additional tooling. Key artifact: /tmp/ntds.dit (MD5: 77f8047b4efaf0437a24e23dccfe02b1).


Blog Post by Palo Alto Unit 42: Tracking Aqua Blizzard's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-48698 against Citrix NetScaler deployments. The initial access vector involves spear-phishing emails from report@auth-check.org delivering Emotet. Post-compromise, the attackers deploy Latrodectus and use Certutil for reconnaissance. C2 infrastructure includes 126.19.35.218 and securecdn.club. A staging server at hxxp://datarelay.com/secure/token hosts additional tooling. Key artifact: C:\Users\Public\Documents\winlogon.exe (MD5: e4ab6d844e384d979ee909f3404b2793).


Blog Post by Palo Alto Unit 42: Tracking Volt Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-46781 against SonicWall SMA deployments. The initial access vector involves spear-phishing emails from billing@account-update.xyz delivering PlugX. Post-compromise, the attackers deploy Raccoon Stealer and use Seatbelt for reconnaissance. C2 infrastructure includes 39.207.177.139 and cloudportal.live. A staging server at http://login-mail.xyz/panel/index.html hosts additional tooling. Key artifact: C:\Users\admin\AppData\Local\Temp\implant.so (MD5: 171dd901e782e4020d65d365798562b6).


Blog Post by Microsoft MSRC: Tracking Turla's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-12082 against Barracuda ESG deployments. The initial access vector involves spear-phishing emails from finance@secure-verify.net delivering RemcosRAT. Post-compromise, the attackers deploy SystemBC and use Chisel for reconnaissance. C2 infrastructure includes 172.137.9.157 and edgerelay.live. A staging server at hxxps://edge-proxy.dev/panel/index.html hosts additional tooling. Key artifact: C:\Users\admin\AppData\Local\Temp\update.dll (SHA256: e4ab9121a66e99979e9de02f743313edf9e3d938561aa8f803b4afe58fc0db4a).


Blog Post by Check Point Research: Tracking APT28's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2026-27261 against Apache Struts deployments. The initial access vector involves spear-phishing emails from hr@document-share.link delivering XLoader. Post-compromise, the attackers deploy Raccoon Stealer and use Hashcat for reconnaissance. C2 infrastructure includes 62.118.13.194 and sync-gateway.com. A staging server at http://storage-gateway.com/login hosts additional tooling. Key artifact: /var/tmp/beacon.dll (MD5: 2e55192c2b35e09859640a224c0eb8da).


Blog Post by SentinelOne: Tracking Gamaredon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-14163 against Progress Telerik deployments. The initial access vector involves spear-phishing emails from hr@auth-check.org delivering Emotet. Post-compromise, the attackers deploy Gootloader and use Burp Suite for reconnaissance. C2 infrastructure includes 192.161.124.15 and proxyupdate.org. A staging server at hxxp://nodecache.com/gate.php hosts additional tooling. Key artifact: C:\Users\Public\Documents\runtime.dll (MD5: 82cf5d7144770c29843e405e95a25bfb).


Blog Post by CrowdStrike: Tracking Star Blizzard's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-11952 against VMware ESXi deployments. The initial access vector involves spear-phishing emails from service@account-update.xyz delivering QakBot. Post-compromise, the attackers deploy RemcosRAT and use Merlin for reconnaissance. C2 infrastructure includes 126.168.152.124 and edge-node.link. A staging server at http://edge-backup.org/portal/verify hosts additional tooling. Key artifact: C:\Users\admin\Downloads\loader.exe (SHA256: 88b08fc9b39779bd7f7cb378f8b0cf39734f5b1cdea146c6e0d7455d939ccfa2).


Blog Post by Sophos X-Ops: Tracking Granite Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2024-14337 against Atlassian Confluence deployments. The initial access vector involves spear-phishing emails from hr@credential-check.site delivering Emotet. Post-compromise, the attackers deploy PlugX and use Rubeus for reconnaissance. C2 infrastructure includes 10.6.189.178 and edge-mail.net. A staging server at hxxp://mailcdn.net/secure/token hosts additional tooling. Key artifact: C:\ProgramData\chrome_helper.exe (SHA256: 9f3c67e8216e20e5a048e38c4e0cbaf517d8c22dac2e2cb1d9461a05ffb2daf3).


Blog Post by Rapid7: Tracking Midnight Blizzard's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2024-14337 against Windows Server 2019 deployments. The initial access vector involves spear-phishing emails from admin@credential-check.site delivering Latrodectus. Post-compromise, the attackers deploy BatLoader and use PowerShell Empire for reconnaissance. C2 infrastructure includes 32.106.61.225 and apinode.com. A staging server at hxxp://apibackup.net/login hosts additional tooling. Key artifact: /usr/local/bin/update.dll (SHA1: 976318ee97a069a1328559d7aa70f9a09499d155).


Blog Post by Kaspersky GReAT: Tracking Aqua Blizzard's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-19065 against MOVEit Transfer deployments. The initial access vector involves spear-phishing emails from support@document-share.link delivering RedLine Stealer. Post-compromise, the attackers deploy IcedID and use Hashcat for reconnaissance. C2 infrastructure includes 10.78.242.105 and portal-edge.cc. A staging server at http://relaydata.io/collect hosts additional tooling. Key artifact: C:\Windows\System32\csrss.exe (SHA256: 21b1afd43645efe4e5eb322c5ffe88cc4b18270351ecd47c80f7c75bd84b1c34).


Blog Post by Google TAG: Tracking Salt Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2024-19363 against Windows 11 deployments. The initial access vector involves spear-phishing emails from report@secure-verify.net delivering Royal. Post-compromise, the attackers deploy StealC and use BloodHound for reconnaissance. C2 infrastructure includes 106.101.210.208 and relay-api.org. A staging server at hxxp://authcloud.online/collect hosts additional tooling. Key artifact: C:\Windows\System32\winlogon.exe (MD5: 9640e15acecc0716856a9b2267514350).


Blog Post by NCSC: Tracking Flax Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-43392 against Cisco ASA deployments. The initial access vector involves spear-phishing emails from hr@auth-check.org delivering IcedID. Post-compromise, the attackers deploy DanaBot and use PsExec for reconnaissance. C2 infrastructure includes 223.97.220.77 and gateway-mail.top. A staging server at https://api-backup.dev/assets/js/payload.js hosts additional tooling. Key artifact: C:\Program Files\Common Files\dropper.ps1 (SHA1: 6a9b2cb15b813f4f2918472338338c180e2cd52d).


Blog Post by Huntress: Tracking Kimsuky's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2026-42806 against MOVEit Transfer deployments. The initial access vector involves spear-phishing emails from admin@mail-service.info delivering RedLine Stealer. Post-compromise, the attackers deploy Cobalt Strike and use Seatbelt for reconnaissance. C2 infrastructure includes 28.150.195.180 and auth-edge.online. A staging server at hxxps://gatewaydata.xyz/download/update.exe hosts additional tooling. Key artifact: C:\Windows\System32\runtime.dll (SHA256: a02415f070c6e8dca82c4410c2377545e5e6d0389d29d1693260631ba1bded96).


Blog Post by ESET Research: Tracking Flax Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-34911 against VMware ESXi deployments. The initial access vector involves spear-phishing emails from account@mail-service.info delivering Play. Post-compromise, the attackers deploy PikaBot and use LaZagne for reconnaissance. C2 infrastructure includes 2.74.166.7 and proxy-update.info. A staging server at http://update-backup.xyz/callback hosts additional tooling. Key artifact: C:\Windows\Tasks\update.dll (MD5: 928d6be78a973cb0b4627fdbb5b14b15).


Blog Post by Rapid7: Tracking Ember Bear's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-49565 against Zyxel USG deployments. The initial access vector involves spear-phishing emails from noreply@login-portal.tech delivering LockBit. Post-compromise, the attackers deploy Raccoon Stealer and use BloodHound for reconnaissance. C2 infrastructure includes 123.214.218.52 and nodeupdate.tech. A staging server at hxxps://proxy-cloud.io/panel/index.html hosts additional tooling. Key artifact: /tmp/update.dll (SHA1: 3de920d693cac31d9765a7d78b1c0758aeb8d7d2).


