Through the assets and agents components, the platform maintains a real-time inventory of targeted and compromised hosts. Each host record carries:
-
Hostname
-
IP Address
-
Operating System
-
User Context
-
A Version Value
-
Free-Form Labels and Tags
-
First and Last Seen Timestamps
-
Live State, Shown as a Coloured Status Marker (Online, Idle or Stopped)
Together these fields give operators an at-a-glance view of active footholds. Hosts are grouped by network “segment”, with values internal, external and dmz that mirror enterprise network zoning, and each engagement is bounded by a scope expressed as CIDR ranges – both indicating an operation that reasons explicitly about its position within a victim network. A companion artefacts repository stores operational evidence under defined types – screenshot, image, log, file, binary, dump and pcap – meaning the operators retain memory dumps, packet captures and recovered binaries, and attach screenshots as proof of compromise (with a 50 MB upload limit and backend magic-byte validation of uploads).
Recovered from the console bundle:
const t=[“ip”,”hostname”,”os”,”segment”,”services”,”tags”,”first_seen”,”last_seen”]
s.status===”stopped”?”⚫”:s.status===”idle”?”🟡”:”🟢”
“option”,{value:”dmz”,children:”dmz”} ; “option”,{value:”dump”,children:”dump”} ; “option”,{value:”pcap”,children:”pcap”}
The credentials component is especially revealing. Rather than storing free-form secrets, it constrains each captured credential to a defined type, and the available types are themselves a statement of intent: password, hash, kerberos_ticket, api_token, cookie and private_key. This is the toolkit of an actor focused on credential theft and lateral movement in Windows and Active Directory environments, NTLM hashes for pass-the-hash, Kerberos tickets for pass-the-ticket and ticket forging, session cookies for authentication-token hijacking, and private keys and API tokens for onward access. Each entry is tied to a target principal recorded in domain form (for example “corp\svc-backup”) and exposes an explicit “reveal” action that discloses the secret value only on demand.
Recovered from the console bundle:
“option”,{children:”password”} ; {children:”hash”} ; {children:”kerberos_ticket”} ; {children:”api_token”} ; {children:”cookie”} ; {children:”private_key”}
reveal:(e,t)=>G.get(/workspaces/${e}/credentials/${t}/reveal)
placeholder:”principal (например: corp\svc-backup)”
The platform’s workflow is formal and measured. Findings and risks carry a severity of critical, high, medium, low or info, while tasks are triaged on a P0-P3 priority scale (P0 denoting a blocker), a vulnerability-management discipline more typical of a professional security team than of a criminal panel. Work items advance through an explicit state machine (not_started, in_progress, attempted, confirmed_exploit, failed, blocked) and targets through a parallel lifecycle (new, confirmed, exploited, reported), with the confirmed_exploit state awarding points to the responsible operator. A live “claims” mechanism lets an operator claim a target or task and later release it, deconflicting concurrent work so that two operators do not act on the same target at once, in itself evidence of genuine multi-operator use. For clarity, and consistent with this report’s evidence-driven approach, confirmed_exploit is a progress label on the operators’ own scoreboard and is not evidence of a software exploit within the malware.
Recovered from the console bundle:
[“not_started”,”in_progress”,”attempted”,”confirmed_exploit”,”failed”,”blocked”]
(n.data??[]).filter(S=>S.status===”confirmed_exploit”).reduce((S,f)=>S+(f.points||0),0)
The console also exposes the operators’ collaboration surface and working language. It provides an “Agent Chat”, per-item comment threads, an acknowledged notes feed, and a structured internal Knowledge Base, a navigable tree of directories and articles that supports embedded Mermaid diagrams – in which the operators maintain and visually document their own playbooks and methodology; authored content is tagged by source, distinguishing entries written by human operators from those posted automatically by agents. The interface text is written predominantly in Russian, and operators are explicitly instructed to write “на русском” (in Russian). Its placeholder examples are not generic filler but operational tradecraft, instructing operators to record, for instance, that they “received SYSTEM on dc01 via PrintNightmare” (CVE-2021-34527, against a domain controller), to “select a wordlist for AD spray” (Active Directory password spraying), to set a target_scope as a CIDR or hostname, to enter service-account principals such as “corp\svc-backup”, and to triage unread “P0-blocker” items – the working vocabulary of a team operating against enterprise Active Directory.
