Research
This report maps the entire ecosystem of a DPRK IT worker infiltration scheme: key actors, GitHub aliases, laundering flows, shell companies, fake domains, platform infiltration, wallet infrastructure, and global enablers. We also examine the national security implications of the scheme, as well as how lax corporate hiring standards allowed North Korean operatives not just to get paid, but to access critical infrastructure, intellectual property, and production code.
Introduction
Over the last five years, the Democratic People’s Republic of Korea (DPRK) has transitioned from smash-and-grab cryptocurrency raids to a more covert, scalable model of economic warfare: the global deployment of disguised IT workers.
Orchestrated by elite units under the Reconnaissance General Bureau (RGB), these operatives acquire remote employment with U.S. and international tech firms using forged or stolen identities. Once embedded, they receive crypto-based salaries and redirect those earnings into the DPRK’s economy via a network of laundering nodes, front companies, and domain infrastructure.
This report maps the entire ecosystem: key actors, GitHub aliases, laundering flows, shell companies, fake domains, platform infiltration, wallet infrastructure, and global enablers. We also examine the national security implications of the scheme, as well as how lax corporate hiring standards allowed North Korean operatives not just to get paid, but to access critical infrastructure, intellectual property, and production code.
Key Actors and Their Roles
Central Command: Song Kum Hyok & the Andariel Subgroup
At the operational core of North Korea’s disguised IT labor campaign stands Song Kum Hyok, a senior officer within the Andariel subgroup, one of the Reconnaissance General Bureau’s (RGB) elite cyber units. The RGB, North Korea’s main foreign intelligence service, directs both offensive cyber operations and covert economic warfare efforts, and Song’s role straddles both.
Hyok has long been involved in digital identity manipulation, remote access infrastructure, and dark market employment pipelines. Intelligence archives suggest that before assuming his current role, he was linked to multiple Andariel operations involving ransomware staging servers and social engineering against South Korean financial firms.
In the IT worker scheme, Song Kum Hyok is the strategic coordinator of identity theft and resume forgery, enabling North Korean engineers to present themselves as legitimate U.S. based freelancers. North Korea’s decentralized cyber-labor offensive hinges on stolen and curated identities—complete with names like Joshua Palmer, Sandy Nguyen, and GitHub handles such as devmad119 and sujitb2114. These identities often include verified Know Your Customer (KYC) data: Social Security numbers, clean background checks, and even Green Card scans, sourced from data breaches or underground markets.
Operatives use these identity packages to craft professional-grade resumes and LinkedIn profiles, frequently enhanced with AI-generated content and real or fabricated employment histories. They apply to remote jobs on freelancing platforms such as Upwork, Ureed, or the now-defunct Nabbesh, exploiting weak or automated verification and HR onboarding systems in U.S. companies.
Once hired, they gain access to internal tools and sensitive systems: GitHub repositories, Slack channels, financial dashboards, CI/CD pipelines, and privileged cloud infrastructure. From this vantage point, they can siphon intellectual property, embed backdoors, and surveill company operations—all while appearing to be legitimate remote hires. This seamless path, from stolen identity to embedded insider—is the operational backbone of Pyongyang’s covert cyber-espionage labor force.
Once North Korean operatives are embedded in foreign companies, their wages, often paid in cryptocurrencies as well as financial transfers through banks are routed through a meticulously layered laundering process. The first stop is typically a GitHub-linked wallet address associated with the operative’s fake identity (e.g., aliases like “devmad119” or “Joshua Palmer”). From there, the funds may flow into front companies such as Hopana-Tech LLC which act as legitimate salary processors. To further obscure the money trail, salaries are split across multiple wallets using automated smart contracts, a tactic designed to fragment and anonymize the source of funds. Finally, the dispersed assets are aggregated and cashed out via over-the-counter (OTC) crypto brokers based in Russia, the UAE, and China, jurisdictions known for permissive financial enforcement. This end-to-end pipeline creates a resilient and stealthy mechanism for the DPRK to funnel hard currency back into its economy while bypassing international sanctions.
Hyok’s innovation lies in combining AI-generated job profiles with pre-cleared identity data and military operational discipline. Under his supervision, the scheme has moved from ad hoc fraud to a scalable, persistent economic attack model yielding millions of dollars annually for North Korea’s weapons programs while hiding in plain sight inside the legitimate global economy.
U.S. Frontman: Kejia Wang
From a quiet address in Edison, New Jersey, Kejia Wang, also known as Tony Wang, ran one of the most critical nodes in North Korea’s international cyber-laundering apparatus. His residence at 65 Idlewild Road wasn’t just a suburban home; it was the physical anchor for a web of front companies, remote device hubs, and disguised income laundering pipelines that allowed DPRK IT workers to embed themselves inside U.S. companies.
Wang operated under the radar, founding multiple businesses that appeared legitimate on paper but functioned primarily as pass-through entities for laundering salaries earned under false identities. These businesses included tech fronts, aviation firms, and even a massage parlor, each playing a role in the deception.
The most visible of these fronts was the Highland Park 215 Spa, located just a few miles from Wang’s listed residence. Officially a wellness spa, it appears to have functioned as a cash-out hub for crypto proceeds tied to North Korean developers. Its web presence was thin and reviews inconsistent, offering more red flags than relaxation.
Wang’s activities extended far beyond shell paperwork. He physically received laptops sent by U.S. companies hiring remote workers and connected them to internet-facing KVM switches. These switches allowed DPRK operatives, posing under names like “Joshua Palmer” or GitHub aliases like “devmad119”, to work as though they were based in the U.S. He also installed unauthorized software, managed credentials, and monitored access on behalf of the regime.
To keep the deception watertight, Wang opened corporate bank accounts, created digital presences for the fake companies, and maintained financial rails through platforms like Wise, Zelle, and Payoneer. His shell entities even issued IRS tax forms using stolen identity data, giving employers the impression that their freelance hires were tax-compliant U.S. residents.
Wang coordinated with a global network of co-conspirators, including Zhenxing Wang and Jing Bin Huang in China, Mengting Liu in Taiwan, and crypto brokers in the UAE and Russia. These connections formed the infrastructure that allowed funds from unsuspecting U.S. firms, including those in the defense sector, to end up in wallets controlled by the North Korean regime.
Court filings in DOJ case 25-cr-10274 paint a damning picture: Kejia Wang was not only aware that the workers were North Korean nationals, but also actively facilitated the laundering of more than $5 million in wages tied to fraud, of which at least $3 million resulted in direct corporate losses.
From his role as a logistics manager to a shell company architect, Wang helped build a shadow economy inside the legitimate global tech labor force, an economy designed to fund weapons development, evade sanctions, and penetrate sensitive digital infrastructure with ease.
Laptop Farms and Stolen Identities: Christina Chapman
Laptop farms function as remote access deception hubs, allowing foreign operatives to convincingly impersonate U.S.based employees. In this scheme, the perpetrators acquire and configure laptops sent by U.S. companies to individuals they believe are legitimate remote hires. These devices are logged into and maintained from U.S. soil, typically through physical setups in homes or small offices, so that all network traffic and telemetry appear domestic. The key to this illusion is identity theft. Recently, the DOJ indicted Christina Chapman, a facilitator in Arizona, who ran “Laptop Farms”. Once the hiring process was complete, victim companies would ship work laptops and grant access to sensitive systems, unaware that the real end users were North Korean nationals abroad. Chapman’s role was not only to receive and activate these laptops but to maintain them for continuous remote access, ensuring that DPRK operatives could stay invisible behind American identities.
Platform Penetration & Global Expansion
As enforcement tightened on global freelancing hubs such as Upwork, Fiverr, and Freelancer.com, North Korean IT operatives expanded their focus to less-regulated, regionally focused gig platforms, particularly in the Middle East and North Africa (MENA). While major global platforms like Upwork and Freelancer still see DPRK IT worker recruitment, intelligence gathered throughout 2024 and 2025 indicates a broader strategy to infiltrate various online platforms. These platforms became attractive to DPRK-aligned actors due to their comparatively lenient onboarding processes, minimal identity verification, and weak vetting practices, which allow the actors to bypass employment verification controls.
This expansion coincided with observed DPRK tactics documented by Microsoft Threat Intelligence and Google Cloud’s Mandiant division , which reported the use of KVM switch setups , stolen identity kits , and remote desktop software to simulate domestic employment in a given jurisdiction—even when the worker operated from DPRK or China. Newer tactics include the use of synthetic voices for video interviews , AI-generated profile images , and automated deployment of identity documents that pass lightweight vetting procedures common to less-regulated platforms.
Payment pipelines also evolved. Payments are often facilitated through virtual currency, as well as services like TransferWise and Payoneer, implying a preference for systems with limited oversight. In 2025, DPRK operatives received payment through disbursement services into crypto wallets or offshore accounts, routing earnings through UAE-based infrastructure. However, the provided research does not directly corroborate specific incidents such as a “Ureed-based hire posing as a Syrian frontend engineer working for a UAE fintech company” or mobile application code delivered via “Nabbesh” by a user claiming to be Palestinian with telemetry traced to Vladivostok, Russia. However, the use of telemetry to detect Russian-linked infrastructure associated with DPRK activity is confirmed.
This redirection to under-monitored platforms reflects the regime’s operational flexibility. Instead of abandoning freelance infiltration altogether, Pyongyang expanded its reach into low-friction digital labor markets with lower regulatory visibility. This expansion not only preserved a steady stream of foreign currency for the regime , but it also increased DPRK’s reach into sectors and geographies beyond traditional U.S.-centric targets. It is not simply opportunistic—it is part of a deliberate, adaptive campaign of economic espionage masked as remote software development.
Shell Company Infrastructure
The DPRK IT labor operation was propped up by a web of shell companies that each played a distinct, carefully engineered role in laundering salaries, spoofing employment legitimacy, and obfuscating the true identities of North Korean operatives. At the core of this infrastructure was Kejia Wang, a New Jersey-based facilitator who established multiple legal entities across the U.S. to mask the flow of illicit wages. Hopana-Tech LLC served as a primary payroll conduit, accepting salary payments from victim companies under the guise of a legitimate staffing agency. Tony WKJ LLC was used to receive and deploy laptops to DPRK operatives, while also functioning as a salary masking layer. Independent Lab LLC provided the technical underpinnings, including blockchain API relays and crypto wallet infrastructure to route funds out of the U.S. financial system. Highland Park 215 Spa LLC, ostensibly operating under the cover of a massage parlor in New Jersey, likely acted as a cash-out point for laundering physical funds.
Wang also operated Northstar Leadership Inc., which produced fabricated resumes and managed identity paperwork, essential for onboarding DPRK operatives to hiring platforms. Through Capella Aviation LLC, Wang and co-registrant Liwen Huang routed wire transfers through Hong Kong and mainland China, creating a cross-border financial bridge. On the Russian front, Gayk Asatryan used Asatryan LLC and Fortuna LLC to legally host 80 DPRK workers, legitimizing their presence under 10-year employment contracts signed with North Korean trading firms.
These entities were not isolated -they were interconnected through shared addresses such as 65 Idlewild Road, overlapping registration details, and reused bank accounts and crypto wallets. Together, they formed a sophisticated scaffolding that gave the illusion of legitimate employment and enterprise, while operating as the foundation for one of the most complex sanctions-evasion schemes tied to DPRK’s Reconnaissance General Bureau.
DPRK Currency Transfers Via Banking
Kejia Wang, operating from New Jersey, functioned as the financial cornerstone of the DPRK’s U.S.-based laundering scheme. Through front companies like Hopana Tech LLC, Tony WKJ LLC, and Independent Lab LLC, he established business and money transfer accounts used to receive salary payments from U.S. companies unwittingly employing North Korean IT workers under false identities.
At Hopana Tech, Wang opened a U.S. bank account that took in over $464,000 from victim firms between January 2022 and April 2024. These funds were rerouted to overseas co-conspirators such as Jing Bin Huang and a network of Chinese shell entities (e.g., Shenyang Xiwang, Deep Tech, Aolien) via Bank of China and Standard Chartered (HK).
