Hunting a Global Formbook Campaign with Machine Learning

This is the story of a hunt: how a pile of 276 Formbook samples run through a machine learning pipeline led us to a global Business Email Compromise campaign. The idea behind that pipeline starts simple: take a pile of samples you suspect share an origin, then group the ones that behave alike. Compared side by side, two clusters show you which direction a family is moving. What an operator dropped or added since the last wave.

Most clustering in CTI leans on C2 signatures, code similarity or the Diamond Model’s triangle. This post takes a fourth approach: clustering on behavior itself. What a sample actually does when it runs and how closely that behavior matches its neighbors. That behavioral signal is what surfaced the Formbook cluster that turned out to be a global Business Email Compromise campaign.

Part 1: The Formbook Business Email Compromise Campaign

We ran 276 Formbook hashes through the clustering pipeline using an algorithm named HDBSCAN that groups similar samples together. It split the dataset into 17 clusters. One of them (Cluster 5) stood out for its size: just six samples, first seen between May 20 and July 14, 2026, descending from a larger parent cluster.

That small cluster was the starting point. Our pivot began with a single hash inside it, surfaced through VMRay UniqueSignal (052180b675d2fefe91bb9cf0255d7fd64c7dac33040aa3d005b20e24710d9c32). UniqueSignal had already flagged it as a fresh, unique Formbook indicator with MITRE ATT&CK context attached automatically. That was enough to place it in the cluster, but it said nothing yet about what the sample actually talked to on the wire.

We enriched the hash through the VMRay Platform, pulling its full analysis report: https://www.vmray.com/analyses/_tf/99841e882569/report/network.html

This gave us the process tree, command lines and the complete list of contacted domains the sandbox observed at runtime. That report is where our C2 (www.finance77-laudantium[.]pro) first surfaced. Every Formbook sample ships with a list of decoy domains alongside its real command-and-control address. A built-in noise layer meant to waste an analyst’s time, with the list partially reshuffled on each run specifically to survive this kind of analysis.[^3]

We took the domain to VirusTotal. The tell that separates it from the decoys is the “Communicating Files” section. VirusTotal’s count of how many distinct malware samples have talked to that domain. A live C2 accumulates traffic from dozens of unrelated infections while a pure decoy sits near zero. Checked against that count, www.finance77-laudantium[.]pro stood out immediately: registered January 26, 2026, sitting behind Cloudflare with 46 communicating files platform-wide. Its panel path /ge47/ matched the cluster’s own recorded C2 paths exactly: https://www.virustotal.com/gui/domain/www.finance77-laudantium.pro/relations

It wasn’t operating alone. One of the cluster’s Turkish-language lures, named “Para transferi makbuzu 2131RI50089500.001” in the above results, carried a list of fourteen contacted domains that all POST to the same /ge47/ path: https://www.virustotal.com/gui/file/7c9c40ddb803b7af04b173af2d001d80ef7ed8a93f95e9413cd70f17567bfe97/relations

12points[.]se · 911itg[.]com · appliancerookies[.]shop · bythebellboxing[.]com · cutoffwheelsrus[.]com · dakarcocktail[.]com · droppingjulzz[.]com · dtu92[.]top · finance77-laudantium[.]pro · heyarefamily[.]store · jefyd[.]top · projectyola[.]click · spectrumcomercial[.]com · thousandoaksbsalandscaping[.]com

Most of that pool was registered in a narrow window, December 26, 2025 through February 25, 2026. A few even share a registrar ID (dtu92[.]top and jefyd[.]top both trace to registrar 1479; appliancerookies[.]shop and cutoffwheelsrus[.]com to registrar 146).