Recovered from the console bundle:
“💬 Agent Chat” ; “/kb/tree” ; “/kb/article” ; “/kb/search” ; “/kb/history”
placeholder:”описание (markdown, на русском)” (“description (markdown, in Russian)”)
“например: получил SYSTEM на dc01 через PrintNightmare” (“e.g.: got SYSTEM on dc01 via PrintNightmare”)
“title (например: «Подберите wordlist для AD spray»)” (“e.g.: pick a wordlist for AD spray”)
Finally, several engineering and operational-security choices point to a mature, in-house development effort rather than an off-the-shelf panel. Record search is performed server-side with PostgreSQL pattern matching (the interface refers explicitly to “ILIKE” queries), indicating a conventional relational backend; an export function is deliberately constrained to omit stored secrets, which remain obtainable only through the reveal action, shielding the actor’s most sensitive holdings even from their own bulk exports; and the platform distinguishes privileged operators by an administrative flag, implying a tiered team rather than a flat group.
Recovered from the console bundle:
“🔎 поиск по тексту (server-side ILIKE)” (“text search (server-side ILIKE)”)
“Экспорт по текущему фильтру (без секретов, они только через /reveal)” (“export by current filter – without secrets; only via /reveal”)
{id:n.id,username:n.username,is_admin:!!n.is_admin}
These artefacts move the assessment beyond infrastructure indicators and into the operation’s internal character: an organised, Russian-speaking offensive team working through a deliberately engineered, multi-operator platform – credential vaults, segment-aware target tracking, an evidence repository, a shared knowledge base and a points-based scoreboard – to coordinate managed agents on compromised hosts.
By considering all of the above C2 behaviours and the relationship between the two servers, VMRay Labs continued the research with “212.193.30[.]45”, which behaves not as a console but as a proxy/redirector that fronts the actor’s infrastructure behind the GitHub domain. A request to the bare host is answered with a redirect toward "http://github[.]com", whereas a request to the very resource the malware fetches – /proxies.txt – is met instead with an HTTP 406 response referencing the invalid path http://github[.]com/proxies.txt . This inconsistency is assessed as a misconfiguration in the threat-actor infrastructure, and it betrays the redirector’s non-genuine nature.
Because GitHub operates no official servers in Russia, a campaign-linked Russian IP address presenting a TLS certificate in the name of http://github[.]com and redirecting all requests toward it was itself a strong anomaly and was selected for further pivoting. The following content was served on port 443 (TCP) by “212.193.30[.]45”:
HTTP/1.1 301 Moved Permanently
Content-Length: 0
Location: https://github[.]com/
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
This IP address is likewise hosted by TimeWeb Ltd. (AS9123) and also exposes an open SSH service on port 22. By pivoting on the server’s characteristics, its HTML content, certificate specifications and ASN, we identified 48 previously unattributed servers, assessed with high confidence to be command-and-control nodes of the campaign. The set numbered 48 at the outset of the investigation and has since reduced to the 44, which are included as indicators of compromise in this report.
It was also observed that some of these C2 servers expose port 10050 and run proxy software such as Traefik and TinyProxy; almost all of them additionally expose an open SSH port and, as a defining trait of this cluster, redirect their traffic to GitHub. On one server, alongside the GitHub domain, several Microsoft subdomains were also being redirected to, together with a Russian-language website, http://loopaai[.]ru. Although that server later became unreachable, VMRay Labs recorded the domains it had redirected to:
It is highly unusual for a Russian server to proxy toward all of these domains, which may indicate that the threat actors are also attempting to conceal their infrastructure behind Microsoft-owned domains.
Having mapped this hidden infrastructure, VMRay Labs continued by pivoting on “STANDOFF COORD”. Although the platform was unfamiliar at first, the discovery of one particular server on TimeWeb Ltd. -the same ASN on which the rest of the infrastructure resides, shed light on the situation: “217.198.13[.]211”.