Simultaneously, Tony WKJ LLC received more than $1.6 million through a U.S. money transfer service (MTS-2), which Wang distributed to accounts linked to Enchia Liu, Food Yard Trading (Dubai), and Shenyang Sun-Lotus Tech. He personally siphoned $218,000 into his own U.S. checking account and another $412,000 to his personal MTS account. Between 2022 and 2023, he also received $237,000 in salary deposits into that same personal account, then forwarded $208,000 across 43 transfers to co-conspirators Huang and Tong Yuze.
Wang further disguised laptop handling and device access fees as routine payments labeled “CA laptops” and “NY laptops,” totaling over $55,000 sent to two U.S.-based facilitators.
Lastly, using MTS-3, Wang falsely registered Tony WKJ as a “VC-backed software firm” and received $352,949 from victim companies. When flagged by MTS staff, Wang lied about a DPRK worker under the alias “Wandee C.,” claiming he was a subcontracted developer.
In total, these financial maneuvers moved millions through U.S. infrastructure to overseas nodes, enabling DPRK operatives to mask their identities and launder salaries under the guise of legitimate tech consulting.
Crypto Payment Flows & Wallet Infrastructure
The laundering of salaries earned by North Korean IT operatives followed a structured, multi-phase pipeline designed to minimize traceability and regulatory exposure. In Phase 1: Salary Receipt, payments from unsuspecting U.S. and international companies were sent either to front companies, such as Hopana-Tech LLC and Independent Lab LLC, or directly to wallet addresses listed on the operatives’ GitHub profiles. These companies believed they were paying legitimate U.S.-based contractors, unaware that the workers were remote operatives in North Korea using stolen or forged identities.
Phase 2: Obfuscation began as soon as payments arrived. Smart contracts were employed to automatically split the incoming funds across clusters of Ethereum or TRON wallets. This fragmentation technique, similar to those used in ransomware operations, obscured the origin of the funds and made tracking the complete financial trail more difficult. Each tranche was redirected through different wallets, reducing the ability of investigators to correlate input/output flows with a single identity or origin point.
In Phase 3: Conversion, the obfuscated crypto was aggregated and funneled through over-the-counter (OTC) brokers based in Russia, the United Arab Emirates, and Hong Kong. These brokers specialize in converting large sums of stablecoins into fiat or alternative cryptocurrencies while avoiding compliance triggers. Eventually, the cleaned funds were consolidated into wallets under DPRK control, some of which have since been blocklisted by platforms like Tether for links to illicit activity and sanctions violations. This seamless pipeline allowed the DPRK to convert stolen or fraudulently earned wages into usable capital for the regime’s strategic programs, including its weapons development efforts.
DPRK IT Worker Cluster Wallet & Identity Mapping
Eight fake identities represent a sophisticated and evolving strategy by the DPRK’s IT worker apparatus to not only infiltrate the U.S. based companies but to systematically exfiltrate salary payments into laundering pipelines that support North Korea’s sanctioned economy. Each alias, crafted with care and strategic foresight, was tied to a complex infrastructure of forged documents, crypto wallets, and online developer personas, all designed to evade detection by employers, banks, and regulators.
These aliases were not random. Many were modeled on plausible names common in the U.S., Canada, or Southeast Asia, making them more likely to pass identity verification or “soft KYC” checks on freelancing platforms and internal HR systems. They were often accompanied by polished Linkedin profiles, active GitHub repositories, and consistent communication habits, all of which contributed to the illusion of a legitimate remote developer.
Behind the scenes, each identity was directly linked to salary laundering flows. For instance, Andy Bell, Benjamin Nguyen, and Sandy Nguyen used ETH-based wallet addresses, including vanity ENS domains like bbshark[.]eth and gsofter[.]eth, to receive payments from U.S. firms under the guise of contract work. These addresses were often listed on their GitHub accounts as “payment preferred to…” links, allowing unsuspecting employers or payroll processors to initiate transfers.
In many cases, funds were first routed to these GitHub-linked wallets, then automatically or manually split using smart contracts across secondary addresses. From there, the payments were funneled to consolidation wallets controlled by DPRK facilitators or OTC brokers in Russia, China, or the UAE. For example, funds from wallets tied to Josh Thomas and Muhammad Abdullah were traced via ZachXBT and TRM Labs to known laundering hubs tied to sanctioned North Korean operators. (*ZachXBT is a self-taught, pseudonymous blockchain investigator who has gained global recognition for tracking fraudulent crypto transactions, hacks, rug pulls, and state-linked laundering schemes.)
The fake geographic locations assigned to these aliases were deliberately chosen to align with employment demand and reduce suspicion, such as Texas, California, Toronto, and Michigan, regions known for tech industry presence. These locations also matched VPN exit nodes and remote access IP ranges used to simulate U.S.-based developer activity during work hours.
In total, these eight identities were tied to at least 12 different U.S. and international projects. They helped siphon hundreds of thousands in salaries, while embedding DPRK-linked code contributors into the core of web3 startups, fintech platforms, and even infrastructure projects. Their exposure now offers critical insight into the DPRK’s strategy: weaponizing remote work, exploiting global labor gaps, and turning open-source ecosystems into vectors of economic subversion.
Associated Consolidation Wallets
ZachXBT reports that all above identities and payment addresses lead to two known consolidation wallets:
These wallets serve as hubs in laundering pathways, taking in payments from U.S. firms and redistributing to DPRK-controlled endpoints via OTC brokers and blacklisted channels. These are frequently referenced in TRM Labs and Treasury forfeiture filings.
Global Network of Enablers
The DPRK’s IT worker laundering network was supported by a multinational cast of facilitators operating across five regions, each providing critical functions that enabled the scheme to scale globally. In the United States, Kejia Wang and Zhenxing “Danny” Wang served as the domestic linchpins, establishing shell companies like Hopana-Tech LLC and Independent Lab LLC, receiving company-issued laptops, and enabling remote access for DPRK operatives via KVM switches. In China, actors such as Jing Bin Huang, Tong Yuze, and Zhenbang Zhou were responsible for setting up domain infrastructure, fabricating identity records, and acting as intermediaries in the salary flow chain. Operating from the United Arab Emirates, Yongzhe Xu and Ziyou Yuan handled the setup of financial accounts and cryptocurrency wallets that served as routing points for laundered funds. Meanwhile, in Taiwan, Mengting Liu and Enchia Liu were tasked with salary account management and crypto-to-cash withdrawal, helping to finalize the money laundering cycle. In Russia, Gayk Asatryan took on a more formal role, entering into 10-year labor agreements with DPRK trading entities and providing legal cover through his companies Asatryan LLC and Fortuna LLC for the long-term hosting of North Korean IT workers. Together, these individuals formed the logistical and financial scaffolding behind one of the DPRK’s most successful sanctions evasion operations to date.
Domains Used to Mask DPRK Labor Pipelines
While the physical infrastructure of DPRK’s cyber-labor operation is anchored in shell companies and banking channels, its digital front is built on a deceptively simple architecture: domain registrations and simple, one-layer-deep web sites. Four key domains, hopanatech[.]com, tonywangtech.com, wkjllc[.]com, and inditechlab[.]com, emerged as critical components of the laundering and deception ecosystem.
All four were registered through NameCheap, a domain registrar frequently exploited by threat actors for its lenient Know-Your-Customer (KYC) policies. These domains aligned closely with the shell companies documented in the July 2025 indictment of Kejia Wang (aka Tony Wang).
- hopanatech[.]com: Used as a façade for the employer-of-record shell “Hopana Tech LLC.” This site served as a point of contact and “employment verification” front, meant to convince firms that IT workers were U.S.-based.
- tonywangtech[.]com and wkjllc.com: Variations on the Tony WKJ LLC shell, these domains were used to generate email aliases and submit resumes under false identities. They helped DPRK contractors pass due diligence by appearing affiliated with a legitimate tech firm.
- inditechlab[.]com: Tied to Independent Lab LLC, a shell involved in crypto infrastructure. The domain may have also hosted webhooks and API interfaces used in TRON-based laundering flows.
Despite their differing branding, these domains shared clear indicators of clustering:
- Similar registrar info and name servers
- Absence of advanced metadata like Google Analytics or embedded tracking (indicating high OPSEC awareness)
- WHOIS privacy enabled
- Associated email accounts and DNS infrastructure linked to Wang or his co-conspirators
These domains were not just placeholders. They were operationally active, used in job applications, HR communications, resume verification, and even crypto billing. In short, they functioned as front-facing digital camouflage for a covert state-aligned economic espionage program.
Strategic and Financial Impact
By the first half of 2025, North Korea’s covert IT labor scheme had evolved into a robust revenue-generating apparatus capable of siphoning millions from the global economy with alarming precision. An estimated $17 million in salary payments was funneled through shell companies and direct crypto wallets tied to DPRK operatives posing as freelance developers. It is also cited that the total for the scheme globally netted between $250 to $600 million altogether. These payments came from hundreds of U.S. companies, including fintech startups, SaaS vendors, blockchain firms, and even defense contractors, who unknowingly onboarded North Korean nationals through falsified resumes and forged identity documents. In June 2025, U.S. authorities seized $7.7 million in cryptocurrency assets connected to the scheme, targeting wallets tied to aliases like “devmad119” and “Joshua Palmer.” Yet this represents just a fraction of the broader threat: over $1.6 billion in global cryptocurrency losses were attributed to DPRK-linked actors in the same time period, with 70% directly traced to operations blending employment fraud, social engineering, and codebase compromise. Far beyond financial theft, this scheme granted North Korean operatives persistent system access, enabling the injection of malicious logic, exfiltration of proprietary code, and creation of long-term backdoors across critical sectors.
Insider Threats: Espionage by Employment
North Korean IT operatives, posing as legitimate remote developers, evolved from mere economic infiltrators to full-fledged insider threats. Once embedded within U.S. and foreign tech firms, these operatives obtained privileged access to critical assets, including GitHub repositories, CI/CD pipelines (like Jenkins and GitLab), and cloud configuration files across AWS, Azure, and GCP. With this level of access, they would be able to insert stealthy “sleeper” functions, delayed or dormant code designed to activate later, as well as data exfiltration logic disguised within standard requests, such as base64-encoded POST or GET calls.
To date, no official disclosures from the government or private sector have confirmed that such actions have occurred. However, given that these nation-state adversaries were embedded as insider threats, it is reasonable to assess that once they gained access to sensitive networks and digital assets, they likely exploited opportunities that extended beyond financial fraud. The potential for strategic espionage, leveraging their privileged access for intelligence collection or cyber sabotage, must be considered a probable scenario.
Threat Assessment
The infiltration of DPRK IT workers into Western firms represents one of the most sophisticated and insidious insider threat campaigns in recent memory. Unlike external cyberattacks that can be blocked at the perimeter, these operatives gained trusted persistent access inside corporate networks by posing as vetted remote employees. Once hired, often via stolen, background-verified U.S. identities, they were embedded into critical roles such as backend development, cloud configuration, CI/CD pipeline maintenance, and DevOps infrastructure. This level of access granted them entry into source code repositories, production environments, encryption logic, and proprietary APIs, allowing for potential IP theft, backdoor insertion, credential harvesting, and pre-positioning for future attacks.
This threat was magnified by a widespread failure among companies to implement robust asset management, access logging, and behavioral anomaly detection. In many cases, organizations lacked visibility into who exactly was accessing which systems, when, and from where. The use of remote KVM switches, proxy VPNs, and U.S.-based cloud endpoints enabled DPRK operatives to blend in with legitimate employee traffic, bypassing geo-fencing or basic endpoint monitoring. Some firms failed to enforce multi-factor authentication, revoke GitHub deploy keys upon contractor termination, or monitor suspicious API activity from “internal” users. Additionally, lax onboarding processes and over-reliance on third-party background check platforms meant many identities went unverified or unchecked.
To counter these threats, companies must enforce zero-trust security models, where access is continuously evaluated based on device health, location, and behavioral norms. Automated asset inventories, real-time session monitoring, and privileged access management (PAM) should be standard practice. Every contractor should have narrowly scoped, time-limited access tied to individual credentials, with full audit trails and immediate revocation mechanisms. Organizations must also reevaluate how they vet remote talent, introducing biometric verification, live interviews, and cross-checks with employment databases to prevent identity fraud. Failure to do so risks granting hostile nation-state actors like the DPRK the keys to their most valuable digital assets, without ever breaching a firewall.
