2025-09-25 (Thursday): Received an email distributing a malicious installer for an #RMM tool. Details at github.com/malware-traf...

2025-09-24 (Wednesday): #LummaStealer infection with follow-up malware, possibly #Ghostsocks or #GoBackdoor. A #pcap of the infection traffic, malware samples, and list of indicators available at www.malware-traffic-analysis.net/2025/09/24/i...

2025-09-22 (Monday) #SmartApeSG campaign using #FileFix style #ClickFix technique on its fake CAPTCHA page for #NetSupportRAT. Script sent to victim through #clipboardhijacking downloads MSI from founderevo[.]com/res/velvet when pasted into a File Manager window (www.virustotal.com/gui/file/958...)

2025-09-03 (Wednesday): #Kongtuke fake CAPTCHA page leads to #ClickFix style script for #LummaStealer A #pcap of the infection traffic, the associated malware, and IOCs are at www.malware-traffic-analysis.net/2025/09/03/i...

2025-08-20 (Wed): #SmartApeSG for fake #CAPTCHA page with #ClickFix instructions that led to an MSI file for #NetSupport #RAT and the #NetSupportRAT infection led to #StealCv2. Malware samples, a #pcap, and indicators at www.malware-traffic-analysis.net/2025/08/20/i...

2025-08-20 (Wed): #Kongtuke still using #FileFix style #ClickFix instructions on its fake CAPTCHA pages. I never got any further than the HTTP POST request that sends information about the infected system host. Details at: github.com/malware-traf...

2025-08-15 (Friday): Information from a social media post I wrote for my employer about a #LummaStealer infection leading to #SectopRAT (#ArechClient2). A #pcap of the infection traffc, along with the associated #malware and artifacts are available at www.malware-traffic-analysis.net/2025/08/15/i...

2025-08-13 (Wednesday): #LummaStealer infection. The associated #malware, artifacts, a #pcap of the #Lumma Stealer traffic, and indicators of compromise are available at www.malware-traffic-analysis.net/2025/08/13/i...

2025-08-11 (Monday): Quick post of an #XLoader ( #Formbook ) infection, with a #pcap, email, and #malware sample available at www.malware-traffic-analysis.net/2025/08/11/i...

2025-08-01 (Friday): Some info on a #LummaStealer example I found today: github.com/malware-traf... #Lumma

2025-07-23 (Wednesday): Ten days of scans and probes and web traffic hitting my web server. A #pcap of the traffic is available at www.malware-traffic-analysis.net/2025/07/23/i...

2025-07-22 (Tuesday): Tracking the #SmartApeSG campaign using #ClickFix to push #NetSupportRAT. Details at: github.com/malware-traf...

With all the recent law enforcement actions in recent years, are Ransomware-as-a-Service operators are telling everyone to "protect your RaaS" ??

2025-07-17 (Thursday): Tracking the #SmartApeSG campaign for #ClickFix pages pushing #NetSupportRAT. Details at github.com/malware-traf...

2025-07-15 (Tuesday): #LummaStealer infection with #SecTopRAT. A #pcap of the #Lumma traffic and #SecTop #RAT activity, the #malware / artifacts from an infection, and the associated IOCs are available at www.malware-traffic-analysis.net/2025/07/15/i...

2025-07-15 (Tuesday): Some different IOCs from the #SmartApeSG #ClickFix page today. warpdrive[.]top <-- domain used for SmartAgeSG injected script and to display ClickFix page. sos-atlanta[.]com <-- domain from script injected into clipboard and to retrieve #NetSupportRAT malware package

2025-07-14 (Monday): #SmartApeSG script injected into page from compromised website leads to #ClickFix style fake verification page. ClickFix-ing you way through this leads to a #NetSupportRAT infection.

From my viewpoint, here are the various types of #ClickFix pages: #FileFix: Asks you to paste script into a File Manager window. #RunFix: Asks you to paste script into a Run window #TermFix: Asks you to paste script into a terminal window (cmd.exe console or PowerShell terminal).