This server hosts several domains which, at the time of publication, are likewise undetected by any security vendor as malicious and remain hidden:
-
bull-drops.online
-
bull-drops.ru
-
bulldrops.online
-
http://bulldrops.ru
-
http://xn--90aguaqgfu.xn--p1ai (буллдроп.рф)
-
http://www.xn--90aguaqgfu.xn--p1ai (www.буллдроп.рф)
-
ggstandoff.online
-
zadrot.gg
-
influencesite.ru / gginfluence.influencesite.ru
-
www.xn----9sbhgocsfmg4a1kfg.xn--p1ai
-
www.mobilearena.online
-
xn----9sbhgocsfmg4a1kfg.xn--p1ai
-
mobilearena.online
-
xn--90aguaqgfu.xn--p1ai
The six domains above do not front a decoy or placeholder website; the server “217.198.13[.]211” carries the threat actor’s own operator tooling. Alongside the public-facing site described below, the host serves two distinct, bespoke operator applications, a Telegram account-farm and a node-based automation platform (the latter delivered as the production JavaScript bundle index-Caak4qkG.js on port 80). Both rest on the same technology stack as the STANDOFF COORD console examined in Section 2.3, React single-page applications built with Vite, Zustand and axios against a JSON /api/v1 backend secured by JWT bearer tokens, with access, and refresh-token rotation and a single-sign-on endpoint, which points to a common development team and toolchain across the operation.
These operator applications sit within a broader service footprint. The host, again on TimeWeb Ltd. (AS9123), listens on ports 443, 3000, 3001 and 8090, and presents a Let’s Encrypt TLS certificate issued for the punycode domain xn--90aguaqgfu[.]xn--p1ai. As Figure 14 shows, port 8090 returns a page titled “GG Influence”, evidently the operators’ own name for the apparatus, and a label whose “GG” prefix echoes the “ggstandoff” branding seen elsewhere across the infrastructure.
Figure 14: The “GG Influence” page returned by port 8090 of 217.198.13[.]211, seen in Shodan
Port 3000 is the most revealing of all. As Figure 15 shows, it serves a polished, Russian-language website built on the Next.js framework and branded “Мобильная Арена” (“Mobile Arena”),which presents itself as “киберспортивный портал о Standoff 2, PUBG Mobile и мобильных играх”, an e-sports portal devoted to Standoff 2, PUBG Mobile and other mobile games. Its content is a search-engine-optimised stream of material aimed squarely at young mobile gamers. The articles promise “free skins” and ways to earn in-game “gold without donating” in Standoff 2, offer promotional codes for Standoff 2 and PUBG Mobile, and feature tier lists and curated round-ups of “case” (loot-box) gambling sites. All of it is interlinked with category pages, a “bonuses” section, a “cooperation” (advertising and affiliate) page, and outbound Telegram and Discord links. The site’s own keyword metadata explicitly includes “ggstandoff”, binding it to the ggstandoff family of domains documented earlier in this report. This portal is best understood as the public, top-of-funnel face of the operation: a content lure that aggregates a gaming audience. It is positioned to channel that audience toward the monetisation and engagement-manipulation machinery described elsewhere in this report, using promotional codes, “free” in-game currency, skin-gambling referrals and Telegram links.
The first application is a Russian-language Telegram account-farm and engagement-automation platform, served from a backend API at http://217.198.13[.]211:8002/api/v1. It is divided into fourteen functional areas:
-
Sessions
-
Session Management
-
Channels
-
Channel Joins
-
Unavailable Channels
-
Comments
-
Chats
-
Dialog Builder
-
Participant Parser
-
Proxies
-
Reputation
-
Tasks
-
Thread Monitor
-
TG Codes
Its own interface text states its purpose without ambiguity, describing the “Автоматическое вступление ботов в каналы и дискуссии” (automatic joining of bots into channels and discussions) and inviting the operator to “Добавляйте и управляйте Telegram аккаунтами для ботов” (add and manage Telegram accounts for bots). The platform is organised around “sessions”, individual Telegram accounts operated as bots, and provides the full machinery required to acquire, maintain and weaponise them at scale.