Blog Post by Europol: Tracking Midnight Blizzard's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2026-27261 against Fortinet FortiGate deployments. The initial access vector involves spear-phishing emails from updates@urgent-notice.online delivering TrickBot. Post-compromise, the attackers deploy Dridex and use ADFind for reconnaissance. C2 infrastructure includes 119.255.25.162 and mailauth.io. A staging server at http://loginauth.com/wp-content/uploads/doc.php hosts additional tooling. Key artifact: C:\Users\admin\Downloads\loader.exe (MD5: 0a01b8cdf8a6b9e0b3b5bce0746e6df4).


Blog Post by Check Point Research: Tracking UNC2452's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2024-26162 against Windows Server 2019 deployments. The initial access vector involves spear-phishing emails from account@phishing-domain.com delivering IcedID. Post-compromise, the attackers deploy XLoader and use Certutil for reconnaissance. C2 infrastructure includes 172.204.32.225 and proxy-cache.com. A staging server at https://securemail.org/callback hosts additional tooling. Key artifact: C:\Program Files\Common Files\dropper.ps1 (MD5: 7dd06682833ede7f4f1b4e2fe2552a80).


Blog Post by Huntress: Tracking Lazarus Group's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-32541 against Apache Struts deployments. The initial access vector involves spear-phishing emails from it@mail-service.info delivering PlugX. Post-compromise, the attackers deploy StealC and use CrackMapExec for reconnaissance. C2 infrastructure includes 192.233.226.3 and auth-cdn.io. A staging server at hxxps://node-cloud.info/collect hosts additional tooling. Key artifact: /usr/local/bin/loader.exe (SHA1: bbe8da709c7e8f7d9645102700c38c71222dc623).


Blog Post by CISA: Tracking MuddyWater's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-27496 against Barracuda ESG deployments. The initial access vector involves spear-phishing emails from info@urgent-notice.online delivering DanaBot. Post-compromise, the attackers deploy Cobalt Strike and use Covenant for reconnaissance. C2 infrastructure includes 10.130.213.231 and edgeportal.dev. A staging server at hxxp://loginportal.com/api/v2/auth hosts additional tooling. Key artifact: C:\Windows\Temp\ntds.dit (SHA256: 9b84fa28e6e1933be1c2aa5dd53c75eda6eb351200fe2c6f49d509946b34b00e).


Blog Post by Secureworks: Tracking Storm-0558's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2024-31252 against Progress Telerik deployments. The initial access vector involves spear-phishing emails from helpdesk@credential-check.site delivering FormBook. Post-compromise, the attackers deploy AsyncRAT and use BloodHound for reconnaissance. C2 infrastructure includes 163.155.113.164 and node-proxy.club. A staging server at hxxp://cloud-relay.io/admin/config hosts additional tooling. Key artifact: C:\Users\Public\Documents\payload.bin (MD5: 7ae11bd590017511b65fafcfe666864a).


Blog Post by Dragos: Tracking Aqua Blizzard's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-45005 against Ubuntu 22.04 deployments. The initial access vector involves spear-phishing emails from service@account-update.xyz delivering PikaBot. Post-compromise, the attackers deploy Qbot and use Mimikatz for reconnaissance. C2 infrastructure includes 202.163.249.139 and data-relay.xyz. A staging server at http://backup-secure.net/admin/config hosts additional tooling. Key artifact: /usr/local/bin/beacon.dll (MD5: 15cc660ae2c71df3dad5530a440cd9ec).


Blog Post by INTERPOL: Tracking Gamaredon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-29213 against VMware ESXi deployments. The initial access vector involves spear-phishing emails from account@mail-service.info delivering SystemBC. Post-compromise, the attackers deploy SmokeLoader and use PsExec for reconnaissance. C2 infrastructure includes 140.81.230.58 and mail-static.online. A staging server at https://gatewaylogin.com/login hosts additional tooling. Key artifact: C:\Users\admin\Desktop\backdoor.elf (MD5: aa702e8872edff1b78f3331d13251604).


Blog Post by Symantec: Tracking APT28's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-17185 against Apache Struts deployments. The initial access vector involves spear-phishing emails from noreply@mail-service.info delivering Conti. Post-compromise, the attackers deploy NjRAT and use Brute Ratel for reconnaissance. C2 infrastructure includes 99.71.59.154 and nodestorage.live. A staging server at https://storagelogin.tech/admin/config hosts additional tooling. Key artifact: /opt/app/bin/dropper.ps1 (MD5: 1545c161fa46dd8181186e0f61b1112d).


Blog Post by Rapid7: Tracking Storm-0558's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-45142 against MOVEit Transfer deployments. The initial access vector involves spear-phishing emails from helpdesk@urgent-notice.online delivering Vidar. Post-compromise, the attackers deploy ShadowPad and use Rubeus for reconnaissance. C2 infrastructure includes 172.82.69.252 and proxystatic.info. A staging server at https://gateway-update.net/portal/verify hosts additional tooling. Key artifact: C:\Users\admin\Downloads\sam.hive (SHA256: 66290d703ce432d8e09127f776785a7b2eef2509eee6571b0eb6de4ca9d860cc).


Blog Post by Secureworks: Tracking Diamond Sleet's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2026-10212 against Juniper SRX deployments. The initial access vector involves spear-phishing emails from contact@identity-verify.cc delivering Play. Post-compromise, the attackers deploy Latrodectus and use Sliver for reconnaissance. C2 infrastructure includes 10.69.103.214 and loginlogin.tech. A staging server at http://gatewaynode.club/download/update.exe hosts additional tooling. Key artifact: C:\ProgramData\update.dll (SHA1: ad955bffc3942a45a495a5f120d47cb13ad86d0f).


Blog Post by ESET Research: Tracking BlackTech's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-23730 against Barracuda ESG deployments. The initial access vector involves spear-phishing emails from service@phishing-domain.com delivering Vidar. Post-compromise, the attackers deploy RedLine Stealer and use PowerShell Empire for reconnaissance. C2 infrastructure includes 192.159.102.126 and backup-cache.org. A staging server at https://loginproxy.xyz/login hosts additional tooling. Key artifact: C:\Users\admin\AppData\Local\Temp\chrome_helper.exe (SHA1: fedf31578a8db5a0151d6dcecc2750666288adf5).


Blog Post by Microsoft MSRC: Tracking Flax Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-45005 against Cisco ASA deployments. The initial access vector involves spear-phishing emails from notification@auth-check.org delivering XLoader. Post-compromise, the attackers deploy FormBook and use Havoc for reconnaissance. C2 infrastructure includes 192.222.38.73 and cache-api.com. A staging server at http://static-auth.site/secure/token hosts additional tooling. Key artifact: /home/user/.config/winlogon.exe (SHA1: c8ee49b14aa6babfe4d8798ff8a3f7adb0029989).


Blog Post by Trend Micro: Tracking Diamond Sleet's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-39439 against F5 BIG-IP deployments. The initial access vector involves spear-phishing emails from confirm@document-share.link delivering BumbleBee. Post-compromise, the attackers deploy Cobalt Strike and use BloodHound for reconnaissance. C2 infrastructure includes 219.204.66.168 and backupsecure.link. A staging server at hxxp://storage-secure.live/secure/token hosts additional tooling. Key artifact: C:\Windows\Tasks\runtime.dll (SHA1: ed4c6da0cf4152d9984c870e854a576211a58938).


Blog Post by Mandiant: Tracking Ember Bear's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-48242 against Cisco ASA deployments. The initial access vector involves spear-phishing emails from hr@phishing-domain.com delivering Hive. Post-compromise, the attackers deploy REvil and use Metasploit for reconnaissance. C2 infrastructure includes 211.204.54.12 and cdnedge.top. A staging server at http://apiauth.live/api/v2/auth hosts additional tooling. Key artifact: C:\Windows\System32\csrss.exe (SHA256: 3c77f5e758d8062eb1157cf5a76ef188c085461c0c1d720767877870c38cbde0).