Conclusion
The breaking up of the DPRK IT workers exploit is a wake up call for corporations around the world. The aphorism of “The insider threat is the biggest threat” in the infosec space rings true here with a clarion call. So far, the information that has come out (and continues to be researched) seems to indicate that the U.S. was not the only target of the DPRK activities. That said, it is important that corporations and organizations understand the aphorism above, and do all they can to ensure such insider attacks are much harder to carry out.
It is also important that, within the new paradigm of AI, interviews, vetting, and generally, everything carried out during the interview and vetting process, be backstopped to ensure authentic individuals are being hired, and not assets of a foreign power, or for that matter, other criminal actors. This new landscape will only get more complex, and as we move forward into this brave new world, expect there to be other exploits like these that could render your operations into extreme response circumstances.
Sign Up For DomainTools Investigations’ Newsletter for the Latest Research
Want more from DomainTools Investigations? Be sure to sign up for our monthly newsletter to get the latest research from the team – available on LinkedIn or email.
This report details an ongoing campaign by an actor operating primarily during Chinese time zone working hours, targeting Chinese-speaking individuals and entities within and outside China. Since approximately June 2023, the actor has created more than 2,800 domains for malware delivery. The actor's methods and malware, largely unchanged since June 2023, primarily deliver Windows-specific malware through fake application download sites and fake update prompts in various spoofed login pages, marketing apps, business sales apps, and cryptocurrency related apps.
This report details an ongoing campaign by an actor operating primarily during Chinese time zone working hours, targeting Chinese-speaking individuals and entities within and outside China. Since approximately June 2023, the actor has created more than 2,800 domains for malware delivery. The actor's methods and malware, largely unchanged since June 2023, primarily deliver Windows-specific malware through fake application download sites and fake update prompts in various spoofed login pages, marketing apps, business sales apps, and cryptocurrency related apps.
Following previous reports, the actor made notable operational changes including the addition of
- Anti-automation and browser emulation code
- Reduction in site tracker services
- Increased server distribution for sparser domain resolutions per IP address
- More discreet registration details
As of June 2025, 266 of the over 850 identified domains since December 2024 were actively distributing malware.
For comprehensive details, refer to the two prior reports linked below:
Part 1: https://dti.domaintools.com/chinese-malware-delivery-websites/
Part 2: https://dti.domaintools.com/chinese-malware-delivery-domains-part-ii-data-collection/
A Sampling of Their Malware Delivery Websites
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
Fake Gmail Login
The `googeyxvot[.]top` domain uses anti-automation and browser emulation checks, and any input on its fake login page triggers a deceptive browser incompatibility error, prompting a malicious update download. Multiple JavaScript files are employed to obfuscate the download URL.
A malicious .zip file from `googeyxvot[.]top` delivers an .msi installer. This installer contains multiple .jpg named files and two executables, `svchost.13.exe` and `flashcenter_pl_xr_rb_165892.19.exe`. `svchost.13.exe` acts as a downloader, fetching a file from `https://ffsup-s42.oduuu[.]com/uploads%2F4398%2F2025%2F06%2F617.txt`. The downloaded file uses a shellcode decoder loop, decrypts its content with XOR key "0x25", and executes an embedded PE file.
Fake Alipay Checkout
The domain displays a fake popup stating it cannot operate currently due to the use of abnormal operation mode. The buttons Get Help Now and Cancel are displayed, which prompt a download of a malicious file.
yeepays[.]xyz
An imported JavaScript file defines the download path
“yeepays[.]xyz/assets/js/external_load.js”
The filename is defined in another imported JavaScript file
“yeepays[.]xyz/assets/download/filename.js”
The download URL for the malicious file then becomes:
Fake Cryptocurrency Sites
coinbaw[.]vip
Clicking most of the interactive buttons redirects to a fake sign-in page for a fake crypto exchange named “CoinBaw”, which likely attempts to spoof as CoinBase.
Registration Details
Mapping over 2,800 of the actor’s registered domains since June 2024, we observed similar trends in timing.
Domain Registrations Create Date
Domain Resolutions First Seen
Comparing the registration creation times for domains and their respective first seen resolutions from DNS lookups we can approximate possible human working times from infrastructure acquisition and operationalization commonalities. Though both of which can be largely automated and consequently the timing of either event can be largely unreliable, they may offer some valuable insights particularly with regard to potential prevalence in targeted regions.
We observed a common distribution of both domain acquisition and potential operationalization across times. Operationalization in this context is essentially the distinction between the registration of the domains and associated infrastructure and then making use of it in some operational way. In this case, to deliver malware via spoofed application download pages. The majority of both are seen to occur during normal Chinese working hours. Notably, the volume of first seen resolutions of those domains also appear during normal Chinese working hours.
Changes In Operations
The actor has implemented several changes in their operational tactics. This includes the addition of rudimentary anti-automation and browser emulation code, designed to hinder site scanners from effectively retrieving website content. Furthermore, there has been a reduction in the use of site tracker services such as Baidu, Gtag, and Facebook. The actor has also increased the number of servers used to spread domain resolution more widely, and adopted more discreet registration details to obscure uniquely identifiable information.
Conclusion
The "SilverFox" actor continues to demonstrate a high degree of persistence and scale in their malware delivery operations, primarily targeting Chinese-speaking individuals and entities globally with Windows-specific malware. Their campaign, ongoing since at least June 2023, leverages over 2,800 created domains, with 266 remaining active since December 2024, highlighting their sustained infrastructure and reliability improvements. The consistent operational timing across all hours with high influxes during Chinese working hours in addition to other factors suggests a combination of automated and likely human-driven approach to their activities.
While the actor's ultimate motivations remain somewhat uncertain, their tactics strongly suggest financially motivated and opportunistic objectives. We suspect their primary goals include credential and financial theft, and potentially access brokering. Furthermore, the observed targeting of individuals engaged in sales and marketing, particularly those outside China but involved in business prospects within the region and possessing Chinese language skills, points to a potential secondary motivation to exploit specific professional networks for further gains.
Modern browsers like Chrome and Edge provide a critical, multi-layered defense against malware from fake download sites. They use integrated security systems—Google Safe Browsing and Microsoft Defender SmartScreen—to proactively block malicious websites before they can be accessed. At the point of download, these browsers analyze files for risk by checking their reputation and digital signatures, and provide clear, direct warnings to prevent users from accidentally running dangerous software.
While current detection rates of SilverFox payloads show limitations, it's crucial to recognize that browser security is a constantly evolving battleground. Browser developers are continually refining their defenses, integrating more advanced AI and machine learning models to identify and block novel threats in real-time. This ongoing technological advancement, however, highlights a fundamental truth: the most sophisticated digital warnings are ultimately supplementary to an aware user.
To counter the persistent threat posed by SilverFox, organizations and individuals should prioritize the following security measures:
- Elevate User Awareness: Conduct phishing simulations and training, and emphasize secure software acquisition from official sources.
- Strengthen Email and Web Gateway Security: Implement ATP, integrate threat intelligence feeds for URL filtering and domain reputation, and employ DNS filtering.
- Enhance Endpoint Security and Response: Deploy NGAV/EDR across Windows endpoints and ensure automated patch management.
- Implement Network Monitoring and Segmentation: Analyze network traffic for indicators of compromise and segment networks to limit lateral movement.
- Prioritize Identity and Access Management: Enforce Multi-Factor Authentication (MFA) for all user accounts.
IOCs
Domains, file URls, and hashes can be found on our Github.
🎵 Sometimes you wanna go
Where everybody knows your name
And they're always glad you came 🎵
~Theme from Cheers
Everyone should have a place to go where they’re comfortable, can pull up a comfy infrastructure barstool, and just kick back and enjoy life.
Everyone except malicious actors.
At DomainTools Investigations we take a special interest in the comfort and caretaking of bad actors, wherever it may occur. Whether it’s a den of aspiring hackers stretching their wings, domain registrar business decisions welcoming in Russian disinformation peddlers, or even mapping out ransomware actor musical chairs, you could say we pay keen attention to the care and feeding of predatory ecosystems.
So it’s no surprise that we’re looking at DNS all the time, day, night and otherwise. Even during leap seconds.
Nameservers and Detecting Threats
They say “to reach people, meet them where they’re at” and in our corporate mission to reach more and more bad actors we’ve taken this to heart. By intensely monitoring nameservers where criminals feel comfortable, we’re able to understand the ebb and flow of whole campaigns as well as opportunistic one-offs as domains circulate between registrars, hosts, and transient infrastructure.
We turn here to the Russian bulletproof hosting service DDoS-Guard. The name is familiar to most in cybersecurity, with a profile that’s led to the then-Chairwoman of the House Oversight Committee pointing out DDoS-Guard links to the Russian government as well as Brian Krebs laying out the complex web of controversies the hosting company supported at the time, from Hamas to 8chan.
DDoS-Guard enablement of criminal activity, terrorism, and espionage is not exactly a secret.
Analyzing only a month’s worth of nameserver activity for DDoS-Guard provides an important glimpse into their current corner of the internet. Activity from 2025-05-13 through 2025-06-11 shows thousands of activities, from transfers in and out of the service (illuminating other sources and destinations) to domain creation and deletion. Analyzing this also allows better understanding of where DDoS-Guard sits in the nexus of services used for malicious interests, pointing at large spaces for possible future research.
In isolating domains transferred in and out of DDoS-Guard Nameservers 269 domains were observed being transferred in from other services, 408 domains transferred out from DDoS-Guard to other services, 677 new domains created, and 199 domains deleted.
For the purposes of this post, we can sort observed domains into three separate buckets, in order of proportion seen: temporary gambling/betting domains, cryptocurrency-targeting domains, and indeterminate/other. The temporary domains were obvious thanks to repetitive, incremented numbers across many alike names as well as their short lifespans on the service: most were new, in non-English languages like Indonesian and Turkish, and deleted within two weeks of creation. A smaller subset was transferred out, mostly to my-ndns[.]com and cloudflare.
Registrar[.]eu appears in the “transfer out” section as an outlier due to a single cluster of 72 domains either targeting or spamming for Russian gambling website Pokerdom. All examples include landing pages in Russian simulating Pokerdom terms of service or login paths, and all used the TLD top. Historical data shows this cluster was spun up on DDoS-Guard one year previous and transferred out to Registrar[.]eu instead of being renewed.
Observing nameservers, as noted, also allowed us to see where DDoS-Guard lies in relation to bad actors constantly shopping their domains from service to service to try and avoid detection or blocklisting. Several notable examples came up in research.
Bioservamerica[.]com sounds like a perfectly reasonable domain from afar. However, seeing it become newly active after three years of dormancy and then bouncing between DDoS-Guard and Cloudflare caused us to take a closer look. In fact, bioservamerica[.]com is the domain for an Indonesian gambling website utilizing the age of the domain to evade some risk metrics.
An investigative rabbit hole deepened the more we dug. Bioservamerica[.]com redirected to capecodrestaurantweek[.]com; sharing that redirect was restaurantweekcapecod[.]com. A pivot on the registrant for the latter led to a dozen chef- or restaurant-themed websites that appear to serve as redirects for a massive network either supporting black-market gambling sites or attempting to phish those users. Passive DNS revealed suspiciously rapid and ongoing DNS changes suggestive of fast flux or a similar technique for capecodrestaurantweek[.]com. All told, this network appeared to be acquiring aged domains and utilizing sophisticated obfuscation and redirection techniques and is due for further research.
Another elementary finding while observing DDoS-Guard nameservers involves a campaign targeting holders of Vanilla gift cards, a Visa product. DDos-Guard users are fans of “com” domains - beginning with apex domains containing “com” to utilize targeted subdomains and deceive targets about the actual site. In practice, the domain comtrackmycom[.]com utilizes subdomains like “www.vanillagift,” so the user sees www.vanillagift[.]comtrackmycom[.]com. In many situations, our perception blocks out everything after the first “com” so that the URL seems legitimate. This domain spun up on DDoS-Guard on 2025-06-02 and, while blocklisted, still appears to be active.
Digital Assets
A popular target for DDoS-Guard users is players of the popular first-person shooter game CounterStrike: GO. CounterStrike has a long history of strangeness around its weapon skin system, which allows users to apply custom decorative designs to their in-game weapons rated by the rarity in which they emerge from game loot boxes (“cases”). Game company Valve halted the entire system in 2019 for a redesign after discovering nearly all transactions were involved in money laundering. DDoS-Guard nameservers reveal a number of candidates for investigation:
Csmoney[.]to, created on DDoS-Guard on 2025-05-28 is likely impersonating the trading marketplace cs[.]money for phishing purposes.