From purchase orders to forged bank receipts

The 46 files that reached finance77-laudantium[.]pro lay out a timeline:

Date	Lure filename	Theme
2026-05-20	Documento de orden de compra N° OC 26750…	Spanish fake purchase order
2026-05-21	Steel piping materials_Bill of Quantity Tender…	Steel-pipe tender documents
2026-05-22	Solicitud de orden de compra OC 26003850…	Spanish fake order request
2026-05-27	Purchase Order_PO_VN35980_JY Globalfoods Co…	Spoofed PO against a real Seoul food importer[^1][^2]
2026-06-01	Para transferi makbuzu 2131RI50089500…	Turkish generic wire-transfer receipt
2026-06-09	Order Requisition Proposal form PR705251910…	Procurement request form
2026-06-11	Ziraat Bankasi Swift Mesaji e_dekont…	Forged SWIFT receipt impersonating Ziraat Bank
2026-06-17	Thong bao thanh toan Swift dien tu VCB170626 USD 37750…	Forged SWIFT notice impersonating Vietcombank
2026-06-20	Ziraat Bankasi Swift Mesaji e_dekont 17062026…	Second Ziraat wave, one week later

The campaign opened with generic purchase-order spam and from June 11 onward, shifted into two waves forging receipts from Ziraat Bank and Vietcombank. That’s a lure built for accounting and finance staff specifically. It’s the standard supporting move for business email compromise: use stolen credentials to intercept or redirect a real payment instruction already in flight.

Pivoting off the domain

We were able to uncover finance77-laudantium[.]pro’s real IP address through DNS history. One resolution from an uncached resolver exposing the real origin, 5[.]45.75.98 (AS58061), Scalaxy B.V., a Netherlands host. Passive DNS on that single IP returned 200 domain records, and 189 of them follow the same naming pattern:

finance777-<word>.pro 76
finance77-<word>.pro 73
finance771-<word>.pro 29
finance99-<word>.sbs 10
finance30-<word>.pro 1

The words filling that pattern — laudantium, consequatur, beatae, quia, dolor, voluptatem — are straight from Lorem Ipsum filler text. That seems to be a dictionary based domain-generation algorithm. Querying VT Intelligence for the pattern directly confirmed this one IP was a small slice of something much bigger:

// VT Intelligence — domain search

entity:domain domain:”finance77-*.pro” → 177 results

entity:domain domain:”finance777-*.pro” → 182 results

entity:domain domain:”finance771-*.pro” → 74 results

entity:domain domain:”finance99-*.sbs” → 211 results

entity:domain domain:”finance30-*.pro” → 67 results

entity:domain domain:”finance*-*.sbs” → 300 results (query cap hit)

Who’s on the receiving end?

The files that reached the active C2 mostly arrived via corporate mail security pipelines. File paths like /tmp/eml_attach_for_scan/, /tmp/cortex-job-…/, and D:\auto_black_abuse\ point to email security gateways and Cortex XDR/XSOAR sandboxes. Meaning these were live attachments landing in corporate inboxes and auto-submitted by the receiving organization’s own defenses. That rules out individual consumers as the target and confirms organizations running email security tooling.

Scanning names and institutions across the full dataset surfaced two more patterns worth naming. On May 21, three near-identical samples across different clusters carried “Project [code]” tender lures naming the University of Bahrain and the University of Sharjah. Their contacted-domain lists on VirusTotal matched exactly: the same four domains, cake11298[.]online, thewhitediamond[.]org, aiueokaki[.]com, and ncumibrs.github[.]io.

Pulling every file that had ever talked to those four domains turned up five more samples:

Hash (short)	Lure filename	Status
72d8e3b25d5076a52640aca8d8e05fe629e8784d5fadbc533d4db50f0ae5aa70	RE GOVT OF SHARJAH UNIVERSITY OF SHARJAH – Project 0238.exe	First found
337c323b0e90ccd3d20df64ef6f59a745ce14359b406359f16bf20e5053a50c6	University of Bahrain- Project FMD20240942.exe	First found
e84fab3a4048a67e7c5c5022c975cb6f797eb08f748d11ca1d98a7ea34b01522	GOVT __OF SHARJAH – UNIVERSITY OF SHARJAH – Project 0238.exe	Pivoted
a2c0ea8985ee918233ed7178fb74b14afecde0611bc7f4785e3c7187666f8233	GOVT_ OF SHARJAH – UNIVERSITY OF SHARJAH – Project 0238.exe	Pivoted
bb25f156255aa80f91f0a3b889ac5329341633d83bf3b9b1c43676b92899b48b	UNIVERSITY OF SHARJAH Project -FMD20240342.exe	Pivoted
c1db3f31f6416c1f1f66a48ba0de6eb55f092c3135fb4eb55366a84ac81b2cc7	University of Bahrain- Project FMD20240342.exe	Pivoted
697b237ac6e4f7e52dc679b4c0364d591268cd02d89d29d9783331612a380367	RAK_ SWIFT PAYMENT INTER-BANK SETTLEMENT FT2024037358.exe	Pivoted

These samples are built as a forged SWIFT inter-bank settlement notice, aimed at whoever handles real interbank transfers. And FormBook’s credential and clipboard harvesting is exactly what turns that inbox into the wire fraud pivot. All seven samples reached real inboxes while corporate mail security gateways caught them after delivery. This wave was live between May and July 2026 against Gulf institutions.