Blog Post by Mandiant: Tracking APT28's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-34898 against Zyxel USG deployments. The initial access vector involves spear-phishing emails from verify@credential-check.site delivering FormBook. Post-compromise, the attackers deploy SystemBC and use Rubeus for reconnaissance. C2 infrastructure includes 202.131.125.80 and gatewaystorage.org. A staging server at https://mailcdn.live/wp-content/uploads/doc.php hosts additional tooling. Key artifact: /usr/local/bin/chrome_helper.exe (MD5: f65a6e30cfb9c60f7facb378b0987004).


Blog Post by Recorded Future: Tracking Storm-0558's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2024-40071 against MOVEit Transfer deployments. The initial access vector involves spear-phishing emails from ceo@account-update.xyz delivering Emotet. Post-compromise, the attackers deploy REvil and use LaZagne for reconnaissance. C2 infrastructure includes 50.255.175.92 and storagecache.dev. A staging server at hxxps://cdn-sync.club/admin/config hosts additional tooling. Key artifact: C:\Users\admin\Downloads\helper.sh (MD5: 65122039aee6350f3fdeea834e0c3fee).


Blog Post by Mandiant: Tracking Granite Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-14679 against Microsoft Exchange deployments. The initial access vector involves spear-phishing emails from finance@auth-check.org delivering Ryuk. Post-compromise, the attackers deploy Vidar and use Merlin for reconnaissance. C2 infrastructure includes 192.126.68.155 and relaysync.info. A staging server at hxxp://datadata.link/collect hosts additional tooling. Key artifact: C:\Windows\Tasks\loader.exe (SHA1: f69f98fb65d36fd0522ccb3423b014eadd93443f).


Blog Post by Dragos: Tracking Diamond Sleet's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-16140 against Apache Struts deployments. The initial access vector involves spear-phishing emails from admin@identity-verify.cc delivering Qbot. Post-compromise, the attackers deploy Gootloader and use Mythic for reconnaissance. C2 infrastructure includes 117.66.134.163 and syncstatic.online. A staging server at https://node-cloud.top/api/v2/auth hosts additional tooling. Key artifact: C:\Windows\Tasks\chrome_helper.exe (SHA1: fc50811066b2f355af4c6ae549069673388a2a44).


Blog Post by CrowdStrike: Tracking APT29's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-26043 against Apache Struts deployments. The initial access vector involves spear-phishing emails from report@credential-check.site delivering StealC. Post-compromise, the attackers deploy DanaBot and use Brute Ratel for reconnaissance. C2 infrastructure includes 192.84.126.17 and synclogin.net. A staging server at https://node-login.site/panel/index.html hosts additional tooling. Key artifact: C:\Users\admin\AppData\Local\Temp\config.dat (MD5: 3d37895893ef3073f50b7b10cf034470).


Blog Post by Trend Micro: Tracking Charming Kitten's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2024-27546 against Ivanti Connect Secure deployments. The initial access vector involves spear-phishing emails from billing@mail-service.info delivering Lumma Stealer. Post-compromise, the attackers deploy IcedID and use Mimikatz for reconnaissance. C2 infrastructure includes 145.45.185.197 and datasync.top. A staging server at hxxp://portalmail.net/wp-content/uploads/doc.php hosts additional tooling. Key artifact: /usr/local/bin/update.dll (MD5: 74c2735811bcfaee412e6e4287e94239).


Blog Post by Secureworks: Tracking Salt Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-19144 against SonicWall SMA deployments. The initial access vector involves spear-phishing emails from verify@login-portal.tech delivering ShadowPad. Post-compromise, the attackers deploy TrickBot and use LaZagne for reconnaissance. C2 infrastructure includes 10.122.168.157 and datastorage.dev. A staging server at https://edgesync.live/collect hosts additional tooling. Key artifact: C:\Users\Public\Documents\payload.bin (SHA256: f21e2efc94a9585f7160f4482c09ad8392a664e33b64dc12abf13035cbd7be85).


Blog Post by NSA: Tracking Turla's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-11739 against Fortinet FortiGate deployments. The initial access vector involves spear-phishing emails from updates@phishing-domain.com delivering IcedID. Post-compromise, the attackers deploy Ryuk and use GhostPack for reconnaissance. C2 infrastructure includes 79.77.48.249 and storage-sync.info. A staging server at hxxp://edgenode.cc/gate.php hosts additional tooling. Key artifact: /dev/shm/update.dll (SHA1: b6072cb9c6ef921e4560795c34f2bd35ef7ae5ab).


Blog Post by SentinelOne: Tracking Salt Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2024-35928 against Windows Server 2019 deployments. The initial access vector involves spear-phishing emails from admin@credential-check.site delivering TrickBot. Post-compromise, the attackers deploy PlugX and use Mimikatz for reconnaissance. C2 infrastructure includes 34.197.111.48 and portalsecure.dev. A staging server at https://cloudlogin.site/gate.php hosts additional tooling. Key artifact: C:\Users\admin\AppData\Local\Temp\backdoor.elf (SHA256: 21c6009812e29c0115d91c20b55be492cab84bd4484dd4a121ea75b03b1f8563).


Blog Post by Volexity: Tracking Ember Bear's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2023-34911 against Zyxel USG deployments. The initial access vector involves spear-phishing emails from it@mail-service.info delivering Cobalt Strike. Post-compromise, the attackers deploy Amadey and use LaZagne for reconnaissance. C2 infrastructure includes 127.168.83.180 and static-cache.cc. A staging server at hxxps://cloudportal.cc/panel/index.html hosts additional tooling. Key artifact: /usr/local/bin/taskhost.exe (MD5: a7f5198a88f102acbd79016294f39965).


Blog Post by Qualys: Tracking Star Blizzard's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-28965 against Juniper SRX deployments. The initial access vector involves spear-phishing emails from finance@credential-check.site delivering Lumma Stealer. Post-compromise, the attackers deploy WarmCookie and use PowerView for reconnaissance. C2 infrastructure includes 116.78.84.103 and static-update.net. A staging server at https://mailauth.tech/download/update.exe hosts additional tooling. Key artifact: /dev/shm/taskhost.exe (MD5: 70dd20910ea8ca618bbab1a21f2bfc6b).


Blog Post by SentinelOne: Tracking UNC2452's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-47837 against Ubuntu 22.04 deployments. The initial access vector involves spear-phishing emails from updates@identity-verify.cc delivering NjRAT. Post-compromise, the attackers deploy Play and use SharpHound for reconnaissance. C2 infrastructure includes 147.116.36.204 and backup-proxy.tech. A staging server at http://apistatic.live/assets/js/payload.js hosts additional tooling. Key artifact: /etc/cron.d/update.dll (SHA256: e73933255becf68ad00ae575b3d1faca7fd7cee34dce962e9599d2116ca8af14).


Blog Post by Microsoft MSRC: Tracking Kimsuky's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2026-10752 against Juniper SRX deployments. The initial access vector involves spear-phishing emails from billing@secure-verify.net delivering TrickBot. Post-compromise, the attackers deploy Cobalt Strike and use Rubeus for reconnaissance. C2 infrastructure includes 79.182.237.15 and mail-auth.top. A staging server at hxxps://storage-data.io/admin/config hosts additional tooling. Key artifact: C:\Windows\Temp\winlogon.exe (MD5: 27afbab1489189858e21ef5430071707).


Blog Post by Symantec: Tracking Sandworm's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-22601 against Fortinet FortiGate deployments. The initial access vector involves spear-phishing emails from security@mail-service.info delivering Qbot. Post-compromise, the attackers deploy Raccoon Stealer and use ADFind for reconnaissance. C2 infrastructure includes 163.85.254.74 and securesecure.site. A staging server at hxxps://storagecloud.net/assets/js/payload.js hosts additional tooling. Key artifact: /tmp/dropper.ps1 (MD5: 3e8d2c9daa7ba7756b00bb39e9ef4793).


Blog Post by FBI: Tracking Mustang Panda's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-17185 against Progress Telerik deployments. The initial access vector involves spear-phishing emails from notification@identity-verify.cc delivering TrickBot. Post-compromise, the attackers deploy PlugX and use Hashcat for reconnaissance. C2 infrastructure includes 192.49.158.221 and syncstatic.info. A staging server at https://cache-cache.site/secure/token hosts additional tooling. Key artifact: C:\Users\admin\Downloads\backdoor.elf (SHA1: b8dff9a2b96073d6395542613017755c30e37bc6).