The domain hellcase[.]com appears to be a legitimate site surrounding case-opening and exclusive skins. However, on DDoS-Guard we see at least one actor deeply comfortable with the service, spinning up over a dozen new domains targeting CS:GO and Hellcase users, as well as transferring domains in and out. Despite being less than a month old at the time of writing, the below domains all show as having already been added to third-party blocklists:
Cs2-hellcas[.]com
Hell2cs[.]com
Hellcs2-events[.]com
Hellcs2promo[.]com
Hellcspromo[.]com
Hlcase-event[.]com
Hlcases-events[.]com
Hlcases-promotional[.]com
Hlcs-promo[.]com
Hlcs-promotionals[.]com
Highlighting the traffic flows in and out of DDoS-Guard nameservers, we can observe hlcases-events[.]com transferred out to Cloudflare, and cs2-hellcas[.]com transferred in from 1reg[.]buzz. The actor(s) targeting CS:GO and Hellcase users seemed mostly comfortable with DDoS-Guard during the month of observation, but this kind of activity raises a question for further research about fingerprinting risk by measuring nameserver transitions.
Cryptocurrency
Video game weapon skins aren’t the only digital asset being targeted from Russia. DDoS-Guard nameserver activity provided a wealth of information on scams and phishing targeting cryptocurrency users. In one month, domains were observed aimed at the following protocols and platforms: Atomic, Bluefish, Brex, Coinbase, Cortex, DefiSaver, Dragonswap, Felix, Hybridge, Hyperion, Hyperlend, Hyperswap, Ledger, Mercury, MetaMask, Nexus, Odos, SoSoValue, Trezor, Tron, UsualMoney, and YieldNest.
Pivots on those domains provided insight into additional apex-level domains or subdomains targeting DEXscreenr, MyEtherWallet, Phantom, Phala, Rabby, Rainbow, Rarible, Safepal, Sui, Trust, Uniswap, and more.
That’s quite the list for one month’s worth of watching, it feels like.
Patterns emerged in several cases of domains created on DDoS-Guard and either deleted within days or transferred out to another set of nameservers within a week.
Let’s discuss some example findings.
YieldNest[.]finance is a restaking token aiming to increase earnings through advancing liquidity in the Ethereum ecosystem. Yet someone’s also looking to restake a claim:
Despite all of these domains being up for less than a week, they all showed a connection to infrastructure, passive DNS indicated resolutions in the wild, and they all substantially diverged from YieldNest’s primary domain profile. IP address, MX record, and tracker pivots on these five domains surfaced several more targeting YieldNest, as well as domains targeting Coinbase, the Oasis protocol, payment processor Coinwall, PLANET token, and more. While PDR and Reg[.]ru were observed, behavior indicated an overwhelming preference for DDoS-Guard, as well as a strong preference for the use of Cloudflare and Namecheap. Many of these domains show abnormal daily changes to either MX or NS records during their period of activity.
While more research is necessary over a longer term to validate it, monitoring problematic nameservers shows promise as a traffic supernode to establish behavior patterns that can support more complex and targeted observation and detection of malicious actors.
Another great example is several domains targeting the Ledger wallet and app. En-ledger[.]to was created on DDoS-Guard services on 2025-05-27 and provided an excellent IP address pivot to 70+ domains almost exclusively targeting cryptocurrency wallets like Atomic, MetaMask, MyEtherWallet, Trezor, and Trust (among others). Most are currently blocklisted with an astronomically high average third-party risk score.
Common infrastructure characteristics across the cluster:
Another popular target in this brief glimpse into DDoS-Guard was cross-chain swap Hybridge. Cross-chain bridges and swaps allow users to exchange tokens from one chain with tokens from a different chain, and in practice they hold a sizable amount of cryptocurrency in hot storage for this purpose, making them a juicy prize.
App-hybridge[.]finance was created on DDoS-Guard on 2025-05-09, transferred to registrar[.]eu nameservers on 2025-05-30, and back to DDoS-Guard on 2025-05-31. A screenshot from urlscan[.]io of the landing page on 2025-05-26 shows an emulated login page.
It should be noted that no results either in the documentation of Hybridge nor on their social media indicate a domain of anything other than hybridge[.]xyz, so both hybridge[.]finance and app-hybridge[.]finance appear to be malicious; both connected to DDoS-Guard, with hybridge[.]finance transferring out to regery[.]net on 2025-05-27 and app-hybridge[.]finance transferring out and back in as noted above.
Conclusion
Above we’ve discussed the results of observing nameservers for Russian bulletproof host DDoS-Guard for a single month, 2025-05-13 through 2025-06-11. Results showed a vast array of threats, but the most active targeted the cryptocurrency sphere in very specific ways, especially through emulating wallets, exchanges, and cross-chain swaps.
There is more work to do and more bad actors, like DDoS-Guard, that provide a haven for criminal activity. Utilizing DNS and domain intelligence, as well as nameserver surveillance over an extended period of time, gives us a feel for the traffic flows of domain services, watching likely or proven malicious domains spin up, get deleted, and transfer in and out.
Digital assets, cryptocurrency, and other decentralized finance services should ensure that they monitor not just new or newly active domains and subdomains but also identify those service providers that give comfort to scammers, phishers, and others. This allows those services a much more clear day-to-day understanding of the prolific and varied threat environment they face, informing both the ways they protect their infrastructure and how they can educate users to protect themselves.
Cryptocurrency and decentralized finance users can protect themselves by staying informed of the threats the sector faces and staying current on the news, as well as engaging with protective DNS solutions and other blocklists that not only use third-party data but allow the user to input domains, services, and other characteristics into their blocklist. The simple act of blocking any domain with ddos-guard[.]net nameservers may serve to cut dozens or hundreds of direct threats per month.
More research along these lines is forthcoming from DomainTools Investigations.
Sign Up For DomainTools Investigations’ Newsletter for the Latest Research
Want more from DomainTools Investigations? Be sure to sign up for our monthly newsletter to get the latest research from the team – available on LinkedIn or email.
Intelligence Group 13, embedded within the Shahid Kaveh Cyber Group, represents one of the most operationally aggressive and ideologically fortified units within the Islamic Revolutionary Guard Corps (IRGC) cyber arsenal. Positioned at the confluence of tactical cyber-espionage, industrial sabotage, and psychological warfare, the group is uniquely equipped to respond to geopolitical escalations,particularly in light of the recent U.S. airstrikes targeting Iranian nuclear facilities, which have significantly heightened the risk of asymmetric retaliation.
A Profile of Iran’s Covert Cyber Strike Unit and Its Psychological Warfare Extension
Executive Summary
Intelligence Group 13, embedded within the Shahid Kaveh Cyber Group, represents one of the most operationally aggressive and ideologically fortified units within the Islamic Revolutionary Guard Corps (IRGC) cyber arsenal. Positioned at the confluence of tactical cyber-espionage, industrial sabotage, and psychological warfare, the group is uniquely equipped to respond to geopolitical escalations,particularly in light of the recent U.S. airstrikes targeting Iranian nuclear facilities, which have significantly heightened the risk of asymmetric retaliation.
As Iran faces intensified pressure and public calls for reprisal, it is assessed that it is increasingly likely that IRGC cyber divisions will be leveraged for retaliatory digital operations. Intelligence Group 13, already known for its history of intrusions into critical infrastructure, including U.S. water systems and Israeli control networks, now finds itself in a strategic posture to deliver retributive action through cyberspace. Whether through direct disruption, pre-positioned malware activation, or narrative defacement and psychological intimidation, the group's capabilities make it a prime tool for hybrid response, combining deniable technical aggression with symbolic messaging designed to project defiance and psychological impact.
Functioning under the umbrella of the IRGC’s broader cyber command, which includes the Electronic Warfare and Cyber Defense Organization (EWCD), the Intelligence Organization (IO), and Quds Force forces like Unit 300, Intelligence Group 13 is not an isolated cell but part of a highly coordinated ecosystem. Its online presence is reinforced by propaganda fronts such as CyberAveng3rs, a media arm that issues threats, amplifies operational claims, and disseminates defacement content through platforms like Telegram and Instagram. Together, these assets form a multi-domain influence architecture that allows Iran to execute cyber retaliation while shaping the narrative battlefield.
This report maps the hierarchy of Intelligence Group 13 within the IRGC, profiles its leadership, outlines its tradecraft and ideological underpinnings, and assesses the increased likelihood of its deployment in near-term retaliatory cyber operations.
Intelligence Team (Group) 13 تیم اطلاعاتی ۱۳
The group, (pronounced: Team-e Ettela'ati-ye Sizdah), takes its name from Mohammad Kaveh, an IRGC commander who was martyred during the Iran-Iraq War in 1986 at the age of 25. He led elite IRGC operations in Kurdistan and Western Iran and was viewed as a revolutionary model for sacrifice, bravery, and obedience. In keeping with the IRGC’s broader ideological tradition, the title “Shahid” (شهید), meaning martyr, is commonly affixed to the names of operational units, serving both as an homage to fallen commanders and a deliberate invocation of religious-nationalist symbolism. This naming convention reinforces the ideological continuity between the IRGC’s early revolutionary battles and its modern digital warfare initiatives. By invoking martyrdom, such units portray their operations not merely as tactical missions but as sacred continuations of a historical and spiritual struggle. The Shahid Kaveh Group draws directly from this legacy to infuse its cyber operations with ideological legitimacy and emotional resonance. The archived site kaveh313[.]lxb[.]ir hosted tributes, biographical stories, and hagiographic imagery that inform the spiritual framework for the group’s name and mission, blending religious devotion, revolutionary ethos, and digital militarism into a unified operational identity.
IRGC Cyber Command Hierarchy
The Islamic Revolutionary Guard Corps (IRGC) oversees a complex and multi-tiered cyber command architecture designed to fulfill distinct yet interconnected missions across domestic security, intelligence collection, and global offensive operations. This structure is deliberately compartmentalized, allowing the IRGC to conduct covert campaigns while maintaining plausible deniability through the use of proxy units, contractors, and front companies. At the core of this system is the Shahid Kaveh Group, an elite offensive cyber unit that operates with both ideological fervor and technical precision. Intelligence Group 13, its most active tactical team, is fully embedded within this command, drawing operational directives from a triad of IRGC oversight bodies:
- The Electronic Warfare and Cyber Defense Organization (EWCD), which coordinates cyber defense and internal sabotage capabilities,
- The Intelligence Organization (IO), responsible for domestic surveillance and strategic targeting intelligence, and
- The Quds Force (QF), which projects IRGC influence and cyber aggression abroad, particularly through specialized units like Unit 300 and Unit 600.
Together, these divisions provide the Shahid Kaveh Group,and by extension Intelligence Group 13, with the operational cover, intelligence feeds, and strategic alignment necessary to wage hybrid cyber warfare across physical and psychological domains.
Command Structure – Known Figures
The leadership behind Intelligence Group 13 reflects a blend of strategic IRGC command, operational direction, and industrial integration. At the top sits Hamidreza Lashgarian, a senior IRGC cyber official with confirmed affiliations to both the Electronic Warfare and Cyber Defense Organization (EWCD) and Quds Force Unit 300. Lashgarian is widely regarded as the supervisory figure behind the Shahid Kaveh Group, providing overarching guidance on both ideological framing and operational tempo. Beneath him, Reza Salarvand serves as the direct commander of Intelligence Group 13, identified in dissident leaks as the group’s tactical leader and field-level coordinator. Salarvand’s role includes managing target selection, overseeing cyber intrusion campaigns, and aligning Team 13’s actions with IRGC strategic objectives. Supporting these military units is Mohammad Bagher Shirinkar, a key figure embedded in EWCD-linked contractor firms. Shirinkar plays a critical role in bridging the IRGC’s internal operations with its broader technical ecosystem, facilitating tool development, subcontractor oversight, and deniable operational capabilities through civilian-facing fronts.