Separately, Cluster 7 carried two waves – 17 days apart – of a lure named for the same vessel (“Dolphin 06”) using the Q88 tanker vetting form format. A Google search revealed that this is a real charter and vetting questionnaire in use since 1988.[^4][^5] Paired with an unrelated Cash-to-Master lure found earlier in this dataset, that points to a bait library written by someone who knows maritime charter paperwork specifically.

Taken together, the verified targets fall into three groups. Trade, finance and accounting departments across Turkiye, Vietnam, Spain and Italy. Maritime and tanker charter operators, a pattern that recurs across at least six clusters. And Gulf public sector, university and interbank settlement targets in Bahrain and the UAE, where seven samples were confirmed on shared C2 infrastructure within an eight-week window.

Part 2: How the Hunt Began? – Behavioral Clustering

Triaging 276 hashes one at a time isn’t realistic for a human analyst. Therefore our first job is narrowing that pile into smaller groups worth investigating individually, such as the Cluster 5 in Part 1. Infrastructure, domains, IPs, registrars, could do part of that narrowing. But infrastructure is also the first thing an operator rotates and Formbook ships with a decoy list built specifically to make that kind of pivot harder. Behavior is a steadier signal: which techniques a sample triggers, what its process tree looks like and what its command lines contain tend to stay consistent even as the C2 infrastructure underneath changes.

That’s exactly the kind of problem machine learning is well suited for. Security vendors worldwide already lean on it to cut through sample volume no human could triage by hand. At a high level, the process has four steps: normalization, which makes different sandbox runs of the same malware comparable; feature extraction, which captures the behavior described above; vectorization, which turns that behavior into a form that can be measured and compared mathematically; and clustering, which turns 276 individual hashes into a handful of groups an analyst can actually investigate. The rest of this section walks through how it works.

Two data sources feed the pipeline that answer different questions. VMRay UniqueSignal is a CTI feed delivering unique, fresh indicators in STIX format. Because this data comes straight from VMRay’s own sandbox, runtime context like MITRE ATT&CK events arrives pre-attached to each indicator. The VMRay Platform is the source for UniqueSignal and provides the detailed analysis reports: process trees, command lines, PIDs, resolved techniques, and parsed C2 configuration. In short, UniqueSignal delivers the relevant intelligence, while the VMRay Platform provides the detailed enrichment.

Before any of this data gets compared across samples, it has to be cleaned up, or normalized. Because two sandbox runs of the exact same Formbook build won’t produce identical raw reports, even though the malware itself hasn’t changed. VMRay assigns each run a random 16-character filename, renames the sample to its own hash before execution, and generates a fresh random username for the analysis account. None of that reflects anything the malware actually did. But left alone, a clustering algorithm can’t tell the difference between “this sample behaves differently” and “this run just had a different random username.” It would treat both as real differences. So before any of the three features below get computed, process names are resolved back to stable labels (SAMPLE.exe, DROPPED1.exe, and so on), and command-line text is stripped of exactly those four artifacts.

Once the data is normalized, each sample gets scored on three features:

01 MITRE ATT&CK labels. Pulled straight from VMRay UniqueSignal, each indicator already carries its resolved ATT&CK technique IDs as feed labels. These get turned into a multi-hot vector: one column per technique ID, shared across the whole sample set, so every hash is compared against the same fixed list of possible techniques.

How does the Multi-Hot encoding work?

Every indicator carries the ATT&CK technique IDs VMRay already resolved as feed labels. A single, fixed technique vocabulary is defined across the whole sample set; each hash gets 1 (present) or 0 (absent) for every column in that vocabulary. Because the column order is shared, two hashes’ vectors become directly comparable.