Blog Post by Zscaler ThreatLabz: Tracking Sandworm's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-16078 against F5 BIG-IP deployments. The initial access vector involves spear-phishing emails from it@secure-verify.net delivering Latrodectus. Post-compromise, the attackers deploy SystemBC and use Mimikatz for reconnaissance. C2 infrastructure includes 171.38.181.116 and gateway-node.tech. A staging server at hxxps://relay-cdn.tech/panel/index.html hosts additional tooling. Key artifact: C:\Users\Public\Documents\svchost.exe (SHA256: bb4efe2e12bf7505f7f91edadc0d27aae5e82ba1d209eba49a4f548545869d2f).


Blog Post by Cisco Talos: Tracking Lazarus Group's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-24110 against Windows Server 2019 deployments. The initial access vector involves spear-phishing emails from service@phishing-domain.com delivering WarmCookie. Post-compromise, the attackers deploy XLoader and use Brute Ratel for reconnaissance. C2 infrastructure includes 91.53.140.72 and gatewaygateway.dev. A staging server at http://static-gateway.link/assets/js/payload.js hosts additional tooling. Key artifact: C:\ProgramData\winlogon.exe (MD5: b47838070e7f78158b7f031cc072dcdf).


Blog Post by Mandiant: Tracking Forest Blizzard's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-17296 against Ubuntu 22.04 deployments. The initial access vector involves spear-phishing emails from noreply@document-share.link delivering SystemBC. Post-compromise, the attackers deploy BumbleBee and use Nmap for reconnaissance. C2 infrastructure includes 10.200.190.88 and portalbackup.online. A staging server at http://gatewayportal.tech/wp-content/uploads/doc.php hosts additional tooling. Key artifact: /dev/shm/beacon.dll (SHA1: 846df4951162758077eac1d0119b39dfdb40c0ae).


Blog Post by Trend Micro: Tracking Lazarus Group's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2025-43392 against Juniper SRX deployments. The initial access vector involves spear-phishing emails from admin@identity-verify.cc delivering QakBot. Post-compromise, the attackers deploy NjRAT and use Mimikatz for reconnaissance. C2 infrastructure includes 158.10.77.62 and cdn-static.link. A staging server at https://gatewaysecure.net/assets/js/payload.js hosts additional tooling. Key artifact: C:\Users\Public\Documents\lsass.dmp (MD5: 0e3aa6691ef076ee77a8deb95b559e6e).


Blog Post by Tenable: Tracking Scattered Spider's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-26049 against Atlassian Confluence deployments. The initial access vector involves spear-phishing emails from service@secure-verify.net delivering Play. Post-compromise, the attackers deploy ShadowPad and use PsExec for reconnaissance. C2 infrastructure includes 172.84.0.244 and nodeapi.top. A staging server at hxxps://logincache.xyz/collect hosts additional tooling. Key artifact: /etc/cron.d/update.dll (SHA1: 62f7316c6465a4675d457101dd9a70c5db65c6df).


Blog Post by FBI: Tracking Kimsuky's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-28210 against Cisco ASA deployments. The initial access vector involves spear-phishing emails from contact@login-portal.tech delivering QakBot. Post-compromise, the attackers deploy XLoader and use Ligolo for reconnaissance. C2 infrastructure includes 10.221.235.15 and cachecdn.info. A staging server at http://auth-relay.top/gate.php hosts additional tooling. Key artifact: C:\Users\Public\Documents\implant.so (SHA1: d13190cb27fde58318b4ccafeae44ea90538f4bc).


Blog Post by Europol: Tracking TA505's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2024-26162 against Windows 11 deployments. The initial access vector involves spear-phishing emails from finance@credential-check.site delivering FormBook. Post-compromise, the attackers deploy PlugX and use BloodHound for reconnaissance. C2 infrastructure includes 70.215.35.221 and login-static.live. A staging server at http://update-node.top/panel/index.html hosts additional tooling. Key artifact: C:\Windows\Tasks\shell.php (SHA1: 41d31268b85e7e1e9c57dd4dd2f79111ffdc26d4).


Blog Post by NCSC: Tracking Charming Kitten's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2022-13003 against Zyxel USG deployments. The initial access vector involves spear-phishing emails from updates@secure-verify.net delivering BatLoader. Post-compromise, the attackers deploy LockBit and use Nmap for reconnaissance. C2 infrastructure includes 160.206.200.138 and securerelay.info. A staging server at hxxps://data-update.live/collect hosts additional tooling. Key artifact: /opt/app/bin/backdoor.elf (SHA1: 315478fbf0054e6539d6286bb4ca81ff0da02243).


Blog Post by FBI: Tracking Flax Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-24628 against VMware ESXi deployments. The initial access vector involves spear-phishing emails from confirm@account-update.xyz delivering NjRAT. Post-compromise, the attackers deploy Lumma Stealer and use Chisel for reconnaissance. C2 infrastructure includes 10.196.231.220 and api-api.live. A staging server at hxxps://portalrelay.link/portal/verify hosts additional tooling. Key artifact: C:\Users\admin\Downloads\agent.py (SHA256: 3c3deb7e338cea435e350ca3325a518989350d5dcba27d6935fdd1b24d499102).


Blog Post by Huntress: Tracking Flax Typhoon's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-32298 against Microsoft Exchange deployments. The initial access vector involves spear-phishing emails from info@login-portal.tech delivering Vidar. Post-compromise, the attackers deploy AsyncRAT and use ADFind for reconnaissance. C2 infrastructure includes 21.215.166.15 and securecloud.top. A staging server at hxxp://mail-cache.site/gate.php hosts additional tooling. Key artifact: C:\Users\Public\Documents\implant.so (SHA1: 81030b00adeb025115d1d899224d623d16e4eda8).


Blog Post by Recorded Future: Tracking BlackTech's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2020-46781 against Microsoft Exchange deployments. The initial access vector involves spear-phishing emails from confirm@secure-verify.net delivering Ryuk. Post-compromise, the attackers deploy BatLoader and use LinPEAS for reconnaissance. C2 infrastructure includes 207.11.13.71 and staticcdn.info. A staging server at https://backupbackup.cc/login hosts additional tooling. Key artifact: /opt/app/bin/taskhost.exe (MD5: bc3271d17871dbb1587a76ec7ab97d36).


Blog Post by INTERPOL: Tracking Velvet Tempest's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-33526 against F5 BIG-IP deployments. The initial access vector involves spear-phishing emails from info@identity-verify.cc delivering Play. Post-compromise, the attackers deploy Meduza Stealer and use Nmap for reconnaissance. C2 infrastructure includes 192.37.82.112 and update-static.io. A staging server at hxxps://cdngateway.live/portal/verify hosts additional tooling. Key artifact: C:\Program Files\Common Files\lsass.dmp (MD5: c7394f095e8d98f6c5f6dac12a7134a4).


Blog Post by Palo Alto Unit 42: Tracking Kimsuky's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2021-16338 against Progress Telerik deployments. The initial access vector involves spear-phishing emails from admin@mail-service.info delivering Amadey. Post-compromise, the attackers deploy ShadowPad and use PowerView for reconnaissance. C2 infrastructure includes 42.1.209.228 and cdnedge.com. A staging server at hxxp://nodemail.io/portal/verify hosts additional tooling. Key artifact: /dev/shm/beacon.dll (SHA1: 4f76f72f17af773f611f913c7ebdd606f37363a9).


Blog Post by Secureworks: Tracking Star Blizzard's Latest Operations. Our research team has uncovered a new campaign leveraging CVE-2026-40674 against Fortinet FortiGate deployments. The initial access vector involves spear-phishing emails from finance@document-share.link delivering Lumma Stealer. Post-compromise, the attackers deploy RemcosRAT and use WinPEAS for reconnaissance. C2 infrastructure includes 2.17.118.16 and api-mail.net. A staging server at http://apirelay.tech/download/update.exe hosts additional tooling. Key artifact: /home/user/.config/sam.hive (SHA256: 914fc1ac0b6232ab3a7ab85bb620ac518ad417b057fa6d8cbb753ea5098a57dd).


