Simon Kenin
@k3yp0d
Threat Hunter at SentinelOne | curatedintel.org Member | k3yp0d.blogspot.com | Opinions are of my own voices inside my own head | memes and music are welcome
1/4 Another day another ClickFix campaign, I call this one #CocoFix because it is dropping an 500mb+ sized executable named coco.exe Sample: app.any.run/tasks/a8b0d1...
1/2 MarkiRAT/Ferocious Kitten from early 2026: 334d5e38774bd0289346231a92a444cf 0c57def86b9d0e9df50101f45243b7a3 3c1f7d9d157c38d17a44f62b6560d3b4 d66de5d6dbcb6f460ae6240de8b7aab0 610696d1d05099125258d25a661704ce db6bc0e947acba379e540349f74fc6ee b56a18df4daf038785891f33c3e89489
1/2 IronWorm ELF Payload: 178d327d87243a6d937ea9f1e4bcb20e 7befd633f4744a436ef6d122381276c43401be3b 36abd242ddaa27f0160c539377a0e92cf781c1695137850acc87e3892b436d36
bonus: 2nd price.py 3cc7b1f2f7a119e4367159ab2cb23b83 9b49dd2a36f028850ba810883a8e58bd7d2f2fbd 57636c0107baa6c3ba33700e6115d5beafdf35466fb5e5db20d4de60e7f78e05 C2: coinhar[.]io
1/3 Suspected old DPRK sample of Pressure Chollima (TraderTraitor, Mata, Jade Sleet, Slow Pisces, UNC4899) price.py f9a80cc1b5a40d29718dd2da5c7cef04 2d1c79722edba23a55231fbbc5725aeb566accd3 776393d5d063a32c6e77b90485e9f15bd92bd346becfe718bd84de1ae9199b48
1/3 New BLUEWIPE wiper sample uploaded from Ukraine? O_o 7c76e51390b0d2e2759fad5ccee2bc30 b91be21e984407529691edb1bfe3f97dd4a1ae24 db41e0da7ab3305be8d9720769c6950b4dc1c1984ef857d3310eb873a0fc7674
2/4 The PDF masquerades the download link to be a Check Point security tool. The password for the RAR however is related to a cloud provider called cloudstar, but the small print say the service is provided by G.N.S. cellcom.co.il/production/B...
1/4 O_o help.pdf 02e3a2cc825b7ac3e1bad50d4088a74f 2d49a02c6e77d7ebcff87e62ab14d826f4281cba e422c2f25fbb4951f069c6ba24e9b917e95edb9019c10d34de4309f480c342df PDF in Hebrew contains a link to a password protected RAR archive hosted in @dropbox.com
4/5 This onlyoffice subdomain is also mentioned by Proofpoint, but the shared key and content are different. Test Projects.zip -> 8e7771ed1126b79c9a6a1093b2598282221cad8524c061943185272fbe58142d This file is listed in the IOCs of the CP blog and might have been reused
3/5 However, Check Point did not mention OnlyOffice. The missing link is available at any.run
5/5 Samples: app.any.run/tasks/191467... app.any.run/tasks/3a1761... app.any.run/tasks/3a1761... app.any.run/tasks/e3ac5b... app.any.run/tasks/1f26a7... app.any.run/tasks/6693a8... app.any.run/tasks/e4cd4f...
4/5 JS downloads NetSupport RAT and drops decoy PDF Example C2 139.28.38.39
3/5 Example zip 0f6f4c1821b71ea73213b3b290b7e23b Vchasno_doc_22.10.2025_0029.zip Zip contains either just a JS payload or benign files with additional archives which contains the JS payload
2/5 Example PDF ebb7c92f4d38510f8efab00eb8e2d9ad Платіжне_доручення_22.10.2025_00684096792.pdf PDF contains link to 2nd payload. 2nd stage payload is distributed among different hosting providers: Dropbox MS OneDrive 4sync
1/5 🇺🇦 Ongoing campaign targeting Ukrainians: EML->PDF->URL->ZIP->JS->NetSupport RAT Email 55ffcf6f4df8ab3f11a405794aa5f4d8
1/4 PDQ which downloads ScreenConnect, the "one weird" RMM trick combo move threat actors don't want you to find out...
2/3 Iranian POV: 60%!!! that's basically free, the Israelis won't resist and will register with their Microsoft account! Israeli POV: Vanzen??? Never heard about them... 60% off to register with MS account? I don't even have a MS account WTF is this shit? vanzen[.]org :
1/3 UNC4444 Watering Hole vanzen.co[.]il compromised to display an overlay pop-up for 60% discount when registering to the site.
5/8 Additional HTML vector: a6c618134fc314dbc7f25a542f838467 8fc5e49e7b0e008f2f7513c6a479ce05416a4ce3 1f6e3bfabb8b85bf7442da91179828762f3cb5c85b8e5fea55798d29c5441b0c
1/8 Sales Contract.pdf 9af100c85c1a58702dfb016c4cb95840 867d16c7150ea010ecbea787bd9939ea4fe93769 688a2ccc09e30bad2d235ce3895afecbbf9b5c5950c8ef2cf3eaba57f6445bb2
5/7 CCSD 15 Staff Compensation Statement (Available on Vistra Global).pdf d989aba36f0268f7d34d278dab90abd9 fbd891af13b5ccf4ff5b292f60492adf30a0649d 573b40d7729c315bf7593f668cd4f4b55532bd5414260e78377b689036bb4221 redirect to msks[.]pics