IRGC High-Level Hierarchy
Placement of Intelligence Group 13 Within IRGC Cyber Org
Intelligence Group 13 functions as the operational spearhead of the Shahid Kaveh Group, a hybrid entity positioned at the intersection of the IRGC’s cyber warfare and Quds Force portfolios. This structural alignment gives Team 13 a unique dual mandate: to execute precision cyber intrusions with military-grade sophistication while simultaneously engaging in psychological and ideological warfare. As a tactical APT (Advanced Persistent Threat) cell, the unit specializes in cyber reconnaissance, disruptive sabotage of critical infrastructure, and the deployment of malware designed to pre-position effects across adversarial networks. Its proximity to both IRGC Electronic Warfare and Cyber Defense (EWCD) and external-facing Quds Force units enables Intelligence Group 13 to operate with both deep access and strategic reach, making it a central instrument of Iran’s asymmetric cyber doctrine.
Internal Chain of Command
Technical Mission and Tactics
The strategic mandate of Intelligence Group 13 centers on disrupting critical infrastructure and shaping adversarial perceptions through covert digital operations. The unit has demonstrated a specific focus on targeting industrial control systems (ICS), including Unitronics PLCs, Israeli electrical grids, U.S. water treatment facilities, and fuel distribution systems, all selected for their high-impact potential and symbolic value. Their campaigns often involve pre-positioning malware, embedding implants within target environments well in advance of activation to enable dormant or timed sabotage. Complementing these efforts is an aggressive intelligence collection posture, relying on phishing, credential theft, and OSINT harvesting to support intrusion planning and post-access operations. Crucially, Team 13 integrates psychological warfare into its strategy, disseminating screenshots, leaks, and taunting messages through propaganda arms like CyberAveng3rs to generate fear, confusion, and reputational damage in tandem with technical effects.
Disinformation & Propaganda: The Role of CyberAveng3rs Patriotic Hacker Wing
CyberAveng3rs serves as the psychological warfare and influence operations extension of Intelligence Group 13, functioning not as an independent actor but as a deliberately constructed propaganda arm embedded within Iran’s cyber doctrine. Rather than remaining in the shadows like traditional APTs, Team 13 leverages CyberAveng3rs to publicize and amplify the psychological impact of its technical operations,turning covert intrusions into open spectacles of defiance. Through Telegram channels, Instagram accounts,and diaspora-linked echo networks, CyberAveng3rs publishes defacement screenshots, malware control panel captures, and operational taunts directed at Western and Israeli infrastructure targets. These narratives are often laced with religious-nationalist motifs, martyr quotes, and anti-Zionist rhetoric, reinforcing the IRGC’s ideological messaging. CyberAveng3rs is not merely reactive; it issues pre-attack warnings, brags post-operation, and threatens future campaigns, making it a key instrument for intimidation, distraction, and symbolic escalation. By fusing information operations with hacking campaigns, it enhances the IRGC’s ability to wage cognitive warfare alongside technical compromise.
Operator: Mr. Soul (Mr_Soulcy)
- Known handles:
- Instagram: Cyberaveng3rs
- Telegram: @CyberAveng3rs
- X @cyberaveng3rs
- Instagram: Cyberaveng3rs
- Notable content:
- Claimed the Aliquippa water system attack (PA, USA)
- Leaked Unitronics control panel screenshots
- Issued threats of “Operation IV” aimed at Israeli cybersecurity units
- Branded style includes martyr quotes, Islamic slogans, and ICS interfaces
- Claimed the Aliquippa water system attack (PA, USA)
Contractor and Front Company Ecosystem
The IRGC’s cyber operations rely heavily on a dense and evolving ecosystem of affiliated companies, some covertly managed through military intermediaries, others openly registered as “cyber defense,” “AI research,” or “IT solutions” firms. This web serves multiple strategic purposes. First, it allows the IRGC to outsource technical labor and scale operations without overexposing its formal personnel. Second, it provides plausible deniability, as these front firms can operate under civilian-facing banners while conducting state-directed offensive cyber activities. Third, it enables a rotating model of corporate obfuscation, where companies like Emen Net Pasargad are dissolved or sanctioned only to reappear under new names like Ayandeh Sazan Sepehr Aria, often with overlapping staff and clients. These firms are frequently staffed by IRGC veterans or relatives of high-ranking cyber officials, further blurring the lines between state, contractor, and covert operator.
This model closely parallels revelations from the i-SOON (安洵) data leak, which exposed how China’s Ministry of Public Security (MPS) and provincial security bureaus have long contracted out cyber operations to nominally private firms. Like the IRGC’s cyber complex, Chinese firms such as i-SOON and Chengdu 404 maintain the veneer of legitimate enterprise while developing spyware, managing fake persona farms, and carrying out state-sponsored intrusions. In both Iran and China, this hybrid public-private structure allows state entities to mask state cyber activity behind corporate fronts, maintain flexibility, and engage in offensive campaigns without bearing the full diplomatic cost.
Moreover, just as Iran’s firms like Cyberban Institute and Kavosh Center double as ideological and technical platforms, Chinese contractors often support both domestic surveillance and global espionage, engaging in infrastructure targeting, data exfiltration, and information control under the guise of national innovation. This convergence of state-backed ideology, cyber warfare, and privatized labor reveals a shared authoritarian blueprint: One in which cyber capabilities are cultivated through semi-privatized ecosystems designed to insulate command structures while enabling scalable, deniable aggression in the global digital theater.
Expanded Corporate Ecosystem Supporting IRGC Cyber Ops
The IRGC’s cyber capabilities rely not solely on military or intelligence personnel but on an expansive and deliberately obscured ecosystem of contracting companies, technical institutes, and shell entities that function as both operational extensions and recruitment/talent pipelines. These firms play a crucial role in sustaining the IRGC’s cyber warfare doctrine, developing malware, testing exploits, maintaining infrastructure, and providing a legal or commercial façade for offensive operations.
What makes these companies particularly effective, and elusive, is the way they straddle the boundary between legitimacy and subversion. Many of them present as cybersecurity vendors, AI startups, or educational technology labs, marketing themselves to civilian, academic, and even international clients. Behind the scenes, however, they serve as contractors for the IRGC’s Electronic Warfare and Cyber Defense Organization (EWCD), Intelligence Organization (IO), and Quds Force, executing tasks that range from infrastructure reconnaissance and SIGINT analysis to psychological warfare and influence ops.
This system is both resilient and adaptive. Companies are frequently rebranded, dissolved, or split into subsidiaries following public exposure or sanctions. For instance, Net Peygard Samavat, once exposed for its involvement in Iranian state cyber operations, later became Emen Net Pasargad, which itself was reconstituted as Ayandeh Sazan Sepehr Aria. Despite their changing names and corporate registrations, these entities retain the same personnel, mission scope, and government sponsors, effectively outlasting sanction regimes and Western takedown efforts.
Moreover, the personnel who operate these firms often rotate between IRGC intelligence positions, academic research roles, and private-sector leadership, creating a feedback loop where state doctrine, technical innovation, and civilian infrastructure become interwoven. This also creates a recruitment channel: Young developers and engineers are often brought into these companies under the banner of patriotic service or career opportunity, then quietly integrated into national-level cyber missions.
In effect, these firms function as force multipliers for Iran’s cyber program. They provide scalability, deniability, and a legal buffer between the Iranian state and its digital aggression. As international scrutiny tightens, the IRGC is likely to continue leaning on these corporate proxies to advance technical capability while avoiding direct attribution,mirroring similar models seen in China (e.g., i-SOON) and Russia (e.g., contractors like NTC Vulkan).
Below is a detailed examination of these key companies and their connections.
Core Contractor Entities and Their Functions
- Emen Net Pasargad (ایمننت پاسارگاد) – Once a flagship contractor for disinformation and foreign interference (e.g., impersonating the Proud Boys during the 2020 U.S. election). Dissolved in 2023. Sanctions Source
- Ayandeh Sazan Sepehr Aria (آریا سپهر سازان آینده) – A successor to Emen Net, continuing operations in information operations and malware development. Founded by Mohammad Bagher Shirinkar. Recorded Future
- Mahak Rayan Afraz (محک رایان افراز) – Specialized in AI and surveillance tooling, including:
- Hazm – Persian NLP engine
- Gol Rokh – Facial recognition platform
- Disbanded in mid-2023 amid U.S. pressure. Treasury
- Hazm – Persian NLP engine
- DSPRI (موسسه سنجش داده پیشرفته) – Linked to IRGC Quds Force Unit 300, DSPRI handles signal interception and encrypted traffic decryption, including battlefield deployments in Syria, Lebanon, and Iraq. Recorded Future, p. 14
- Sabrin Kish (شرکت صابرین کیش) – Developed sniffers and ICS tools sold to IRGC clients; also engaged in foreign contracts (e.g., deal with Iraq’s NSA head Faleh al-Fayyadh). Maintains financial and corporate overlap with IRGC Cooperative Foundation. Wikipedia
- Soroush Saman Co. (شرکت توسعه الکترونیکی و مخابراتی سروش سامان) – Supplied surveillance and tracking systems to Hezbollah, and built AI-based phone surveillance for Unit 300. [IntelliTimes coverage via Lab Dookhtegan]
- Afkar Systems (افکار سیستم) – Tied to Nemesis Kitten APT, allegedly led by Ahmad Khatibi Aghda. Operated through Center 2060 and Cyber Base 2000, both under EWCD’s umbrella. CISA Advisory
- Parnian Telecommunication (شرکت الکترونیکی و مخابراتی پرنیان) – Facilitates cyber workforce recruitment for IRGC and MRA-linked projects. Job ads call for infosec and penetration testing expertise. Recorded Future, p. 19
- Kavosh Center (مرکز کاوش) – Offensive R&D hub tied to the Shahid Kaveh Group. Led by IRGC affiliate “Shayan” (Malek Mohammadi Nejad). Possibly involved in TTP development and APT tool testing. Recorded Future
- Cyberban Institute (موسسه سایبربان) – Run by Mehdi Lashgarian, nephew of IRGC cyber leader Hamidreza Lashgarian. This front publishes ideological content, disinfo narratives, and tech analysis favorable to IRGC doctrine. Recorded Future, p. 22
Observations on Structure and Strategy
The structure and behavior of IRGC-affiliated cyber firms reveal a deliberate and adaptive operational model. Many of these companies engage in strategic rebranding, dissolving or renaming themselves after being sanctioned or exposed, Net Peygard reemerged as Emen Net, which later became Ayandeh Sazan, while Dehkadeh Telecom transitioned into Mahak Rayan Afraz, with a new identity likely forthcoming. These transitions help avoid regulatory scrutiny while maintaining operational continuity. Furthermore, interlocking leadership is a hallmark of the ecosystem: Figures such as Mohammad Bagher Shirinkar, Hamidreza Lashgarian, and Esmail Rahimi appear across multiple entities, indicating a centralized and tightly coordinated management structure. The ecosystem also supports technology transfer abroad, with tools and capabilities exported to IRGC-aligned actors in Iraq, Syria, and Lebanon, particularly via Quds Force Unit 300. Notably, these firms are often the technical and logistical backends for known APT groups. For example, Afkar Systems underpins Nemesis Kitten, Mahak Rayan Afraz has links to Tortoiseshell (TA456), and clusters tied to the Shahid Kaveh Group appear to support Pioneer Kitten operations.
Operational Forecast and Strategic Implications
Intelligence Group 13 functions as the operational core of the IRGC’s cyber disruption strategy, a convergence point where technical sabotage, psychological warfare, and revolutionary ideology are seamlessly integrated. Operating under the umbrella of the Shahid Kaveh Group, Team 13 is not an independent or freelance actor but a disciplined tactical cell embedded in a broader, multi-layered command system overseen by IRGC EWCD, IO, and Quds Force divisions. Its mission is augmented through propaganda arms such as CyberAveng3rs, which act not only as amplifiers of defacement and intrusion campaigns but also as strategic influence assets projecting IRGC narratives into public and geopolitical consciousness.
The group’s tradecraft spans traditional APT techniques, such as credential harvesting, critical infrastructure penetration (e.g., Unitronics PLCs, fuel pump logic, and water treatment systems), and covert malware deployment (e.g., IOControl, Project Binder). Yet what sets Team 13 apart is its parallel investment in symbolic messaging, issuing threats via Telegram, leaking screenshots via Instagram handles like @mr.sul.ir, and invoking martyrdom and Islamic resistance to create a psychological echo chamber around each technical act.