Secureworks detected a multi-stage attack chain. The initial phishing email from security@identity-verify.cc contained a link to https://syncauth.cc/collect. This redirected to https://nodecloud.org/api/v2/auth on proxyproxy.com. A secondary email from account@account-update.xyz pointed to http://api-update.org/wp-content/uploads/doc.php which delivered Hive. The final payload callback was hxxp://sync-static.live/download/update.exe resolving to 192.184.189.68 via cachebackup.live.


Microsoft MSRC detected a multi-stage attack chain. The initial phishing email from billing@document-share.link contained a link to hxxp://syncedge.link/api/v2/auth. This redirected to hxxps://node-update.net/secure/token on secure-cloud.online. A secondary email from verify@login-portal.tech pointed to https://proxyportal.cc/api/v2/auth which delivered RemcosRAT. The final payload callback was https://authcloud.cc/secure/token resolving to 172.163.85.209 via updatenode.link.


Google TAG detected a multi-stage attack chain. The initial phishing email from account@phishing-domain.com contained a link to https://login-sync.xyz/assets/js/payload.js. This redirected to https://auth-cloud.cc/assets/js/payload.js on update-gateway.club. A secondary email from finance@urgent-notice.online pointed to http://cachegateway.tech/download/update.exe which delivered WarmCookie. The final payload callback was hxxp://proxy-cloud.dev/secure/token resolving to 192.149.21.122 via storagestorage.club.


Cisco Talos detected a multi-stage attack chain. The initial phishing email from billing@secure-verify.net contained a link to https://securemail.club/panel/index.html. This redirected to http://securecache.xyz/login on edgelogin.live. A secondary email from contact@credential-check.site pointed to http://securemail.live/assets/js/payload.js which delivered RedLine Stealer. The final payload callback was hxxps://portal-update.io/secure/token resolving to 218.10.32.22 via gateway-login.link.


Rapid7 detected a multi-stage attack chain. The initial phishing email from helpdesk@document-share.link contained a link to hxxp://relay-update.link/portal/verify. This redirected to https://backup-relay.online/callback on edge-cache.io. A secondary email from service@auth-check.org pointed to hxxp://cloudproxy.net/gate.php which delivered Qbot. The final payload callback was https://updatenode.com/wp-content/uploads/doc.php resolving to 177.186.99.195 via secure-login.top.


Zscaler ThreatLabz detected a multi-stage attack chain. The initial phishing email from contact@document-share.link contained a link to hxxps://syncbackup.tech/download/update.exe. This redirected to hxxp://portallogin.org/login on node-cdn.online. A secondary email from notification@login-portal.tech pointed to https://sync-gateway.live/admin/config which delivered Raccoon Stealer. The final payload callback was http://logincache.cc/api/v2/auth resolving to 88.38.18.244 via edge-portal.com.


NCSC detected a multi-stage attack chain. The initial phishing email from support@document-share.link contained a link to hxxp://node-login.cc/api/v2/auth. This redirected to http://logincache.io/login on update-mail.site. A secondary email from service@document-share.link pointed to https://secureproxy.io/assets/js/payload.js which delivered REvil. The final payload callback was http://authcdn.xyz/admin/config resolving to 19.71.109.82 via gatewaysecure.tech.


ESET Research detected a multi-stage attack chain. The initial phishing email from verify@credential-check.site contained a link to http://edge-node.link/login. This redirected to hxxps://api-update.online/portal/verify on cloudproxy.org. A secondary email from contact@login-portal.tech pointed to hxxp://cloud-portal.com/callback which delivered AsyncRAT. The final payload callback was https://node-storage.io/portal/verify resolving to 10.38.28.206 via cloud-secure.site.


Recorded Future detected a multi-stage attack chain. The initial phishing email from updates@mail-service.info contained a link to http://datacdn.link/collect. This redirected to https://storageportal.io/download/update.exe on auth-auth.org. A secondary email from service@phishing-domain.com pointed to hxxps://edge-auth.io/api/v2/auth which delivered BlackCat. The final payload callback was hxxps://syncrelay.org/assets/js/payload.js resolving to 10.67.108.28 via mailstatic.club.


CISA detected a multi-stage attack chain. The initial phishing email from confirm@document-share.link contained a link to hxxps://nodeauth.online/portal/verify. This redirected to https://data-login.online/panel/index.html on maillogin.live. A secondary email from alert@phishing-domain.com pointed to hxxp://api-edge.tech/login which delivered IcedID. The final payload callback was https://cloudupdate.live/api/v2/auth resolving to 58.49.21.5 via secureportal.net.


NCSC detected a multi-stage attack chain. The initial phishing email from updates@credential-check.site contained a link to http://storage-api.xyz/admin/config. This redirected to hxxps://login-cloud.io/api/v2/auth on staticportal.net. A secondary email from noreply@credential-check.site pointed to hxxps://relay-cdn.org/collect which delivered DanaBot. The final payload callback was hxxps://static-backup.com/portal/verify resolving to 10.144.186.13 via portal-cdn.dev.


Tenable detected a multi-stage attack chain. The initial phishing email from helpdesk@account-update.xyz contained a link to https://gateway-cloud.club/wp-content/uploads/doc.php. This redirected to hxxps://cloud-mail.com/callback on cdn-mail.top. A secondary email from admin@document-share.link pointed to hxxps://gateway-login.tech/login which delivered Lumma Stealer. The final payload callback was hxxps://cachesync.site/gate.php resolving to 114.103.28.222 via storage-auth.xyz.


Mandiant detected a multi-stage attack chain. The initial phishing email from admin@phishing-domain.com contained a link to https://backup-update.online/api/v2/auth. This redirected to http://storage-cache.top/callback on data-static.net. A secondary email from confirm@mail-service.info pointed to hxxps://datadata.cc/wp-content/uploads/doc.php which delivered RedLine Stealer. The final payload callback was http://datanode.tech/portal/verify resolving to 172.72.193.125 via nodeupdate.club.


Tenable detected a multi-stage attack chain. The initial phishing email from admin@secure-verify.net contained a link to hxxp://backup-gateway.io/admin/config. This redirected to hxxps://sync-portal.tech/login on node-auth.link. A secondary email from service@auth-check.org pointed to https://cache-sync.link/secure/token which delivered TrickBot. The final payload callback was hxxp://portalbackup.top/login resolving to 192.3.207.191 via login-cloud.org.


ESET Research detected a multi-stage attack chain. The initial phishing email from admin@mail-service.info contained a link to http://proxy-mail.com/secure/token. This redirected to http://cache-secure.site/gate.php on mailgateway.io. A secondary email from confirm@credential-check.site pointed to hxxps://updatesync.site/callback which delivered NjRAT. The final payload callback was https://login-node.top/wp-content/uploads/doc.php resolving to 10.116.196.201 via secureupdate.org.


Europol detected a multi-stage attack chain. The initial phishing email from finance@credential-check.site contained a link to https://proxyportal.link/api/v2/auth. This redirected to http://backuplogin.club/api/v2/auth on cdn-login.top. A secondary email from billing@auth-check.org pointed to hxxps://backupstorage.xyz/portal/verify which delivered BlackCat. The final payload callback was hxxps://cachemail.tech/panel/index.html resolving to 66.69.229.177 via gateway-cache.tech.


Volexity detected a multi-stage attack chain. The initial phishing email from security@account-update.xyz contained a link to hxxps://cloudgateway.top/login. This redirected to https://cache-node.org/secure/token on relay-backup.net. A secondary email from it@account-update.xyz pointed to http://node-auth.info/admin/config which delivered SmokeLoader. The final payload callback was hxxp://relaycdn.org/callback resolving to 83.103.41.49 via cdngateway.com.


Dragos detected a multi-stage attack chain. The initial phishing email from report@identity-verify.cc contained a link to hxxp://relay-gateway.org/panel/index.html. This redirected to hxxps://cache-mail.info/gate.php on edge-auth.online. A secondary email from report@secure-verify.net pointed to http://synccdn.net/wp-content/uploads/doc.php which delivered AgentTesla. The final payload callback was https://staticcdn.tech/panel/index.html resolving to 192.83.216.167 via static-cloud.xyz.