02 Process tree shape. Two samples from the same Formbook build tend to spawn a similarly shaped process tree, parent and child processes branching in a comparable pattern even when exact process names or PIDs differ. To score that similarity, we use an algorithm named Weisfeiler-Lehman subtree kernel. It works by hashing each node’s label together with its children’s labels, and using that hash as the node’s new label. It then repeats that process three times, so each label gradually reflects more of the tree beneath it. Two nodes end up with matching labels only if the branches underneath them are structured the same way. Comparing how many labels two trees share gives a similarity score based on structure.

How does the Weisfeiler-Lehman algorithm work?

Two samples from the same build tend to spawn a similarly shaped parent/child process tree. The Weisfeiler–Lehman technique captures that shape by relabeling every node with a hash of itself together with its children’s current labels; the process repeats three times. The result is a count of recurring sub-structures.

03 Procedure command line. The actual command-line text VMRay recorded is lightly normalized and then broken into overlapping chunks of three to five characters (character n-grams). Then they are weighted by how often each chunk appears. This catches recurring substrings, like a flag, a path fragment or an encoded argument, even when the full command line varies between samples.

How does the N-gram technique work?

The raw command-line text VMRay recorded is lightly normalized, then split into 3–5 character n-grams and weighted by term frequency. The window slides one character at a time across the text; the result is a vector that counts recurring substrings.

Each of the three blocks gets L2-normalized on its own before being concatenated into one vector, so a sample with a long list of ATT&CK tags doesn’t dominate one with just a few, and the binary technique block stays comparable to the frequency-weighted command-line block.

Clustering itself runs on HDBSCAN, an unsupervised algorithm that groups samples by similarity. It doesn’t require committing to a cluster count up front and it leaves genuinely dissimilar samples unclustered instead of forcing them into one.

Appendix — Indicators

Investigate mail exchange history and rotate any credentials if any of these are observed in your environment.

Active C2 www.finance77-laudantium[.]pro (panel path /ge47/, tcp/80)

Rotational C2 pool 12points[.]se · 911itg[.]com · appliancerookies[.]shop · bythebellboxing[.]com · dakarcocktail[.]com · droppingjulzz[.]com · dtu92[.]top · heyarefamily[.]store · jefyd[.]top · projectyola[.]click · spectrumcomercial[.]com · thousandoaksbsalandscaping[.]com

Origin infrastructure 5[.]45.75.98 — AS58061 Scalaxy B.V. (NL)

Domain-generation pattern to hunt finance77-*.pro · finance777-*.pro · finance771-*.pro · finance99-*.sbs · finance30-*.pro

References

[^1]: JY Globalfoods Co., Ltd. — UK Companies House, FC036456 [^2]: JY Globalfoods Co., Ltd. — ImportGenius trade record [^3]: Formbook/xLoader decoy-domain configuration — Check Point Research, “Stealth is never enough, or Revealing Formbook successor’s C&C infrastructure” (2021) [^4]: Q88 tanker vetting questionnaire — Veson Nautical [^5]: Q88 industry adoption — BIMCO

VMRay Research — behavioral clustering pipeline: VMRay UniqueSignal (via OpenCTI) + VMRay Platform per-hash reports, HDBSCAN over a fused ATT&CK / process-tree / command-line vector.

UniqueSignal (NEW!)

DeepResponse

Professional Services

TotalInsight

FinalVerdict

Analyzer (Legacy)

Use Cases

Industry

Success Stories

By Category

By Company

Why VMRay

News

About Us & Contact

Careers

Insights

Malware Analysis Reports

Cybersecurity glossary

Hunting a Global Formbook Campaign with Machine Learning

Part 1: The Formbook Business Email Compromise Campaign

From purchase orders to forged bank receipts

Pivoting off the domain

Who’s on the receiving end?

Part 2: How the Hunt Began? – Behavioral Clustering

Appendix — Indicators

References

Get The Latest Update

Subscribe to our newsletter

Table of Contents

Share With Others:

You May Also Like:

What Indicators Miss: Geo-Aware Malware and Two Hidden Backdoors

Read now

Pivoting in MISP: From Individual Indicators to Broader Threat Context

Read now

Why Behavior-Based Detection Is the New Standard

Read now

Missed the headlines?

We’re featured in: