Threat intelligence and security testing for cannabis and regulated retail.

1. TimelineOct 30, 2026

   Virtualine seizure and AS202412's last three weeks New

   BGP history of the AS202412 estate from October 8 to 28, set against Operation Omegaline, the FBI's seizure of virtualine.net announced October 27, whose aliases include Omegatech. It shows two estate-wide flaps, AS6461 originating in parallel 14 hours before the final withdrawal, and AS0 ROAs signed on either side of it. In the October 30 01:35 UTC monitor snapshot, all 19 invalid routes are still below 4% RIS visibility.

   Sources DOJ USAO-EDVA release · SecureLeaf BGP intercept and CIDR monitor

   TimelineMonitor snapshotDOJ release
2. ResearchOct 29, 2026 · v1.1 Oct 30

   AS0 ROAs and the AS202412 routing transition New

   AS202412 withdrew its whole monitored estate on October 28, the day after the DOJ announced the virtualine.net seizure. Most of the space returned under AS6461, where two AS0 ROA objects from different issuing CAs leave 19 /24s RPKI Invalid and visible to only about 3% of RIS peers. Version 1.1 adds the seizure context, the BGP history and the October 30 snapshot. Routing and RPKI observations only; no attribution to the new origin or resource holders.

   Scope 29 prefixes · AS202412, AS219199 → AS6461, AS51130

   Read
3. IncidentOct 23, 2026

   Omegatech direct-from-ASN .env harvesting — no compromise

   Ten cluster IPs scanned the Dispensight application tier (s01-app, kpi, help, TAXII) direct from announced AS202412 / AS197769 space, hunting exposed .env files. Every probe was refused (404/403) — nothing disclosed. 130.12.180.0/24 is now a recurring, blockable direct-scan pool.

   Source AS202412 130.12.180.0/24 (rotating), AS197769 102.220.160.0/23

   ReadSTIX
4. V18Oct 10, 2026

   Go Loader — Cloudflare-fronted stagers and a new signed Go loader

   ClickFix moves to purpose-registered domains behind Cloudflare. Stage 1 is a new self-signed Go 1.23.1 loader ("GraniteSystemsAnalytics") delivering the Remus stealer (CAPE-confirmed) — no EtherHiding this wave. Payload fetched at /<word>/<token>/.

   Lure degpoints[.]com, soutslts[.]com, seaopencd[.]com

   Read
5. V16+17Oct 4, 2026

   Variants B and C — what we know so far

   Consolidated update across both late-September iterations: elevated Win+X lures, EtherHiding on BSC-testnet and Polygon, browser-side screenshot exfil, and the C2 forced onto Spamhaus-DROP AS202412.

   Lure freightbook365[.]com, gogreenlightloans[.]com

   ReadSTIX unified
6. V17Sep 28, 2026

   Variant C — Polygon EtherHiding and self-hosted C2 on AS202412

   C2 moves off Cloudflare-fronted stagers to entry-verifed-cdn[.]codes on 178.16.52.101 (Spamhaus DROP). The on-chain lookup failed in capture and only a numeric string reached the clipboard — delivery is degrading.

   Lure gogreenlightloans[.]com

   ReadSTIXYARASigma
7. V16Sep 24, 2026

   Variant B — elevated shell, failover loader, screenshot exfil

   Russian-localized fake Turnstile walks visitors to an administrator PowerShell. A three-domain failover loader feeds a TDS-gated clipboard stage, while an html2canvas screenshotter reports to helauth[.]com on every visit.

   Lure freightbook365[.]com

   ReadSTIXYARASigma
8. V15.3Sep 2, 2026

   Remus Stealer via ClickFix/EtherHiding — revised analysis

   Links the chain end to end, from a BSC-testnet EtherHiding lure through the AutoIt loader to the recovered native core (build B, 2026-08-28). Corrects five earlier statements; documents four AutoIt obfuscation layers and an NXDOMAIN sentinel check.

   Lure dorz[.]nl

   ReadSTIXYARASigma
9. V15.2Sep 2, 2026

   Remus Stealer — IExpress-SFX and AutoIt loaders replace Donut

   The delivery pipeline is rebuilt on IExpress-SFX and AutoIt, but the durable RSA-1024 C2 key (dc4cb858…febfac6f) is confirmed in memory across two detonations. New C2 209.38.82.72:9048 / cdire[.]shop verified from packet captures.

   Lure dorz[.]nl

   ReadSTIXYARASigma
10. v14.3Aug 6, 2026

    Gatekeeper TDS and dual-chain EtherHiding

    A bot-filtering gatekeeper TDS sits in front of the fake-Cloudflare overlay. Staging runs on Polygon-mainnet and BSC-testnet in parallel over XHR, WebSocket and web3 channels. Stealer screen capture and WMI recon confirmed at runtime.

    Lure verrerie-farinelli[.]com

    Read
11. Aug 3Aug 3, 2026

    2026-08-03 detonation wave and the two-branch model

    Five TLS-decrypted detonations confirm V13.1.2 lineage and two segregated delivery branches (root and /std/), each with its own BSC-testnet contract, both on 158.94.211.92.

    Lure wissmann.co.il, jerseys.co.ke, ibrahimstores.com, +2

    Full write-up

    TLP:CLEAR public edition — freely redistributable. Five pcapng detonations across compromised WordPress lures (wissmann.co.il, jerseys.co.ke, ibrahimstores.com, classroom.mindloops.org, andstudio.lt), TLS-decrypted from embedded keylogs. All confirmed V13.1.2 lineage — no 14.x drift. The campaign runs two operationally-segregated branches, distinguished at the network, binary, and blockchain layers: root (digitalenterprise2026.com · /jsrepo · /my_enterprise/ · BSC contract 0x7Fd85c09…E437) and /std/ (senterprise2026.com · /teamrepo · /std_enterprise/ · 0xFB448D46…D469d), both C2s on 158.94.211.92. Durable pivots hold: MZER+GetPC prologue at offset 0, loader imphash edc8ef44e1870aad7a3e58dab17f8e1b, downloader imphash 8e7b065c967657cca657d11206f96e23. Per-victim loader recompile (~60s pre-detonation) makes per-sample SHA-256 non-durable — imphash is the pivot. Lure hosts are compromised victims (do-not-blocklist).

    • 5-Lure Wave — TLS-Decrypted PCAP
    • Two-Branch Model (root · /std/)
    • Per-Branch BSC-Testnet EtherHiding Contracts
    • imphash edc8ef44 / 8e7b065c — Durable Pivots
    • V13.1.2 Continuation — No 14.x Drift
    • STIX 2.1 (38 obj) + YARA + Suricata + HTML
    • TLP:CLEAR — Freely Redistributable
    Read
12. WP-002Aug 3, 2026

    WP-002 payload — native loader and CLR-hosted .NET infostealer

    Static and runtime characterization of the two delivered payloads: an MZER-polyglot loader injecting into svchost.exe, and a CLR-hosted browser infostealer exfiltrating over AES-encrypted raw sockets.

    Lure —

    Full write-up

    TLP:CLEAR public edition — freely redistributable. Full static + dynamic (VirusTotal Jujubox runtime) behavioral characterization of the two payloads the WP-001 chain delivers. Stage 2 (my_enterprise, 50,688 B) is a native MZER-polyglot loader — token/integrity recon, process enumeration, and VirtualAllocEx/WriteProcessMemory/CreateRemoteThread injection into svchost.exe — pulling enterprise/my_sss.bin from 158.94.211.92. Stage 3 (my_sss, 275,968 B) hosts the CLR (mscoree!CLRCreateInstance) and reflectively loads a managed infostealer: browser credentials/cookies + local files + screenshots, AES-encrypted over a raw socket to a /c0g1k2s3 gate. Key runtime finding: both payloads are evasion-gated (IsDebuggerPresent, Sleep(60000) stall) and C2-dependent — neither completed its network stage under analysis, which is precisely why public sandbox scores understate them. IOC trap flagged: the Global\CLR_CASOFF_MUTEX mutex is a legitimate .NET artifact, not a campaign marker.

    • MZER Polyglot (4D 5A 45 52) — Cross-Version Anchor
    • Native Loader → svchost Injection
    • CLR-Hosted .NET Browser Infostealer
    • AES Socket Exfil (/c0g1k2s3 gate)
    • Evasion-Gated: Debugger Check + 60s Stall
    • CLR_CASOFF_MUTEX = False-Positive Trap
    • STIX 2.1 (68 obj) + YARA (5 rules) + HTML
    • TLP:CLEAR — Freely Redistributable
    Read
13. V13.1.2Aug 1, 2026

    Parallel root and /std/ delivery branches

    Two delivery templates with separate contracts, beacon domains and payload hosts share one C2. Loaders are now recompiled per victim within 60 seconds, and targeting widens to Australia, Estonia, Serbia and the US.

    Lure worrigeesports.com.au, munis-minibus.com, martvarauto.ee, besen-group.com

    Read
14. V13.1Jul 25, 2026

    Twin-lure delivery revision on one shared backend

    A byte-identical native downloader across both lures becomes the primary pivot; per-wave .NET loaders compile three minutes apart.

    Lure tapviaspace.com, hi8.one

    Full write-up

    TLP:CLEAR public edition — freely redistributable. Two newly surfaced lures — tapviaspace.com and hi8.one — confirmed via sinkhole telemetry and detonated (ANY.RUN) on a single shared V13.1 backend. Continuity is nailed at the byte level: the Donut MZER polyglot header (4D 5A 45 52) + PIC bootstrap and the embedded BSJB .NET socket payload are intact. Primary pivot: the native WinHTTP first-stage downloader (da3ba493…55503dc) is byte-identical across both lures and unchanged since 2026-07-16 — any host serving it belongs to this operator. The two my_sss .NET loaders are recompiled per wave, their timestamps clustering 3 minutes apart (05:24:18Z / 05:27:18Z) inside the live SID window. Cradle revised to root path /?sid=<ms>-<rand> with -UseBasicParsing; infra stapled to the cluster via 158.94.211.92, second-stage C2 91.92.243.161:3038, and injector dntds.shop. Assessed V13.1, not V14: delivery + loader wrapper revised, payload family unchanged.

    • Twin Lures (tapviaspace.com · hi8.one)
    • Byte-Identical Downloader = Shared Pivot
    • MZER Polyglot + BSJB .NET Intact
    • Per-Wave Loaders — 3 min Apart
    • New 2nd-Stage C2 (91.92.243.161:3038)
    • hi8 Broken TLS Leaks ZeroSSL/Sectigo CA
    • STIX 2.1 + OTX-Ready YARA + HTML
    • TLP:CLEAR — Freely Redistributable
    Read
15. V13Jul 23, 2026

    Per-victim server rebuild and on-host csc.exe compilation

    The outer loader is rebuilt server-side per victim and a second compile runs on the host; injected svchost.exe hosts CLR v2.0, predating AMSI .NET integration.

    Lure healthcare site (unnamed)

    Full write-up

    TLP:CLEAR public edition — freely redistributable. Continuity is again imphash-confirmed: the Donut/.NET loader still carries edc8ef44e1870aad7a3e58dab17f8e1b — identical to V12 and V12.1, the same source tree recompiled once more. New compromised lure site in the healthcare sector (victim, deliberately unnamed pending remediation — not blocklisted). New in this release: the outer loader is rebuilt server-side per victim — its compile timestamp postdates the visitor's own session ID by ~5m25s, reproduced across two sessions — and a second compilation runs on the victim host via PowerShell Add-Type/csc.exe, emitting a Rozena-style VirtualAlloc/CreateThread launcher with randomised names per run. Injected svchost.exe hosts CLR v2.0.50727, which predates AMSI .NET integration — visible in ordinary fusion logs. New C2 domain dntds.shop alongside the V12 node senterprise2026.com. Final-stage objective remains unresolved and no capability is claimed.

    • imphash edc8ef44… STILL IDENTICAL to V12
    • Loader Compiled AFTER Victim's Session ID
    • Second Compile On-Host via csc.exe
    • CLR v2.0 in svchost = AMSI Avoidance
    • New C2 dntds.shop
    • Lure = Healthcare Site (Victim, Unnamed)
    • TLP:CLEAR — Freely Redistributable
    Read
16. V12.1Jul 16, 2026

    Native MinGW stager and recycled V11 C2

    Imphash-identical .NET loader; a new MinGW-w64/GCC-15 WinHTTP downloader fronts it, and the V11 domain is recycled onto a new /24.

    Lure naturlexikon-bayern.de

    Full write-up

    V12.1 analysis from full detonation forensics (PCAP + live artifacts). Same unknown APT reusing AS202412 infrastructure (operator of record: Omegatech LTD — infra provider, not a confirmed actor identity). Continuity is imphash-confirmed: the Donut/.NET loader carries edc8ef44e1870aad7a3e58dab17f8e1b — byte-identical to V12, i.e. the same source tree merely recompiled. New compromised lure naturlexikon-bayern.de (a Bavarian nature encyclopedia run by a charitable foundation — victim, not attacker infra). New in V12.1: a native MinGW-w64 / GCC-15 WinHTTP downloader stage now fronts the .NET loader — a different toolchain entirely. Infra rotated to 158.94.211.92 (V12 used 158.94.208.104), and the V11 domain digitalenterprise2026.com was recycled onto it while still serving the V12 stage config — so Chain_V11 and Chain_V12 now fire simultaneously. The MZER polyglot Donut header returns, and the EtherHiding contract 0xFB448D…D469d (BSC testnet) is extracted for the first time. Assessed V12.1, not V13: the chain config and .NET core are unchanged.

    • imphash edc8ef44… IDENTICAL to V12
    • Native MinGW/GCC-15 WinHTTP Stager
    • V11 Domain Recycled onto New /24
    • MZER Polyglot Donut Header Returns
    • EtherHiding Contract Extracted (BSC)
    • Lure = Charity Site (Victim, Not Blocklisted)
    • STIX 2.1 + OTX-Ready YARA + HTML
    Read
17. V12Jul 2026

    senterprise2026.com verification node

    A new C2 acts as an anti-replay verification node, stage 2 moves to /s_enterprise/, and eth_call is fully encoded — closing a YARA gap.

    Lure ejecutivos.es

    Full write-up

    V12 analysis from PCAP forensics and live-artifact triage. Attributed to an unknown APT reusing AS202412 infrastructure (operator of record: Omegatech LTD — infra provider, not a confirmed actor identity). New compromised WordPress lure ejecutivos.es; a new C2 domain senterprise2026.com acts as a verification / anti-replay node (confirmChallenge SID tracking). Stage-2 renamed /s_enterprise/ (was /my_enterprise/) and eth_call is now fully encoded in the string-array — closing the cleartext-eth_call YARA gap. Infra stays stapled to the cluster (158.94.208.104 · 91.92.240.121 · 178.16.53.137); fresh .NET Donut loader compiled 2026-07-07.

    • New Lure (ejecutivos.es)
    • senterprise2026.com Verification Node
    • s_enterprise/ Stage-2 (was /my_enterprise/)
    • Encoded eth_call — YARA Gap Closed
    • Infra Reuse (AS202412) = Same Unattributed Actor
    • STIX 2.1 + YARA + HTML Bundle
    Read
18. V11Jun 2026

    splitcam.com lure and the BSC-testnet shift

    EtherHiding moves from BSC mainnet to testnet; Donut-to-svchost injection re-confirmed, with Task Scheduler COM persistence on Windows 10.

    Lure splitcam.com

    Full write-up

    V11 campaign analysis from dual-VM (win10 + win11) tria.ge detonations and PCAP forensics. New compromised lure site splitcam.com; the EtherHiding contract read shifts from BSC mainnet to testnet, and the stage-2 path is renamed /my_enterprise/. Backend delivery stays constant on 158.94.208.0/24, keeping V11 stapled to the cluster. Donut → svchost.exe injection re-confirmed; win10 detonation adds Task Scheduler COM persistence.

    • New Lure (splitcam.com)
    • BSC Testnet EtherHiding
    • Infra Constant (158.94.208.0/24)
    • Donut → svchost Injection
    • Task Scheduler COM Persistence
    • STIX 2.1 + YARA Bundle (83 objects)
    Read
19. V10Jun 2026

    New lure, reversion to V8 baseline infrastructure

    A new standalone EtherHiding loader, but post-EtherHiding infrastructure reverts exactly to V8 — undoing V9's YARA-evasion rotation.

    Lure jbhtech.org.il

    Full write-up

    V10 campaign analysis with PCAP forensics. A new standalone EtherHiding loader (css.js) is delivered from a new compromised lure site, jbhtech.org.il, but post-EtherHiding infrastructure reverts to V8's exact baseline — same PS C2 IP, same staging path, same tid naming — undoing V9's YARA-evasion rotation. Static analysis confirms the stage-3 Donut blob and stage-4 CLR-hosting payload remain structurally consistent with V8.

    • New Lure Site (jbhtech.org.il)
    • Infra Reversion to V8
    • Donut Blob Re-Confirmed
    • CLR-Hosting Payload Analysis
    • Supports SL-RETRACT-2026-001
    Read
20. V9Jun 2026

    Infrastructure rotation and single-token YARA evasion

    Beacon and EtherHiding payload delivery split into separate stages; a surgical tid→sid rename defeats V8 rules. Browser-to-C2 in 26 seconds.

    Lure —

    Full write-up

    V9 campaign analysis with PCAP forensics. New architecture separates JS beacon from EtherHiding payload delivery. Introduces a surgical tid→sid mutation to defeat V8 YARA rules. Full compromise confirmed at 26 seconds.

    • RC4+Obfuscator.io Custom Obfuscation
    • Beacon / Payload Stage Split
    • Single-Token YARA Evasion
    • PCAP-Confirmed Forensics
    • STIX 2.1 Bundle (1,108 objects)
    • 26s Browser-to-C2 Chain
    Read
21. V8Jun 2026

    Complete kill chain — in-memory shellcode

    Three-stage in-memory execution from fake Cloudflare lure to RWX thread injection with zero disk artifacts, about one second to compromise.

    Lure —

    Full write-up

    Full end-to-end kill chain analysis of the Omegatech ClickFix v8 campaign (AS202412, Seychelles BPH). Three-stage in-memory shellcode execution from fake Cloudflare lure to RWX thread injection — zero disk artifacts, ~1s to compromise. Includes PCAP-extracted loader, YARA rules, SIEM queries, and STIX 2.1 bundle.

    • In-Memory Shellcode (T1620)
    • Fake Cloudflare Lure
    • P/Invoke via Add-Type
    • YARA + SIEM Rules
    ReadMemory dump PDF
22. MayMay 11, 2026

    Original whitepaper — ClickFix WordPress implant

    Where it started: static and behavioural analysis of the Shadow DOM implant and a secondary injector in a compromised WordPress install.

    Lure —

    Full write-up

    Full static and behavioural analysis of the ClickFix Shadow DOM JavaScript implant plus a secondary independent injector found in a compromised WordPress installation. Includes IOCs, deobfuscated payload breakdown, and remediation steps.

    • Shadow DOM Injection
    • Secondary JS Injector
    • Full IOC List
    • Remediation Guide
    Whitepaper PDFMalware report

No advisories match that search. Try a version number like “V15” or a lure domain.