For each account, the platform automates the Telegram authentication sequence from end to end, submitting the telephone number, the login code and, where required, the two-factor password (through the API endpoints /sessions/auth/start, /sessions/auth/code and /sessions/auth/password). To obtain those login codes automatically, it monitors Telegram’s official service account, chat 777000, across the controlled accounts and through their assigned proxies, a function the interface labels “Мониторинг кодов входа из Telegram (чат 777000) через прокси сессии (Monitoring login codes from Telegram (chat 777000) via the session proxy)”. Each account is routed through a proxy drawn from a dedicated proxy-management module, which imports and validates proxy lists in bulk (the endpoints /proxies/import and /proxies/import-async), thereby consuming, directly, the pool of relay nodes produced by the proxy-botnet described in Sections 2.1 and 2.2. A reputation module supports the gradual “warming” of accounts in order to evade Telegram’s anti-abuse controls. Account warming refers to the practice of building up a new account’s activity history incrementally, joining a small number of channels, generating modest interaction, before deploying it for bulk operations; Telegram’s automated systems apply restrictions to accounts that engage in mass activity immediately after creation, and an account with an established activity history is significantly less likely to be flagged or suspended.
With a stock of authenticated accounts in hand, the platform drives them to join target channels and their linked discussion groups in bulk, importing channels en masse and tracking those that become “unavailable” once the bots are banned, and to scrape the participants of those channels into an exportable “Готовый список username для рассылок” (ready-made username list for mass distribution). The whole process is coordinated by a task scheduler, timed in Moscow time (“МСК”) and exposing scheduled tasks, execution histories and per-bot progress, so that joining, parsing and posting can be run continuously and at volume.
The platform’s defining feature is its content-generation engine. Through a visual “Dialog Builder”, the operators assemble automated conversation flows whose central element is a GPT node: a large-language-model component that produces Telegram comments and replies in the voice of a configurable persona, defined by a name, an age, a writing style and a goal; and bound to one of the farmed accounts. The engine can comment on channel posts, reply to individual messages, watch discussions for keywords and answer them automatically (“ИИ-ответы”, or AI replies), and sustain real-time conversations between its bots and genuine users. This is, in effect, a system built for coordinated inauthentic behaviour: the manufacture of synthetic engagement, opinion and conversation on Telegram at scale, under the guise of plausible human personas.
The second application, served as a production bundle on port 80, is a bespoke, node-based automation and orchestration platform, comparable in concept to commercial workflow-automation products, but custom-built. Presented in English, governed by role-based access control (with distinct Admin and Manager roles) and Google OAuth single sign-on, it allows operators to construct workflows on a visual canvas, embed code through an integrated editor, and execute them on schedules or webhooks (recorded as “runs”). Its catalogue of integrations is the clearest statement of its function: electronic mail through Gmail and IMAP, Google Sheets, the Anthropic “Claude” large-language model, Telegram, WhatsApp, generic HTTP requests, and arbitrary scripts, each triggered by cron expressions, webhooks or schedules.
The workflow primitives recovered from the code show precisely how those integrations are used: harvesting email addresses, reading inboxes over IMAP, drafting and sending mail, generating text and replies with Claude, and dispatching messages over Telegram and WhatsApp, every step backed by a typed vault of stored credentials that accommodates generic and Anthropic API keys, HTTP basic and bearer tokens, OAuth client identifiers and secrets, Gmail OAuth tokens and Google service-account keys. In practice, it is a multi-channel, AI-driven mass-outreach and engagement engine capable of running automated campaigns across e-mail, Telegram and WhatsApp; equally, through its scripted HTTP requests and stored credentials, it can serve as the connective tissue that binds the operation’s other platforms together.