Check Point Research detected a multi-stage attack chain. The initial phishing email from admin@document-share.link contained a link to http://login-cdn.link/portal/verify. This redirected to http://syncgateway.live/callback on api-backup.xyz. A secondary email from notification@account-update.xyz pointed to https://relayedge.live/callback which delivered AgentTesla. The final payload callback was https://storage-cdn.io/secure/token resolving to 31.4.73.134 via mail-relay.dev.


Check Point Research detected a multi-stage attack chain. The initial phishing email from admin@urgent-notice.online contained a link to hxxp://authsync.xyz/secure/token. This redirected to hxxp://loginupdate.xyz/admin/config on storage-cloud.com. A secondary email from helpdesk@phishing-domain.com pointed to hxxps://storagecache.net/collect which delivered XLoader. The final payload callback was hxxp://mail-secure.io/collect resolving to 192.148.9.27 via proxydata.dev.


Dragos detected a multi-stage attack chain. The initial phishing email from updates@identity-verify.cc contained a link to hxxp://relayportal.cc/assets/js/payload.js. This redirected to hxxps://cache-auth.club/secure/token on updategateway.cc. A secondary email from verify@login-portal.tech pointed to http://proxy-auth.cc/login which delivered RedLine Stealer. The final payload callback was https://proxybackup.dev/secure/token resolving to 63.59.162.191 via backup-data.io.


Huntress detected a multi-stage attack chain. The initial phishing email from helpdesk@mail-service.info contained a link to http://gatewaystatic.tech/collect. This redirected to http://cache-portal.org/wp-content/uploads/doc.php on storage-gateway.site. A secondary email from billing@phishing-domain.com pointed to https://proxy-cloud.org/wp-content/uploads/doc.php which delivered DanaBot. The final payload callback was hxxps://cdncloud.top/collect resolving to 102.118.76.244 via authsync.net.


Volexity detected a multi-stage attack chain. The initial phishing email from billing@mail-service.info contained a link to http://portaledge.net/login. This redirected to http://apicache.net/login on edge-cdn.net. A secondary email from info@login-portal.tech pointed to hxxp://sync-secure.live/callback which delivered XLoader. The final payload callback was hxxp://relay-sync.club/gate.php resolving to 221.246.61.207 via api-node.info.


CrowdStrike detected a multi-stage attack chain. The initial phishing email from service@urgent-notice.online contained a link to hxxps://gateway-auth.net/assets/js/payload.js. This redirected to hxxp://relayportal.dev/login on backuprelay.dev. A secondary email from confirm@auth-check.org pointed to http://cloudsync.online/wp-content/uploads/doc.php which delivered TrickBot. The final payload callback was https://backupauth.info/secure/token resolving to 172.206.118.122 via api-auth.link.


CISA detected a multi-stage attack chain. The initial phishing email from security@identity-verify.cc contained a link to hxxps://dataedge.xyz/api/v2/auth. This redirected to hxxps://edgemail.online/callback on backup-backup.site. A secondary email from info@credential-check.site pointed to hxxps://gatewayupdate.io/admin/config which delivered WarmCookie. The final payload callback was hxxps://apinode.top/admin/config resolving to 172.193.17.238 via edge-node.link.


FireEye detected a multi-stage attack chain. The initial phishing email from contact@mail-service.info contained a link to https://gateway-cloud.net/collect. This redirected to hxxp://api-node.net/gate.php on sync-cache.net. A secondary email from notification@account-update.xyz pointed to hxxp://login-cache.club/panel/index.html which delivered Play. The final payload callback was hxxp://backup-storage.com/login resolving to 51.208.49.53 via portal-backup.online.


FBI detected a multi-stage attack chain. The initial phishing email from account@credential-check.site contained a link to http://loginsecure.top/assets/js/payload.js. This redirected to https://edge-api.tech/wp-content/uploads/doc.php on cdndata.xyz. A secondary email from service@phishing-domain.com pointed to hxxp://mail-node.io/login which delivered Emotet. The final payload callback was http://api-cloud.site/api/v2/auth resolving to 192.252.158.154 via apiproxy.link.


Mandiant detected a multi-stage attack chain. The initial phishing email from it@login-portal.tech contained a link to hxxps://gateway-sync.io/login. This redirected to hxxps://updatedata.cc/callback on secure-relay.top. A secondary email from notification@auth-check.org pointed to hxxp://edgeapi.org/gate.php which delivered DarkSide. The final payload callback was hxxp://static-edge.tech/login resolving to 172.76.124.243 via sync-gateway.cc.


Trend Micro detected a multi-stage attack chain. The initial phishing email from alert@account-update.xyz contained a link to http://securebackup.live/api/v2/auth. This redirected to hxxp://storage-gateway.link/wp-content/uploads/doc.php on login-edge.dev. A secondary email from support@urgent-notice.online pointed to hxxps://portal-proxy.io/api/v2/auth which delivered PlugX. The final payload callback was hxxps://portalproxy.com/portal/verify resolving to 172.65.145.141 via sync-backup.online.


Symantec detected a multi-stage attack chain. The initial phishing email from helpdesk@identity-verify.cc contained a link to http://portalsecure.xyz/panel/index.html. This redirected to hxxp://apiproxy.dev/download/update.exe on proxybackup.net. A secondary email from service@login-portal.tech pointed to http://relaygateway.com/wp-content/uploads/doc.php which delivered Dridex. The final payload callback was hxxps://apidata.site/callback resolving to 172.190.213.200 via cacheedge.info.


Google TAG detected a multi-stage attack chain. The initial phishing email from security@auth-check.org contained a link to http://maildata.tech/gate.php. This redirected to hxxp://proxynode.tech/assets/js/payload.js on cdnbackup.org. A secondary email from service@credential-check.site pointed to http://storagenode.xyz/api/v2/auth which delivered PikaBot. The final payload callback was hxxp://relay-backup.info/wp-content/uploads/doc.php resolving to 10.61.245.208 via syncstorage.com.


Qualys detected a multi-stage attack chain. The initial phishing email from ceo@secure-verify.net contained a link to hxxps://cacheedge.io/callback. This redirected to http://update-data.online/wp-content/uploads/doc.php on gateway-static.dev. A secondary email from admin@urgent-notice.online pointed to hxxp://cache-backup.com/panel/index.html which delivered Emotet. The final payload callback was https://backup-cloud.online/api/v2/auth resolving to 199.52.236.235 via node-portal.tech.


Proofpoint detected a multi-stage attack chain. The initial phishing email from billing@account-update.xyz contained a link to hxxp://nodecloud.cc/admin/config. This redirected to https://data-login.cc/login on mailmail.tech. A secondary email from confirm@secure-verify.net pointed to https://proxy-mail.cc/download/update.exe which delivered NjRAT. The final payload callback was http://cdnapi.dev/secure/token resolving to 192.253.1.201 via backupnode.site.


Qualys detected a multi-stage attack chain. The initial phishing email from updates@document-share.link contained a link to hxxp://storage-storage.online/panel/index.html. This redirected to http://authcdn.cc/login on updatesecure.info. A secondary email from info@urgent-notice.online pointed to hxxps://gateway-portal.live/callback which delivered Raccoon Stealer. The final payload callback was http://storage-cloud.net/callback resolving to 172.109.117.195 via mailportal.cc.


ESET Research detected a multi-stage attack chain. The initial phishing email from ceo@urgent-notice.online contained a link to https://storagerelay.tech/portal/verify. This redirected to hxxp://updateportal.io/portal/verify on portalcdn.io. A secondary email from confirm@phishing-domain.com pointed to hxxp://gateway-update.tech/wp-content/uploads/doc.php which delivered FormBook. The final payload callback was http://backup-static.club/collect resolving to 28.148.10.50 via node-relay.link.