2025-07-03 (Thursday): #FileFix style #ClickFix page from #Kongtuke injected script in page from legitimate site at besthotelshome[.]com. The mr.d0x article announcing FileFix calls it a ClickFix alternative, but it's really a -variant- of ClickFix. Just using File Manager instead of a Run window.

2025-07-02 (Wednesday): Another #LummaStealer infection with follow-up #Rsockstun malware. The Lumma Stealer infection uses a password-protected 7-zip archive, a NullSoft installer, and AutoItv3. Malware samples, a #pcap and some IOCs are available at www.malware-traffic-analysis.net/2025/07/02/i...

2025-06-27 (Friday): Ran another #LummaStealer infection today and saw different follow-up malware than yesterday. Same URL for sok.exe, but a different file. Same C2 traffic using TCP port 16443, but a different domain at eset-blacklist[.]net. Analysis at www.joesandbox.com/analysis/172... #Lumma

2025-06-27 (Friday): #SmartApeSG script for #ClickFix page leads to #NetSupport #RAT Details at: github.com/malware-traf... #NetSupportRAT #ClipboardHijacking

2025-06-26 (Thursday): #LummaStealer ( #Lumma ) infection leads to follow-up loader that retrieves a pen test tool hosted on Github and configures it as #malware. A #pcap of the infection traffic, the associated malware, and IOCs are available at: www.malware-traffic-analysis.net/2025/06/26/i...

2025-06-21 (Saturday): #KoiLoader / #KoiStealer infection. #pcap of the infection traffic, associated malware/files, and some of the indicators available at www.malware-traffic-analysis.net/2025/06/21/i...

2025-06-20 (Friday): Post I wrote for my employer on other social media about distribution of #malware disguised as cracked software. The malware is contained in password-protected 7-Zip archives to avoid detection. #pcap and malware files at www.malware-traffic-analysis.net/2025/06/20/i...

2025-06-18 (Wed): #SmartApeSG --> #ClickFix lure --> #NetSupportRAT --> #StealCv2 A #pcap of the traffic, the malware/artifacts, and some IOCs are available at www.malware-traffic-analysis.net/2025/06/18/i.... Today's the 12th anniversary of my blog, so I made this post a bit more old school.

2025-06-13 (Friday): Traffic analysis exercise: It's a trap! www.malware-traffic-analysis.net/2025/06/13/i...

2025-06-10 (Tuesday): Ten days of scans and probes and web traffic to a webserver I run (not my blog web server, but another one). After helping a coworker review an Apache Tomcat vulnerability, I opened TCP port 8080 to accept web traffic requests. www.malware-traffic-analysis.net/2025/06/10/i...

Been on vacation, and I've had a lot at work, so I haven't updated the blog in the last 3 to 4 weeks. I'm back now, and I was able to post some stuff that had backed up in my queue for the blog. New entries for May 22nd, May 27th, and May 31st at www.malware-traffic-analysis.net/2025/index.h...

2025-05-22 (Thurs): After the #LummaStealer disruption, I found an active sample today, so how effective was the disruption, really? SHA256 hash for the EXE: 8619bea9571a4dcc4b7f4ba494d444b8078d06dea385dc0caa2378e215636a65 Analysis: - tria.ge/250523-afpxx... - app.any.run/tasks/add82e...

2025-05-14 (Wed): A reminder these fake CAPTCHA pages for #ClickFix infections can also leave instructions to infect macOS hosts. Script had typo. I fixed it, but it still didn't work. Different GUIDs for different hosts hxxps[:]//qv.gahq[.]ru/fdgv.sh/01234567-89ab-cdef-0123-456789abcdef.solve

2025-05-06 (Tuesday): #RaspberryRobin activity - file hashes, malware samples, #WebDAV server info, and a #pcap of the infection traffic available at www.malware-traffic-analysis.net/2025/05/06/i...

2025-05-09 (Friday): #KoiLoader / #KoiStealer activity. Same type of distribution chain and infection characteristics as always. Example of downloaded zip available at: - bazaar.abuse.ch/sample/35236... - tria.ge/250510-a2fw5... - app.any.run/tasks/3adefb...

2025-04-22 (Tuesday): Always fun to find the fake CAPTCHA pages with the "ClickFix" style instructions trying to convince viewers to infect their computers with malware. Saw #StealC from an infection today. Indicators at github.com/malware-traf...

2025-04-21 (Monday): #Phishing email sends login credentials to Telegram. Phishing page URL: hxxps[:]//iipg[.]it/mail2/login-Inbox.html

2025-04-17 (Thursday): #MassLogger malware sent through #malspam. Infection traffic indicates stolen data sent to email server at mail.bouttases[.]fr. Details at github.com/malware-traf...

2025-04-04 (Fri): Social media post I wrote for my employer on other platforms. #KongTuke script in pages from legitimate websites leads to fake #CAPTCHA pages and #ClipboardHijacking / #pastejacking. These pages ask users to paste script into a Run window. Latest info at github.com/PaloAltoNetw...

2025-03-26 (Wednesday): #SmartApeSG traffic for a fake browser update leads to #NetSupport #RAT and #StealC infection. A #pcap from an infection, the associated #malware samples, and indicators of compromise ( #IOCs ) are available at at www.malware-traffic-analysis.net/2025/03/26/i...

2025-03-24 (Monday): #GuLoader for #Remcos #RAT ( #RemcosRAT ) distributed through email - More info at github.com/malware-traf...

This is whatever I think of when someone describes a threat actor or hacker as "sophisticated"

2025-03-10 (Mon): Post I wrote for my employer on other platforms. #Remcos #RAT email distribution used a zip archive attachment with a .7z file extension. During a test infection, we saw indicators of a #Keylogger and a Hacking tool to view browser passwords. More info at github.com/PaloAltoNetw...

2025-03-06 (Friday): A #Phishing email saying I have 47,939 messages in my mailbox vastly overestimates how important or popular I am. URL for phishing site from email: kwikkopyegypt[.]com/wp-admin/login.php/web.mail.verify/inbox.html

2025-03-05 (Wednesday): #Astaroth ( #Guildma ) distributed through Brazil #malspam - As usual, I didn't get a full infection chain, but I got the initial zip archive from link in the email. Details at github.com/malware-traf...

Social media post I wrote for my employer on other platforms: 2025-02-26 (Wednesday): #XLoader (#Formbook) sent thru #malspam. Email has an attached PDF document. PDF has links for a ZIP download, and the ZIP contains files using DLL side-loading for XLoader. Details at github.com/PaloAltoNetw...

2025-02-25 (Tuesday): #VenomRAT from #malspam uses zip attachment containing a VHD file containing a VBS file. Calls Pastebin link for C2 server information. Details at github.com/malware-traf...

Post I wrote for my employer on other social media: 2025-02-18 (Tues): Legit but compromised websites with injected script for #SmartApeSG lead to a fake browser update for #NetSupportRAT malware. During an infection run, we saw follow-up malware for #StealC. Details at github.com/PaloAltoNetw...

At this point, I just assume any AI response is wrong.

2025-02-12 (Wed): #VIP_Recovery (an #AgentTesla variant) from Brazil #malspam --> zip attachment --> extracted EXE. File name: Factura Gastos.exe Email accounts for data exfiltration: antonipont@grupobdb[.]com --> cludsewe3@gmail[.]com EXE available at: bazaar.abuse.ch/sample/c7620...

2025-02-10 (Monday): Social media post on #StrelaStealer I assisted on for my employer at www.linkedin.com/posts/unit42... and x.com/Unit42_Intel... #pcap, email and malware samples at malware-traffic-analysis.net/2025/02/10/i...

2025-02-07 (Friday): Today's boring example of #malpsam pushing #GuLoader for #AgentTesla style malware. EXE of this malware available at bazaar.abuse.ch/sample/833aa...