Taken together, these platforms establish a third dimension to the campaign, alongside the access-and-monetisation layer of Sections 2.1 and 2.2 and the hands-on-keyboard intrusion console of Section 2.3. Several threads bind them to that wider operation: shared hosting on the same TimeWeb Ltd. autonomous system; the bull-drops and xn--90aguaqgfu[.]xn--p1ai domains they serve, which remained undetected by security vendors at the time of writing; an identical bespoke technology stack and /api/v1 authentication pattern; Russian-language interfaces and Moscow-time scheduling; and, most concretely, the Telegram farm’s reliance on the very proxy pool into which the malware’s victims are conscripted. The capture shown in Figure 16 corroborates several of these threads: it records “217.198.13[.]211” serving all of its resources from the same TimeWeb network and reveals that its frontend was served from a Vite/React development server, a configuration error that exposed the applications’ unminified source. Its construction is unmistakable: a Russian-speaking team has assembled an industrial capability for AI-assisted, multi-channel, coordinated inauthentic engagement and mass outreach.
Figure 16: urlscan.io Capture of 217.198.13[.]211, Showing its HTTP Transactions and the Exposed Vite/React Development Server.
VMRay Labs assesses, with high confidence, that this infrastructure constitutes a large-scale, AI-driven disinformation and engagement-manipulation operation run by Russian-speaking actors. The combination of an industrial Telegram account-farm, artificial-intelligence personas that comment and converse under fabricated identities, a multi-channel automation hub spanning electronic mail, Telegram and WhatsApp, and a public gaming-content portal aimed at a young, Russian-speaking audience amounts to a coordinated capability for shaping opinion, manufacturing artificial consensus and engagement, and conducting mass outreach at scale. On the available evidence, the operation is assessed to serve one or more of the following ends: the dissemination of disinformation and the artificial amplification of narratives; the posting of fake product reviews and endorsements, together with gambling and fraud-related promotion across the Standoff 2 and mobile-gaming ecosystem; and the building and steering of a gaming audience toward the malware and proxy-botnet infrastructure documented earlier in this report. The specific narratives, targets and beneficiaries of the operation reside in server-side data that was beyond the scope of this analysis and are not asserted here as fact; the existence, sophistication and industrial scale of the capability, however, are established directly by the actors’ own tooling.
3. Conclusion
Operation STANDOFF demonstrates how a contemporary Russian-speaking cybercriminal group can operate well beyond the boundaries of a conventional malware campaign. On a single body of shared infrastructure, the actors run four mutually reinforcing capabilities: the mass distribution of commodity malware, a proxy-botnet that conscripts victims into relay infrastructure, a bespoke console for the targeted hands-on-keyboard intrusion of enterprise networks, and an AI-driven, multi-channel apparatus for influence and mass outreach. These are bound together by common tooling, a common development team, and a common concealment strategy built around the GitHub domain.
The campaign’s defining characteristic is convergence. Automated, opportunistic cybercrime; stealers, a coin miner and a proxy-botnet, is fused with deliberate, human-operated intrusion tradecraft, an Active Directory-oriented credential vault, segment-aware targeting, shared playbooks and a multi-operator scoreboard, and with a coordinated influence operation built on an industrial Telegram account-farm, AI personas, and a Standoff 2 and PUBG Mobile gaming lure. This breadth, combined with Russian-language tooling, Moscow-time scheduling and consistent “ggstandoff” branding, supports a high-confidence assessment of a single, organised Russian-speaking group pursuing multiple revenue and influence objectives in parallel.
Critically, the link between these disparate capabilities was established not by isolated indicators but by execution-level intelligence: by observing how the malware actually behaved, individually unremarkable artefacts, a malformed User-Agent, a proxy-list retrieval, a redirect to GitHub, were connected into a single operation and used to surface infrastructure that had evaded vendor detection.
Two points bear emphasis for defenders. First, much of this infrastructure remains active and undetected at the time of writing, including operator-controlled domains that no security vendor currently flags as malicious; the indicators provided in this report are intended to enable their detection and blocking. Second, the operation’s most novel element, a purpose-built, AI-assisted influence and engagement-manipulation platform sharing infrastructure with a criminal intrusion set, reflects a broader trend in which financially motivated cybercrime, targeted intrusion and information operations increasingly converge within a single threat actor.
4. Indicators of Compromise
The indicators below are provided to support detection, hunting and blocking. Network indicators are listed as observed; many of the campaign domains and servers were not flagged as malicious by security vendors at the time of writing.