Mandiant detected a multi-stage attack chain. The initial phishing email from admin@phishing-domain.com contained a link to https://noderelay.info/api/v2/auth. This redirected to hxxp://portal-auth.dev/gate.php on sync-storage.tech. A secondary email from verify@account-update.xyz pointed to hxxp://secure-secure.top/login which delivered BumbleBee. The final payload callback was hxxp://backupcloud.net/api/v2/auth resolving to 103.198.248.34 via staticstatic.cc.


CrowdStrike detected a multi-stage attack chain. The initial phishing email from info@document-share.link contained a link to http://cloudgateway.tech/panel/index.html. This redirected to https://relay-api.top/api/v2/auth on login-login.info. A secondary email from contact@credential-check.site pointed to http://backup-auth.xyz/gate.php which delivered BlackCat. The final payload callback was https://proxyportal.online/collect resolving to 85.231.60.208 via proxycloud.online.


Zscaler ThreatLabz detected a multi-stage attack chain. The initial phishing email from notification@secure-verify.net contained a link to hxxps://storagesync.top/download/update.exe. This redirected to hxxp://backupcloud.io/callback on staticupdate.io. A secondary email from finance@secure-verify.net pointed to hxxps://portalcache.info/wp-content/uploads/doc.php which delivered QakBot. The final payload callback was http://portalproxy.info/panel/index.html resolving to 172.19.146.157 via nodegateway.xyz.


Google TAG detected a multi-stage attack chain. The initial phishing email from report@login-portal.tech contained a link to https://backupsync.online/download/update.exe. This redirected to https://cdnrelay.org/portal/verify on edge-proxy.info. A secondary email from report@secure-verify.net pointed to http://storagelogin.online/api/v2/auth which delivered WarmCookie. The final payload callback was http://static-storage.info/admin/config resolving to 98.3.122.115 via relay-storage.net.


Volexity detected a multi-stage attack chain. The initial phishing email from helpdesk@secure-verify.net contained a link to hxxps://data-storage.site/admin/config. This redirected to http://edge-mail.io/gate.php on relaystatic.dev. A secondary email from verify@credential-check.site pointed to hxxps://updateproxy.tech/api/v2/auth which delivered FormBook. The final payload callback was hxxp://cache-static.xyz/secure/token resolving to 192.206.92.105 via backupportal.live.


Check Point Research detected a multi-stage attack chain. The initial phishing email from admin@auth-check.org contained a link to http://nodegateway.net/wp-content/uploads/doc.php. This redirected to hxxps://edge-portal.xyz/wp-content/uploads/doc.php on portalportal.tech. A secondary email from helpdesk@identity-verify.cc pointed to http://cloud-login.club/download/update.exe which delivered DanaBot. The final payload callback was https://staticnode.site/login resolving to 69.127.131.248 via cacheproxy.online.


INTERPOL detected a multi-stage attack chain. The initial phishing email from it@identity-verify.cc contained a link to hxxps://backupauth.org/admin/config. This redirected to hxxps://portalsecure.com/api/v2/auth on update-mail.xyz. A secondary email from account@identity-verify.cc pointed to https://node-static.xyz/panel/index.html which delivered Dridex. The final payload callback was hxxps://edge-update.dev/admin/config resolving to 154.20.19.238 via storageupdate.info.


CISA detected a multi-stage attack chain. The initial phishing email from ceo@identity-verify.cc contained a link to https://cloud-cloud.net/download/update.exe. This redirected to hxxps://updatesync.dev/secure/token on proxy-relay.live. A secondary email from report@mail-service.info pointed to https://storagenode.club/assets/js/payload.js which delivered RemcosRAT. The final payload callback was http://relay-gateway.io/api/v2/auth resolving to 10.47.137.66 via data-data.xyz.


Dragos detected a multi-stage attack chain. The initial phishing email from contact@secure-verify.net contained a link to hxxp://portalapi.site/collect. This redirected to hxxps://cdngateway.info/login on cloud-sync.top. A secondary email from noreply@phishing-domain.com pointed to hxxps://api-edge.info/admin/config which delivered DarkSide. The final payload callback was http://datasecure.top/secure/token resolving to 192.143.210.117 via mailmail.info.


Symantec detected a multi-stage attack chain. The initial phishing email from support@credential-check.site contained a link to hxxp://backupcdn.net/assets/js/payload.js. This redirected to https://backup-cloud.live/wp-content/uploads/doc.php on relaystorage.live. A secondary email from hr@document-share.link pointed to http://syncsecure.tech/download/update.exe which delivered WarmCookie. The final payload callback was hxxps://updateproxy.club/wp-content/uploads/doc.php resolving to 192.162.9.96 via data-sync.link.


NCSC detected a multi-stage attack chain. The initial phishing email from alert@auth-check.org contained a link to https://sync-cdn.link/admin/config. This redirected to https://syncgateway.club/api/v2/auth on cloudrelay.org. A secondary email from confirm@mail-service.info pointed to hxxps://cdn-portal.cc/admin/config which delivered BlackCat. The final payload callback was https://authauth.cc/collect resolving to 80.116.128.70 via dataupdate.xyz.


SentinelOne detected a multi-stage attack chain. The initial phishing email from ceo@auth-check.org contained a link to hxxps://storage-sync.top/login. This redirected to https://cloud-auth.cc/login on cloudsecure.club. A secondary email from it@auth-check.org pointed to hxxps://edgeproxy.xyz/secure/token which delivered Qbot. The final payload callback was hxxps://cache-update.live/wp-content/uploads/doc.php resolving to 210.75.154.156 via portal-login.com.


Qualys detected a multi-stage attack chain. The initial phishing email from updates@urgent-notice.online contained a link to hxxp://mailrelay.io/wp-content/uploads/doc.php. This redirected to https://static-cache.link/wp-content/uploads/doc.php on cache-storage.online. A secondary email from billing@phishing-domain.com pointed to https://update-cache.top/api/v2/auth which delivered Lumma Stealer. The final payload callback was hxxp://relayedge.online/panel/index.html resolving to 192.221.185.162 via node-data.cc.


Cisco Talos detected a multi-stage attack chain. The initial phishing email from ceo@account-update.xyz contained a link to http://portalupdate.live/portal/verify. This redirected to https://gatewaysecure.top/admin/config on storagecdn.link. A secondary email from support@mail-service.info pointed to hxxp://relayupdate.dev/download/update.exe which delivered Gootloader. The final payload callback was http://authedge.link/secure/token resolving to 204.24.236.252 via login-cdn.online.


Dragos detected a multi-stage attack chain. The initial phishing email from security@document-share.link contained a link to https://portal-sync.dev/gate.php. This redirected to hxxps://cloudstatic.org/download/update.exe on secure-cdn.link. A secondary email from info@identity-verify.cc pointed to http://syncsync.com/wp-content/uploads/doc.php which delivered Vidar. The final payload callback was hxxps://cache-proxy.net/api/v2/auth resolving to 33.221.42.251 via portal-proxy.dev.


NCSC detected a multi-stage attack chain. The initial phishing email from verify@mail-service.info contained a link to hxxps://syncproxy.net/gate.php. This redirected to https://mail-secure.online/callback on secure-api.tech. A secondary email from info@identity-verify.cc pointed to hxxp://loginupdate.io/api/v2/auth which delivered Cobalt Strike. The final payload callback was http://update-update.net/api/v2/auth resolving to 183.137.107.244 via cache-cdn.com.


Rapid7 detected a multi-stage attack chain. The initial phishing email from confirm@secure-verify.net contained a link to hxxp://updatebackup.org/api/v2/auth. This redirected to hxxp://proxylogin.xyz/portal/verify on proxy-relay.io. A secondary email from support@phishing-domain.com pointed to hxxps://syncsync.online/login which delivered Meduza Stealer. The final payload callback was http://cdnportal.com/gate.php resolving to 42.13.131.121 via api-sync.net.


Sophos X-Ops detected a multi-stage attack chain. The initial phishing email from admin@document-share.link contained a link to hxxps://auth-auth.online/assets/js/payload.js. This redirected to http://portalsync.online/assets/js/payload.js on cachesync.link. A secondary email from report@document-share.link pointed to https://edgemail.online/gate.php which delivered Vidar. The final payload callback was http://data-data.site/assets/js/payload.js resolving to 192.247.144.139 via staticapi.live.


Tenable detected a multi-stage attack chain. The initial phishing email from finance@secure-verify.net contained a link to hxxps://cloud-cdn.io/portal/verify. This redirected to hxxp://cloudcloud.info/login on storagesync.online. A secondary email from contact@login-portal.tech pointed to hxxps://staticedge.org/gate.php which delivered LockBit. The final payload callback was http://update-update.org/gate.php resolving to 172.41.53.121 via cloudstatic.site.


Palo Alto Unit 42 detected a multi-stage attack chain. The initial phishing email from finance@login-portal.tech contained a link to https://cdn-cloud.live/panel/index.html. This redirected to hxxp://api-proxy.link/callback on auth-secure.link. A secondary email from support@identity-verify.cc pointed to hxxps://data-update.io/assets/js/payload.js which delivered Dridex. The final payload callback was http://edgeupdate.io/assets/js/payload.js resolving to 175.237.247.33 via nodeupdate.info.


FBI detected a multi-stage attack chain. The initial phishing email from service@urgent-notice.online contained a link to http://relay-auth.club/panel/index.html. This redirected to hxxps://update-cache.io/admin/config on relay-auth.net. A secondary email from contact@urgent-notice.online pointed to https://gatewaygateway.xyz/download/update.exe which delivered Gootloader. The final payload callback was http://storage-login.dev/gate.php resolving to 71.214.157.26 via relay-update.dev.


SentinelOne detected a multi-stage attack chain. The initial phishing email from admin@secure-verify.net contained a link to https://mail-static.live/callback. This redirected to hxxp://cloudrelay.info/secure/token on portalcdn.xyz. A secondary email from hr@phishing-domain.com pointed to http://storage-relay.online/panel/index.html which delivered IcedID. The final payload callback was https://proxydata.top/api/v2/auth resolving to 183.31.225.204 via data-proxy.club.


NCSC detected a multi-stage attack chain. The initial phishing email from account@secure-verify.net contained a link to hxxp://static-static.site/download/update.exe. This redirected to http://cdn-backup.online/download/update.exe on logincache.top. A secondary email from ceo@identity-verify.cc pointed to hxxps://cachegateway.net/secure/token which delivered DanaBot. The final payload callback was https://datadata.link/api/v2/auth resolving to 14.98.13.249 via gateway-secure.io.


Microsoft MSRC detected a multi-stage attack chain. The initial phishing email from confirm@credential-check.site contained a link to hxxp://mail-api.top/portal/verify. This redirected to http://sync-cache.xyz/wp-content/uploads/doc.php on authgateway.online. A secondary email from finance@login-portal.tech pointed to http://gatewaynode.com/gate.php which delivered AsyncRAT. The final payload callback was https://backup-proxy.org/assets/js/payload.js resolving to 192.208.146.128 via loginauth.link.


ESET Research detected a multi-stage attack chain. The initial phishing email from security@auth-check.org contained a link to hxxp://login-portal.io/assets/js/payload.js. This redirected to hxxp://nodeproxy.com/collect on portal-login.online. A secondary email from account@secure-verify.net pointed to hxxp://authgateway.top/panel/index.html which delivered Vidar. The final payload callback was https://edge-backup.tech/panel/index.html resolving to 192.238.201.252 via clouddata.net.


CrowdStrike detected a multi-stage attack chain. The initial phishing email from it@account-update.xyz contained a link to hxxps://updatesync.link/collect. This redirected to http://syncsync.dev/callback on api-proxy.tech. A secondary email from confirm@mail-service.info pointed to http://securelogin.info/collect which delivered RemcosRAT. The final payload callback was hxxps://nodestorage.link/callback resolving to 67.232.14.183 via relay-auth.xyz.


Zscaler ThreatLabz detected a multi-stage attack chain. The initial phishing email from security@account-update.xyz contained a link to https://mail-relay.info/assets/js/payload.js. This redirected to https://proxy-gateway.site/panel/index.html on edgedata.xyz. A secondary email from hr@auth-check.org pointed to hxxp://nodebackup.net/panel/index.html which delivered Emotet. The final payload callback was http://auth-secure.online/login resolving to 172.60.198.224 via staticbackup.io.


FBI detected a multi-stage attack chain. The initial phishing email from finance@urgent-notice.online contained a link to hxxps://mail-data.info/gate.php. This redirected to hxxps://mailbackup.site/portal/verify on secure-cache.io. A secondary email from admin@secure-verify.net pointed to hxxps://auth-cache.top/login which delivered PlugX. The final payload callback was hxxp://backup-relay.live/collect resolving to 172.243.37.35 via storage-node.info.


Sophos X-Ops detected a multi-stage attack chain. The initial phishing email from service@auth-check.org contained a link to https://storage-portal.top/wp-content/uploads/doc.php. This redirected to http://cache-auth.top/portal/verify on portal-sync.live. A secondary email from confirm@mail-service.info pointed to https://proxycache.dev/login which delivered SmokeLoader. The final payload callback was hxxp://cloud-update.link/download/update.exe resolving to 10.125.237.108 via static-static.link.


Rapid7 detected a multi-stage attack chain. The initial phishing email from admin@auth-check.org contained a link to http://gateway-storage.io/download/update.exe. This redirected to http://secure-data.io/secure/token on node-edge.io. A secondary email from billing@credential-check.site pointed to hxxps://securegateway.com/panel/index.html which delivered REvil. The final payload callback was hxxps://mail-cache.io/admin/config resolving to 192.203.245.162 via update-data.com.


Dragos detected a multi-stage attack chain. The initial phishing email from noreply@credential-check.site contained a link to http://cdn-cloud.com/api/v2/auth. This redirected to http://edge-api.dev/collect on apicache.io. A secondary email from noreply@document-share.link pointed to http://secure-cloud.live/callback which delivered Latrodectus. The final payload callback was https://secureauth.tech/api/v2/auth resolving to 192.157.79.170 via relay-update.live.


FBI detected a multi-stage attack chain. The initial phishing email from billing@urgent-notice.online contained a link to hxxp://storage-edge.link/portal/verify. This redirected to http://portal-cloud.io/admin/config on relaylogin.dev. A secondary email from report@secure-verify.net pointed to hxxps://staticstorage.tech/login which delivered Latrodectus. The final payload callback was https://data-data.tech/panel/index.html resolving to 21.13.179.83 via sync-portal.top.


Kaspersky GReAT detected a multi-stage attack chain. The initial phishing email from verify@account-update.xyz contained a link to hxxp://cloudupdate.club/collect. This redirected to hxxps://apisync.club/admin/config on syncedge.net. A secondary email from account@mail-service.info pointed to https://apigateway.online/admin/config which delivered Lumma Stealer. The final payload callback was hxxps://cdn-secure.online/portal/verify resolving to 201.154.247.70 via edge-static.net.


Secureworks detected a multi-stage attack chain. The initial phishing email from noreply@document-share.link contained a link to hxxp://cdn-cache.live/callback. This redirected to https://edge-node.site/assets/js/payload.js on backupcloud.link. A secondary email from noreply@auth-check.org pointed to hxxps://proxy-secure.com/panel/index.html which delivered TrickBot. The final payload callback was hxxps://mail-relay.link/api/v2/auth resolving to 210.191.215.129 via relaystorage.top.


Tenable detected a multi-stage attack chain. The initial phishing email from hr@identity-verify.cc contained a link to hxxps://gatewaystatic.club/login. This redirected to hxxp://storage-edge.net/wp-content/uploads/doc.php on cache-cdn.site. A secondary email from support@document-share.link pointed to hxxp://loginsync.club/portal/verify which delivered REvil. The final payload callback was hxxp://proxycdn.com/secure/token resolving to 208.242.248.230 via loginbackup.club.


FBI detected a multi-stage attack chain. The initial phishing email from hr@account-update.xyz contained a link to https://edgeproxy.online/gate.php. This redirected to hxxp://datacdn.top/secure/token on relaybackup.top. A secondary email from support@account-update.xyz pointed to hxxps://loginedge.cc/collect which delivered DanaBot. The final payload callback was http://cdn-cdn.club/wp-content/uploads/doc.php resolving to 10.7.161.200 via node-update.live.