Initial sample (Pay-per-Install Loader)
|
|
File name: setup_x86_x64_install.exe
|
|
MD5: e77221d7a4b47b9107ba1b61a551ca89
|
|
SHA-1: 95c5ae3fec0d900e4634e11b3ad81971e78e2b31
|
|
SHA-256: 22ebb950592ccc987fd1dab9ddcd34c4fc519975dc1b82e4a793dc038d2d8e41
|
Campaign Command-and-Control and Operator Infrastructure
|
|
212.193.30.29 (serves /server.txt; hosts russianhackers.online and the “STANDOFF COORD” console)
|
|
212.193.30.45 (serves /proxies.txt; GitHub-proxied redirector node)
|
|
russianhackers.online
|
|
api.russianhackers.online
|
|
217.198.13.211 (operator host: Telegram account-farm, automation platform and gaming-lure portal)
|
|
bull-drops.online
|
|
bull-drops.ru
|
|
bulldrops.online
|
|
http://bulldrops.ru
|
|
http://xn--90aguaqgfu.xn--p1ai
|
|
ggstandoff.online
|
|
zadrot.gg
|
|
influencesite.ru
|
|
www.mobilearena.online
|
|
xn----9sbhgocsfmg4a1kfg.xn--p1ai
|
|
www.xn----9sbhgocsfmg4a1kfg.xn--p1ai
|
|
mobilearena.online
|
GitHub Proxied Command and Control Cluster (TimeWeb Ltd., AS9123)
|
|
5.129.196.85
|
|
5.129.208.108
|
|
5.129.209.17
|
|
5.129.209.58
|
|
5.129.210.32
|
|
5.129.210.139
|
|
5.129.214.85
|
|
5.129.216.104
|
|
5.129.217.228
|
|
5.129.219.114
|
|
5.129.225.220
|
|
5.129.226.97
|
|
5.129.213.59
|
|
5.129.213.241
|
|
5.129.227.196
|
|
5.129.231.176
|
|
5.129.231.240
|
|
5.129.233.99
|
|
5.129.236.52
|
|
5.129.236.68
|
|
5.129.237.19
|
|
5.129.237.53
|
|
5.129.238.90
|
|
5.129.238.104
|
|
5.129.238.105
|
|
5.129.239.229
|
|
5.129.242.37
|
|
37.252.21.227
|
|
45.139.78.67
|
|
46.149.70.18
|
|
89.223.71.207
|
|
90.156.224.57
|
|
92.51.22.34
|
|
93.183.80.126
|
|
147.45.183.198
|
|
147.45.237.23
|
|
185.247.185.85
|
|
188.225.39.252
|
|
188.225.72.157
|
|
188.225.82.125
|
|
194.87.56.156
|
|
194.87.131.30
|
|
195.133.73.225
|
|
212.60.21.249
|
Commodity-Payload Command and Control, Distribution and Dead-Drop Resolvers (Delivered Malware)
|
|
RedLine Stealer: 185.215.113.44:23759 (MissionID “@Tui”)
|
|
Socelars: www.wgqpw.com
|
|
XMRig (Monero): pool.supportxmr.com:3333 (wallet 8BFyHJmwhhxXo29aFXZrTJTWDbkiQFEsBBnj1VnHBcy9ZQ2NKEUGdKvZbWGRNYamgAgJ75jsX1bzDiVh21D5WShJPJVqaMU)
|
|
Amadey / Loader Panels: wfsdragon.ru/api/setStats.php (104.247.81[.]99) ; 212.192.241[.]62/base/api/statistics.php ; 185.215.113[.]35/d2VxjasuwS/index.php
|
|
SmokeLoader: rcacademy.at/upload/ (188.40.141[.]211)
|
|
“borderxra” download paths: 91.219.236[.]207/borderxra ; 91.219.237[.]227/borderxra ; 185.225.19[.]18/borderxra
|
|
Other Downloaders / C2: server5.trumops.com (3.229.117[.]57) ; www.listincode.com / listincode.com (172.237.145[.]27) ; cloudjah.com/77_1.exe ; 65.108.69[.]168:16278 ; 23.88.118[.]113:23817
|
|
Pay-per-Install Hosting (Scaleway S3): coffee-music-laptop.s3.pl-waw.scw.cloud/publisher_installer/powerOff.exe (151.115.10[.]x) ; hammajawa7dou.s3.nl-ams.scw.cloud/advertiser_Installer/powerOff.exe (51.158.211[.]x)
|
|
Payload hosting: cdn.discordapp.com/attachments/915539163787460658/917347672489349130/myfile.exe
|
|
Dead-Drop Resolvers: http://t.me/borderxra; http://t.me/jredmankun;noc.social/@menaomi; qoto.org/@mniami ; pastebin.com/raw/A7dSG1te
|
|
Victim Tracking: http://iplogger.org – paths /2ANpP6, /143up7, /1FRbw7, /1FEbw7
|
|
Decoy / Unresolved Domains Referenced in Payload Configurations: all-mobile-pa1ments.com.mx ; buy-fantasy-football.com.sg ; buy-fantasy-gxmes.com.sg ; new-androidapps.me ; topniemannpickshop.cc ; blvckxxx.beget.tech
|
|
|
|
Staging directory: %LOCALAPPDATA%\Temp\7zSCB82E89C\
|
|
Dropped payloads: MonXXXXXXXX.exe (randomised names)
|
|
Fake system process: C:\Windows\rss\csrss.exe
|
|
Persistence: RaptorMiner.exe (Run key) ; Driver.url (Startup folder) ; scheduled tasks named “Schedule.Service.1” ; %APPDATA%\Roaming\teieedr ; %APPDATA%\Roaming\Sysfiles\Driver.exe
|
|
Services installed: VBoxGuest, VBoxMouse, VBoxSF, VBoxService, VBoxVideo, VBoxWddm
|
|
Local listeners: TCP 31461, TCP 49703
|
|
Mutexes: Global\h48yorbq6rm87zot ; Global\qtxp9g8w ; kEecfMwgjiZ5i-O1fR-8gT0
|
|
|
|
Malformed WinHTTP User-Agent: The intended “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36” transmitted with corrupted leading bytes, rendered as non-Latin (CJK) code points in memory and as a single control byte (0x02) on the wire.
|
Operator-Platform Fingerprints
|
|
“STANDOFF COORD” console; browser storage keys standoff.token and standoff.workspace.
217.198.13[.]211:8002 (Telegram account-farm API) and the “GG Influence” / “Мобильная Арена” services on the same host; browser storage key auth-storage.
|
5. Abbreviations
AD Active Directory
API Application Programming Interface
ASN Autonomous System Number
C2 Command-and-Control
CIB Coordinated Inauthentic Behaviour
CIDR Classless Inter-Domain Routing (an IP address-range notation)
DMZ Demilitarised Zone (a perimeter network segment)
IMAP Internet Message Access Protocol (e-mail retrieval)
IOC Indicator of Compromise
JARM An active TLS server fingerprinting method
JWT JSON Web Token
NSIS Nullsoft Scriptable Install System (an installer format)
NTLM NT LAN Manager (Windows authentication / password hashes)
OAuth Open Authorisation (a delegated-access standard)
PPI Pay-Per-Install (a malware-distribution model)
RBAC Role-Based Access Control
SSH Secure Shell
SSO Single Sign-On
TLS Transport Layer Security
TTP Tactics, Techniques and Procedures
WMI Windows Management Instrumentation
6. REFERENCES
[1] abuse.ch ThreatFox. “Raccoon Stealer botnet C2, Telegram dead-drop resolver t[.]me/borderxra.” IOC ID 1676437, IOC type: URL, threat type: botnet_cc,confidence: moderate (50%). First seen: 2025-12-12. Reporter: juroots. Available: https://threatfox.abuse.ch/ioc/1676437/.
[2] abuse.ch ThreatFox. “Raccoon Stealer botnet C2, Telegram dead-drop resolver t[.]me/jredmankun.” IOC ID 1676438, IOC type: URL, threat type: botnet_cc, confidence: moderate (50%). First seen: 2025-12-12. Reporter: juroots. Available: https://threatfox.abuse.ch/ioc/1676438/.