This entire operation is scaffolded by a front company and contractor ecosystem designed to provide deniability, talent, infrastructure, and logistical support. These include Afkar Systems (linked to Nemesis Kitten), Mahak Rayan Afraz (associated with TA456), and Kavosh Center (supporting Pioneer Kitten), among others. These firms are part of a strategy of institutional layering and rebranding, allowing the IRGC to rotate through corporate identities while sustaining long-term capabilities. Rebranding paths such as Net Peygard → Emen Net → Ayandeh Sazan show how the IRGC evades sanctions without losing operational momentum.
Key Takeaways:
- Intelligence Group 13 is a deeply embedded extension of the IRGC’s strategic cyber doctrine,not an isolated threat actor.
- Psychological operations are prioritized on par with malware deployment, reflecting a dual mission of technical and perceptual warfare.
- The martyrdom framework (e.g., naming conventions like “Shahid Kaveh”) plays a pivotal role in unifying cyber actions with ideological legitimacy.
- The use of contractor ecosystems and front companies provides flexibility, plausible deniability, and continuity across sanctions and takedowns.
Risk Assessment:
Future campaigns by Intelligence Group 13 and its affiliates are likely to blend cyber-kinetic threats with narrative manipulation, targeting not just critical infrastructure but public perception and institutional trust. This includes:
- Threatening or disrupting civilian infrastructure in the U.S., Israel, and Gulf States
- Deploying psychological campaigns through channels like CyberAveng3rs, timed with physical intrusions
- Leveraging rebranded contractors to deliver tooling and intelligence capabilities both domestically and to proxy forces abroad (e.g., Hezbollah, PMF in Iraq)
Defending against this threat requires not only technical hardening but cognitive resilience, recognizing that the IRGC’s cyber ambitions are as much about controlling the story as they are about breaching the network.
Sign Up For DomainTools Investigations’ Newsletter for the Latest Research
Want more from DomainTools Investigations? Be sure to sign up for our monthly newsletter to get the latest research from the team – available on LinkedIn or email.
As the conflict between Iran and Israel escalated in early 2025, it quickly expanded beyond missiles and airstrikes into a broader battle for digital and psychological dominance. Among the most visible players in this new front is a group known as CyberAv3ngers. Their operations have included hijacking water systems, defacing programmable logic controllers (PLCs), and ridiculing Israeli cybersecurity efforts across social media platforms like Telegram and Twitter. Yet, their rise wasn’t built solely on technical exploits—it began with fabrications and theatrical messaging. CyberAv3ngers evolved from obscure defacers into sophisticated narrative operators, blending cyber sabotage with psychological operations. As their influence grew, so did suspicions of deeper affiliations—particularly with Iran’s Cyber Command, suggesting that the group may be more than a rogue actor and instead part of a broader state-aligned strategy.
Act I: A Hot War Fuels a Digital One
The ongoing conflict between Iran and Israel has intensified across both physical and digital fronts. In the last two weeks alone, Iran has launched multi-warhead missile attacks targeting major Israeli cities such as Tel Aviv and Haifa. In response, Israel conducted retaliatory airstrikes against Iranian military installations, nuclear sites, and key IRGC-Cyber Electronic Command (IRGC-CEC) facilities in cities like Isfahan and Tehran. Alongside these kinetic exchanges, Iranian cyber operators have reportedly hijacked Israeli CCTV and smart home cameras to evaluate the precision and impact of missile strikes in real time. Concurrently, cyberattack activity has spiked dramatically, since early June affecting sectors ranging from energy and defense to agriculture and municipal infrastructure across Israel and extending into Western targets.
Act II: Who Are CyberAv3ngers?
Before CyberAv3ngers emerged as a recognizable threat actor in 2023, they appeared to be reviving an obscure alias from the past. In 2020, a group calling itself “Cyber Avengers” claimed responsibility for a power outage and railway disruption in Israel, events that Israeli officials attributed to technical faults, not cyberattacks. No malware was identified, no indicators of compromise (IOCs) were released, and the group faded from view. Then, in September 2023, a new Telegram channel @CyberAveng3rs was launched, adopting the old name with a stylized twist and retroactively tying itself to the 2020 claims. The group posted ideological threats, listed infrastructure targets, and positioned itself as a cyber-arm of resistance. Its first major public claim came on October 8, 2023, when it announced it had hacked the Dorad power station, one of Israel’s largest private energy producers, a dramatic move intended to cement its arrival in the cyber threat landscape.
Except they didn’t hack it.
CyberAv3ngers' claim that they hacked Israel’s Dorad private power station on October 8, 2023, was quickly debunked by technical analysis. Investigators from Securelist confirmed that the images shared by the group were not the result of a new intrusion but were recycled from a 2022 data leak by the Iranian APT group Moses Staff. The visuals had been cropped, overlaid with new logos, and presented as fresh evidence, but metadata and compression timestamps matched the original files. There was no supporting technical evidence—no new malware, logs, or IOCs to indicate that CyberAv3ngers had gained real access to Dorad’s infrastructure. The only actual activity was a denial-of-service (DDoS) attack on the Dorad website, which served more as a psychological support act than an operational exploit. This episode marked a clear shift in CyberAv3ngers' strategy: from technical sabotage to theatrical propaganda.
Act III: The Illusion of the Dorad Hack
In reality, CyberAv3ngers did not breach the Dorad power station in October 2023. Instead, they repurposed images from a 2022 leak by the Iranian APT group Moses Staff. These files, though legitimate at the time of their original release, were outdated. CyberAv3ngers cropped the images, added their own defacement slogans, and circulated them as if they were proof of a new, live intrusion. No technical compromise occurred at Dorad, but the impact was psychological. The staged attack triggered a wave of reactions across social media and threat monitoring communities. Telegram lit up with reposts, and news outlets picked up the story. To reinforce the illusion, CyberAv3ngers launched DDoS attacks on Israeli websites and released altered versions of Israeli infrastructure security guidance under mocking titles like “Advice for Victims.” It was a performance—but one calibrated to sow fear and disrupt public trust.
Act IV: When the Hacks Became Real
While some of CyberAv3ngers’ early claims were rooted in propaganda, the group did carry out real and damaging cyberattacks. Between November 2023 and April 2024, at least 29 confirmed intrusions targeting industrial control systems (ICS) and operational technology (OT) in the United States were attributed to the group. Among these incidents were compromises of Unitronics PLCs used in municipal water utilities, including one in Aliquippa, Pennsylvania, where human-machine interfaces (HMIs) were defaced with the message: “You have been hacked, down with Israel.” The group also targeted fuel distribution systems, specifically Orpak and Gasboy terminals, disrupting their functionality. Additional intrusions affected routers, IP cameras, firewalls, and HMIs across various sectors of critical infrastructure. At the center of these campaigns was a custom Linux-based malware tool known as IOCONTROL, which enabled persistent access, remote command execution, and stealthy communication via encrypted MQTT channels. These attacks confirmed that beneath the narrative manipulation, CyberAv3ngers had a genuine operational capability with real-world consequences.
Act V: Iran’s Cyber Doctrine Evolves
CyberAv3ngers represents the latest evolution in Iran’s long-standing tradition of blending cyber operations with ideological messaging. While groups like Moses Staff, APT33, and Charming Kitten have previously combined technical intrusions with media theatrics, CyberAv3ngers has refined the model into a fully realized propaganda apparatus. Their approach is not just to breach systems, but to control the narrative surrounding those breaches—turning each operation into a performance aimed at both foreign audiences and domestic sympathizers. What sets them apart is the deliberate construction of a digital persona that fuses propaganda, defacement, and symbolic domain control into a cohesive identity.
Further supporting this narrative-centric shift, we observed three domains registered within hours of CyberAv3ngers’ September 15, 2023 Telegram launch post—a message that introduced the group’s rebranding and outlined threats to Israeli infrastructure. The domains were:
- cyberav3ngers.com
- cyberav3ngers.org
- cyberav3ngers.net
All three were registered through Namecheap using the registrar service registrar-servers.com, with privacy masking enabled via WithheldForPrivacy. As of this writing, none of the domains host active websites, nor do they resolve to public content. Passive DNS history shows that these domains were connected briefly to placeholder IP addresses, but no C2 or content delivery infrastructure has been deployed—strongly suggesting that their primary function is symbolic rather than operational.
This domain registration pattern aligns tightly with CyberAv3ngers’ pivot to psychological operations. Rather than functioning as delivery vehicles for malware or command-and-control beacons, these domains appear to serve as digital flags staking ideological territory on the internet. Just as their defacements aim to instill fear and assert presence, these unused domains enhance the group’s narrative power, presenting them as structured, intentional, and enduring. By echoing the group's name in global domain registries, CyberAv3ngers reinforces its persona as a persistent ideological combatant—building credibility not just through code, but through semiotic control.
CyberAv3ngers’ propaganda and PSYOPS narrative strategy:
- Builds on past Iranian hybrid groups like Moses Staff, APT33, and Charming Kitten, known for blending cyberattacks with ideological content.
- Operates a Telegram channel not just for updates, but as a staged information environment—complete with threats, slogans, and memes.
- Frequently shares repackaged defacements and screenshots to simulate recent operations.
- Registers domain names, to establish symbolic control and brand presence (e.g., cyberav3ngers.com, cyberav3ngers.org, cyberav3ngers.net).
- Continues the Iranian model of patriotic hacker narratives, but with diminished separation between state and grassroots actors.
- Leverages these platforms to mock foreign security services, distribute edited guidance docs, and amplify the psychological effect of their campaigns.
Act VI: Who’s Behind the Mask?
The U.S. government has made no secret of its belief that Iran’s IRGC-Cyber Electronic Command (IRGC-CEC) is behind the escalating cyber campaigns targeting U.S. and Israeli infrastructure. In 2024 and early 2025, the U.S. Treasury and Department of Justice sanctioned six IRGC-CEC operatives, naming them as key players in attacks against critical systems. All six were added to the Rewards for Justice program, with bounties of up to $10 million for information leading to their arrest. Among the most prominent is Mahdi Lashgarian, a senior cyber operations official and likely architect behind multiple OT-focused malware campaigns. While public attribution has yet to confirm a direct link between Homayunfal and the alias Mr. Sul (or Mr. Soul), mounting circumstantial evidence places him squarely in the operational core of the CyberAv3ngers campaign.
Now, he’s also become a target.
In May 2025, an Israeli patriotic hacker group calling itself WeRedEvilsOG claimed on Telegram that they had successfully breached Lashgarian’s personal and professional accounts. The group released what it described as a “partial dox drop”, including purported email addresses, internal communications, and IRGC-linked credentials. While the authenticity of the data is still under review, the leak marked the first instance of direct retaliatory targeting against a named Iranian cyber commander involved in the ICS/OT threat landscape.
Profile: Mahdi Lashgarian
- Full Name: Mahdi (Mehdi) Lashgarian
- Date of Birth: June 2, 1989
- Nationality: Iranian
- Affiliation: Senior official in the Islamic Revolutionary Guard Corps – Cyber‑Electronic Command (IRGC‑CEC)
Why he’s suspected to be “Mr. Sul”
- Matches the technical and leadership profile attributed to the IOCONTROL malware operator
- Named in the same DOJ bounty notice targeting CyberAv3ngers operators
- His sanction timeline aligns with the rollout of the most destructive CyberAv3ngers campaigns
- Newly leaked data by WeRedEvilsOG reportedly ties him to multiple IRGC infrastructure assets
The inclusion of Lashgarian in public sanctions, U.S. bounty programs, and now retaliatory hacker operations by pro-Israel actors suggests that the shadow war between Iran and Israel has entered a new phase—one where attribution isn’t just technical, it’s personal.
Final Act: A War of Machines and Messages
CyberAv3ngers has evolved beyond a conventional threat actor into a strategic asset within Iran’s asymmetric warfare toolkit—combining real-world cyberattacks, recycled leaks, and targeted propaganda to amplify psychological impact. Their operations integrate technical capability, such as IOCONTROL malware and MQTT-based command and control, with ideological messaging distributed via Telegram, Twitter, and symbolic domain registrations. Whether or not “Mr. Sul” is truly Mahdi Lashgarian, the persona functions as a force multiplier shaping narratives, intimidating adversaries, and reinforcing the perception of persistent threat. CyberAv3ngers aren't just breaching systems, they're engineering beliefs.
Sign Up For DomainTools Investigations’ Newsletter for the Latest Research
Want more from DomainTools Investigations? Be sure to sign up for our monthly newsletter to get the latest research from the team – available on LinkedIn or email.
FIN6 and Financially Motivated Cybercrime
Skeleton Spider, also known as FIN6, is a long-running financially motivated cybercrime group that has continually evolved its tactics to maximize impact and profit. While the group initially gained notoriety for point-of-sale (POS) breaches and large-scale payment card theft, it has since shifted to broader enterprise threats, including ransomware operations.
In recent years, FIN6 has sharpened its focus on social engineering campaigns that exploit professional trust. By posing as job seekers and initiating conversations through platforms like LinkedIn and Indeed, the group builds rapport with recruiters before delivering phishing messages that lead to malware. One of their preferred payloads is more_eggs, a stealthy JavaScript-based backdoor that facilitates credential theft, system access, and follow-on attacks, including ransomware deployment.
This research combines technical insights and practical analysis for both general audiences and cybersecurity professionals. We examine how FIN6 uses trusted cloud services, such as AWS, to host malicious infrastructure, evade detection, and ultimately deploy malware through socially engineered lures.
Phishing with Fake Resumes
FIN6 begins its attack by crafting phishing emails that impersonate job applicants. But their social engineering doesn't start in the inbox. The group has been observed initiating contact via professional job platforms like LinkedIn and Indeed, posing as enthusiastic job seekers and engaging with recruiters before following up with phishing messages. This adds a layer of authenticity and increases the chances of the recruiter trusting the source.
This phishing lure shows a professionally worded message from a fake applicant, using a non-clickable, no hyperlink ('bobbyweisman[.]com') to bypass automated link detection. This tactic forces the recipient to manually type the URL into their browser.
These messages are carefully written and contain no clickable links—an evasion technique that helps them bypass security filters. Instead, recipients are forced to manually type a URL, often obscured with added spaces, or underscores “_” such as (elizabethabarton. COM)
Notably, the domains used in these campaigns often follow a pattern where the attacker's domain mimics a real applicant by combining a first and last name (e.g., bobbyweisman[.]com, ryanberardi[.]com). These domains are typically registered anonymously through GoDaddy, adding a layer of obfuscation that complicates threat attribution and takedown efforts. By exploiting GoDaddy’s domain privacy services, FIN6 further shields the true registrant details from public view and takedown teams. Although GoDaddy is a reputable and widely used domain registrar, its built-in privacy features make it easy for threat actors to hide their identities.
Whois records for these domains typically show redacted ownership information and standardized proxy entries, often pointing to GoDaddy’s domain privacy service. Abuse reports can technically be submitted via contact email fields listed in the Whois, commonly abuse@godaddy.com; however, responses and enforcement timelines vary.
It is likely the actors behind these domains use disposable or fraudulent email addresses, anonymous or foreign IP addresses, and prepaid or stolen payment methods to create and maintain these accounts. Combined with the use of resume-themed domain names and impersonation techniques, this registration strategy allows FIN6 to keep their infrastructure alive just long enough to carry out active phishing campaigns while avoiding rapid takedown by security researchers or registrars.
Cloud-Hosted Malware Infrastructure
FIN6 hosts its phishing sites using trusted cloud infrastructure, including AWS. These platforms are appealing to attackers due to:
- Past observations of FIN6 leveraging Amazon CloudFront to obscure infrastructure and evade detection. By using CDN services like CloudFront, attackers can mask the origin of malicious content, making it harder for defenders to trace and block the true hosting source.
- Ease of setup using services like EC2 and S3
- Low cost with free-tier abuse or use of compromised billing accounts
- Cloud IP ranges that are often implicitly trusted by enterprise network filters
- Built-in scalability and the ability to rapidly provision disposable infrastructure
FIN6 often sets up landing pages on cloud-hosted domains that resemble personal resume portfolios. These domains are usually mapped to AWS EC2 instances or S3-hosted static sites, making them difficult to distinguish from legitimate personal or business hosting.
These landing sites are built with traffic filtering logic to distinguish between potential victims and unwanted analysis tools. If the visitor doesn't match specific criteria, the site serves only benign content, typically a plain-text version of the resume or an error page.
To evade detection and analysis, FIN6 deploys a combination of environmental fingerprinting and behavioral checks, including:
- IP reputation and geolocation – Traffic is filtered to allow access only from residential ISP ranges, excluding connections from cloud infrastructure, VPN services, or known threat intelligence networks.
- Operating system and browser fingerprinting – The site checks for typical Windows browser user-agent strings, such as Mozilla/5.0 (Windows NT 10.0; Win64; x64). Visitors using Linux, macOS, or uncommon browsers are blocked or shown harmless content.
- CAPTCHA verification techniques – The site presents a CAPTCHA (such as Google reCAPTCHA) that must be completed before allowing access to any downloadable content. This prevents automated analysis tools and headless browsers from easily interacting with the site. In many cases, the CAPTCHA is only triggered when the visitor meets initial filtering conditions, acting as a final gate to ensure human presence before delivering the payload.
These layered filters ensure that the malicious content is only delivered to actual human recruiters browsing from typical home or office setups, while blocking security scanners and automated crawlers.
If the request meets all conditions, the site returns a CAPTCHA and a fake resume interface that eventually offers a ZIP download.
All the following domains have been confirmed as hosted on AWS infrastructure:
- bobbyweisman[.]com
- emersonkelly[.]com
- davidlesnick[.]com
- kimberlykamara[.]com
- annalanyi[.]com
- bobbybradley[.]net
- malenebutler[.]com
- lorinash[.]com
- alanpower[.]net
- edwarddhall[.]com
These sites often display a professional-looking fake resume, complete with a CAPTCHA to verify human access. Additionally, the attackers employ traffic filtering techniques to control who can access the malicious content. Only users appearing to be on residential IP addresses and using common Windows-based browsers are allowed to download the malicious document. If the visitor originates from a known VPN service, cloud infrastructure like AWS, or corporate security scanners, the site instead delivers a harmless plain-text version of the resume. This selective delivery tactic helps the malware infrastructure avoid detection and analysis. If conditions are met, the site delivers a malicious ZIP file to the visitor.
More_eggs Malware Delivery Chain
The malware delivery uses simple techniques wrapped in deceptive visuals:
- ZIP file contains a disguised .LNK (Windows shortcut) file
- LNK file executes hidden JavaScript using wscript.exe
- Payload connects to external resources and downloads the More_eggs backdoor
More_eggs, developed by the "Venom Spider," also known as "Golden Chickens," is a modular JavaScript backdoor offered as malware-as-a-service. It allows for command execution, credential theft, and follow-on payload delivery, often operating in memory to evade detection.
Common TTPs Observed:
- Initial Access: .zip archive containing .lnk file
- Execution: Uses LOLBins like ie4uinit.exe, regsvr32.exe, or msxsl.exe
- Persistence: Registry run keys or scheduled tasks
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\<RandomName>
- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\<RandomName>
- C2 Communication: HTTPS with spoofed User-Agent headers
- Mozilla/5.0 (Windows NT 10.0; Win64; x64)
- Mozilla/5.0 (Windows NT 10.0; Win64; x64)
- PowerShell Execution:
- powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -EncodedCommand <Base64>
How to Defend Against These Attacks
For Recruiters and General Staff:
- Avoid manually typing in resume links from unknown senders
- Be cautious of CAPTCHA-protected resume sites
- Never download ZIP files unless verified by IT
For Security Teams:
- Monitor for outbound traffic to domains that appear recently re-registered or show signs of ownership change. These domains may have been benign in the past and are now being used for malicious purposes. This reuse can help attackers benefit from existing domain reputation and bypass domain age-based filters.
- Block execution of .lnk files inside ZIPs from untrusted sources
- Detect use of LOLBins executing PowerShell or JScript unexpectedly
- Implement EDR policies for scripting engine abuse (e.g., wscript.exe, msxsl.exe)
- Watch for persistence indicators in Windows registry and scheduled tasks
The Efficacy of Low-Complexity Phishing Campaigns
FIN6’s Skeleton Spider campaign shows how effective low-complexity phishing campaigns can be when paired with cloud infrastructure and advanced evasion. By using realistic job lures, bypassing scanners, and hiding malware behind CAPTCHA walls, they stay ahead of many detection tools.
Security teams and HR departments alike must stay informed and vigilant. Training, layered defenses, and early detection of unusual traffic or file types are critical to disrupting these types of attacks.
Stay informed. Stay alert. Stay safe.
IOCs on GitHub
If the community has any additional input, please let us know.
Sign Up For DomainTools Investigations’ Newsletter for the Latest Research
Want more from DomainTools Investigations? Be sure to sign up for our monthly newsletter to get the latest research from the team – available on LinkedIn or email.
Understanding the landscape of cyber threats, particularly Russian-affiliated ransomware, is a complex and evolving challenge. The traditional model of tracking distinct, unified ransomware groups is becoming increasingly difficult. In the "post-Conti era," ransomware has transformed into a marketplace of mutations. It's no longer about centralized operations but rather a fractured ecosystem where allegiances shift and connections are often hidden.
In order to develop a deeper understanding and help others in the community in the process, Jon DiMaggio at Analyst1, Scylla Intel, and the DomainTools Investigations Team dove into a research project that culminated into a detailed infographic called “A Visual and Analytical Map of Russian-affiliated Ransomware Groups.” This work follows previous research DomainTools undertook in tracking ransomware families and provides a visual representation of complex connections in this space.
The goal of this project was not simply attribution or listing individual groups. Instead, we set out to map hidden connections between criminal factions, going beyond just mapping "families" to understand the intricate relationships between them. The core focus was on identifying overlaps in human operators, code fragments, infrastructure, and TTPs (Tactics, Techniques, and Procedures).
The Creation Process: A "Spider-Out" Investigation
Creating this map required a deep dive into the operational realities of various ransomware actors. Our methodology involved performing a "spider-out" incremental investigation. We began with well-known groups like Conti, LockBit, and Evil Corp, then expanded our research outwards, following the threads of connection.
To gather the necessary information, we drew upon a variety of sources:
- OSINT (Open-Source Intelligence)
- Historic infrastructure data
- Proprietary threat intelligence
- HUMINT (Human Intelligence)
It's important to note that the analysis only includes publicly available information; nothing is revealed that could tip off adversaries.
Our analysis of these diverse data points helped isolate valuable signals from the surrounding noise. This included overlapping IP addresses, passive DNS records, shared certificates, web content, and delivery vectors used by different groups. These infrastructure overlaps imply potential resource pooling, bulletproof hosting, or affiliate-level reuse. We also analyzed code and TTP crossovers, such as the overlap between Black Basta and Qakbot or the use of legacy Trickbot infrastructure. The prevalence of shared tools like AnyDesk and Quick Assist also suggested common training, playbooks, or crossovers in operator organizations. And finally, we looked closely at the most important element, the people in these groups.
Visualizing the Overlaps: Human Capital and Operator Drift
Perhaps one of the most significant findings visualized in the infographic is the human overlap and operator drift. Our research uncovered instances of known individual actors migrating across different ransomware ecosystems. For example, sources indicate individuals like “Wazawaka” have been associated with multiple groups including REvil, Babuk, LockBit, Hive, and Conti. Similarly, "Bassterlord" moved from REvil to Avaddon, then to LockBit, and finally to Hive.
This phenomenon highlights a crucial insight: brand allegiance among these operators is weak, and human capital appears to be the primary asset, rather than specific malware strains. Operators adapt to market conditions, reorganize in response to takedowns, and trust relationships are critical. These individuals will choose to work with people they know regardless of the name of the organization. Indeed, rebranding in this context is a feature, not a bug. The infographic helps to visualize how these individuals move between groups, carrying their expertise and capabilities with them.
Key Takeaways from the Mapping:
The creation of this infographic reinforces several strategic takeaways:
- Reuse does not equal identity. Different groups may share code or have human overlap but are not the same entity.
- Group labeling is increasingly obsolete.
- The modern threat landscape is best understood by tracking clusters of activity, not just named groups, and focusing on similar activity rather than specific names.
This new perspective, visually represented in this infographic, is crucial for understanding how ransomware operations function today. Groups act like modules, specializing and adapting as the marketplace matures. They exhibit a separation of responsibilities, with distinct roles for negotiators, developers, infrastructure managers, and leadership. Sanctions evasion strategies, such as Evil Corp’s repeated rebranding paired with infrastructure reuse, prove that while names may change, capabilities endure.
Understanding these hidden alliances and overlaps is key to developing and maturing more effective disruption strategies. As a community, we need to evolve how we track actors and criminal brands, recognizing that shared infrastructure or website artifacts might serve as more stable "fingerprints" than group names.
The full infographic provides a comprehensive visual guide to these complex relationships. We believe this work offers a new lens through which to view and counter Russian-affiliated ransomware, emphasizing the need to understand the underlying ecosystem and human networks rather than just transient names and tools.
This report details a malicious campaign that uses deceptive websites, including spoofed Gitcodes and fake Docusign verification pages, to trick users into running malicious PowerShell scripts on their Windows machines. Victims are lured into copying and pasting these scripts into their Windows Run prompt, which then download and execute multiple stages of additional scripts, ultimately leading to the installation of the NetSupport RAT (remote access trojan).
Malicious Multi-Stage Downloader Powershell Scripts Identified
Our team identified malicious multi-stage downloader Powershell scripts hosted on multiple themed websites including Gitcodes and fake Docusign captcha verifications. These sites attempt to deceive users into copying and running an initial powershell script on their Windows Run command. Upon doing so, the powershell script downloads another downloader script and executes on the system, which in turn retrieves additional payloads and executes them eventually installing NetSupport RAT on the infected machines.
Malicious Powershell Scripts Hosted on Gitcodes
Malicious Powershell scripts were found to be hosted on instances of Gitcodes sites for the purpose of downloading second stage Powershell scripts. The second stage also functioned as downloaders, making 3 or more web requests to retrieve and execute a third stage of scripts from other domains, which then retrieve and run a fourth stage resulting in NetSupport RAT running on the victim host.
![Domain: gitcodes[.]org resolving website with a Gitcodes service running titled: “Gitcodes - #1 paste tool since 2002!”](https://cdn.prod.website-files.com/6941445776ba1afe6af83186/695263af101e496079c4d160_Code-Repository.png)
Domain: gitcodes[.]org resolving website with a Gitcodes service running titled: “Gitcodes - #1 paste tool since 2002!” Gitcodes is populated with a malicious Powershell script that concatenates multiple strings to form a domain. It then initiates a web request using the specified user agent and domain to download and run the returned script.
![the script calls out to “http[:]//tradingviewtool[.]com” using the user agent “TradingView.”](https://cdn.prod.website-files.com/6941445776ba1afe6af83186/695263af101e496079c4d15a_tradingview-developer-mode.png)
The retrieved script from tradingviewtool[.]com subsequently invokes additional web requests to download 3 files from a different domain “tradingviewtoolz[.]com” and also initiates multiple requests to tradingviewtool[.]com. Initially the script reaches out to https[:]//tradingviewtool[.]com/info2.php, which appears to be a method of checking in with the computer name to record the initial execution of the script. Once the script completes its intended purpose and cleans up its local artifacts, it calls out to the same domain again at https[:]//tradingviewtool[.]com/info3.php with the computer name likely indicating the host is infected.
As seen in the capture above, this second stage script performs a series of malicious actions to install a payload and make it persistent, all while trying to hide its activities and deceive the user. The script essentially functions as a downloader, retrieving NetSupport RAT and running it on the system. The three files contain a legitimate 7zip executable, which it uses to unpack “client32.exe” and creates a new entry in the Windows Registry's "Run" key for the current user for it. This ensures that `client32.exe` will automatically start every time the user logs in, establishing persistence for the malware. Naming it "My Support" is an attempt to make it look less suspicious in lists of startup programs.
Uncovering the Broader Malware Ecosystem Behind the Campaign
The observed infrastructure had a wider variety though the combination of registration and website configurations as well as the repeat use of malicious payloads enabled the identification of additional lure sites serving similar malicious downloader scripts.
Registrar:
- Cloudflare
- NameCheap
- NameSilo
NameServer:
- cloudflare[.]com
- luxhost[.]org
- namecheaphosting[.]com
SSL Issuer: WE1
Website Title contains Gitcodes
Example 1:
Example 2:
Fake Docusign CAPTCHAs Used to Deploy NetSupport RAT
Pivoting on the Netsupport RATs being distributed and the associated infrastructure, additional malware distribution domains were identified including Docusign spoofed websites. Similar to the Gitcodes sites, multiple stages of script downloaders were observed resulting in Netsupport RATs being installed on victim machines.
An initial payload retrieves a “s.php” file from a domain spoofing as docusign. It then unzips the file and launches a script within it.
| docusign.sa[.]com |  |
The main malicious functionality is present in “docusign.sa[.]com/verification/s.php,” which is initially ROT13 encoded, likely to avoid signature detections and obfuscation. ROT13 or rotate 13, is a form of Caesar Cipher in which a simple letter substitution replaces each letter with the 13th letter after it in the alphabet. Completing this operation twice effectively decodes the text.
The page is designed to look like a Cloudflare "Checking your browser" / CAPTCHA page, mixed with Docusign branding. The initial screen presents a fake CAPTCHA checkbox (.captcha-check). Upon clicking, "s.php?an=0" is triggered, likely for logging the click attempt. The page then initiates Clipboard Poisoning, in which a “unsecuredCopyToClipboard()” function is called, copying an encoded multi-layered string to the user’s clipboard. The user is instructed to (Win+R, Ctrl+V, Enter) or in other words, open their Window’s Run prompt, copy in the malicious script, and run it.
Also on the s.php page, after the clipboard poisoning, an interval timer is set to make an AJAX GET request to c.php every second. If c.php returns "1," the current page (s.php) reloads (window.location.reload()). This is likely a C2 (Command and Control) mechanism waiting for the victim to paste and run the PowerShell script on their machine.
The string copied to the user’s clipboard decodes to the following PowerShell script:
This script downloads a persistence script, “wbdims.exe,” from Github. It then starts it as a process, creates a COM object for Windows Script Host, which it then uses to create a shortcut in the Startup folder to automatically execute when the user logs in.
While this payload was no longer available during the time of investigation, the expectation is that it checks in with the delivery site via “docusign.sa[.]com/verification/c.php.” Upon doing so, it triggers a refresh in the browser for the page to display the content of “docusign.sa[.]com/verification/s.php?an=1.”
The initial clipboard poisoning delivered a first-stage PowerShell downloader. The refresh of s.php (to s.php?an=1) delivers this second-stage PowerShell script, which then downloads and executes a third-stage payload (jp2launcher.exe from the zip file) retrieved by passing “an=2” argument to the same php page “docusign.sa[.]com/verification/s.php?an=2.”
Downloaded Zip File: 254732635529a0567babf4f78973ad3af5633fd29734ea831e5792292bbf16cd
The script then unzips the file and starts a process called “jp2launcher.exe”, which subsequently, goes through additional stages of file retrievals and executions resulting in a NetSupport RAT (3acc40334ef86fd0422fb386ca4fb8836c4fa0e722a5fcfa0086b9182127c1d7) being installed on the victim machine with these associated network actions:
http[:]//mhousecreative[.]com
http[:]//170.130.55[.]203:443/fakeurl.htm
In summary, the fake Docusign website is likely distributed via phishing attempts over email and/or social media. It is the beginning of an elaborate multi-stage NetSupport RAT delivery method that relies upon deceiving users into verifying they are humans by copying and running a malicious powershell script on their machines. The multiple stages of scripts downloading and running scripts that download and run yet more scripts is likely an attempt to evade detection and be more resilient to security investigations and takedowns.
By breaking the attack into small, distinct steps, the attacker increases the chance that at least one stage will slip past initial signature-based defenses. Additionally, the early phase persistence files appear to be short lived or quickly identified and taken down, however the subsequent later stages appear to be active for longer time frames. This demonstrates the method's somewhat effective disposable pawn strategy with a more resilient late game setup.
The Widening Scope of Clipboard Poisoning Attacks
While the use of ROT13 encoding can make some detections more difficult, particularly when depending on services that attempt to preprocess server scan data, the samples themselves allow for more unique identification such as the consistent use of the same strings and comment values within the php code.
Pivots on the Clickboard Poisoning scripts identified several other nearly identical instances of the code present on a wider range of spoofed content including Okta and popular media apps. Additionally, Discord and GitHub were also identified as being utilized for hosting the next stage malware such as in the following example.
While attribution of this campaign of activity is unclear, pivots on the associated infrastructure and malware identified reuse of associated NetSupport RAT hashes, similar delivery URL patterns, and similar domain naming and registration patterns observed in a previously reported cluster of SocGholish activity. Notably, the techniques involved are commonplace and NetSupport Manager is a legitimate administration tool known to be leveraged as a RAT by multiple threat groups such as FIN7, Scalert Goldfinch, STORM-0408 and others.
Key Takeaways and Security Recommendations
This analysis highlights a sophisticated and persistent malicious campaign designed to deliver the NetSupport RAT through deceptive means, primarily leveraging spoofed Gitcodes and fake Docusign verification pages. The attackers employ a multi-stage approach, using seemingly innocuous "verify you are human" CAPTCHAs and malicious PowerShell scripts disguised as legitimate prompts to trick users into infecting their own machines. This method capitalizes on user trust and familiarity with common online interactions, such as document verification and code sharing platforms.
Key Security Recommendations:
- Exercise extreme caution when prompted to copy and paste scripts into the Windows Run prompt: legitimate websites rarely, if ever, require users to execute PowerShell commands directly. Always verify the source and legitimacy of any such requests.
- Be wary of CAPTCHA-like verifications that instruct you to run commands: genuine CAPTCHAs do not involve running scripts. Any prompt to do so should be treated as highly suspicious.
- Verify the authenticity of websites: Double-check the URL and SSL certificates of websites, especially those that request sensitive actions or information. Be cautious of lookalike domains.
This campaign serves as a stark reminder of the evolving threat landscape. Attackers are continuously refining their techniques to exploit user behavior and bypass traditional security measures. Vigilance, user education, and proactive security practices are paramount in defending against these increasingly sophisticated threats. The "self-infect" tactic, while seemingly simple, can be highly effective, emphasizing the need for users to remain skeptical and verify all interactions before acting.
IOCs on GitHub
https://github.com/DomainTools/SecuritySnacks/blob/main/2025/prove-you-are-human.csv
If the community has any additional input, please let us know.
Sign Up For DomainTools Investigations’ Newsletter for the Latest Research
Want more from DomainTools Investigations? Be sure to sign up for our monthly newsletter to get the latest research from the team – available on LinkedIn or email.
A malicious campaign using a fake website to spread VenomRAT, a Remote Access Trojan (RAT), is detailed in this analysis. The malware includes tools for password theft and stealthy access. This research examines the attackers' methods, such as deceptive websites and command infrastructure, indicating a clear intent to target individuals for financial gain by compromising their credentials, crypto wallets, and potentially selling access to their systems.
VenomRAT, StormKitty, and SilentTrinity Deployment
Malicious domain “bitdefender-download[.]com” resolves a website titled “DOWNLOAD FOR WINDOWS,” which spoofs Bitdefender’s Antivirus for Windows download page.
The “Download For Windows” button initiates a file download from the following bitbucket URL:
“https[:]//bitbucket[.]org/sadsafsadfsadf/dsfgdsgssdfgdsg/downloads/BitDefender.zip,”
The bitbucket URL redirects to its content source on Amazon S3.
“https[:]//bbuseruploads.s3.amazonaws[.]com/9e2daa63-bae3-4cbb-9f88-8154ba43261f/downloads/aa7b9593-2ccd-4cd0-9e04-9b4a7da9276b/BitDefender.zip.”
The bundled executable StoreInstaller.exe was found to contain malware configurations associated with VenomRAT. It also contained code associated with open source post-exploitation framework SilentTrinity and StormKitty stealer.
A report by Arconis describes VenomRAT as a RAT that originated as a fork of the open-source Quasar RAT. It is often used for initial access and persistence. Capabilities include remote access, stealing credentials, keylogging, exfiltration and more.
At a high level, the three malware families function as follows:
- VenomRAT provides initial and ongoing access to victim machines
- StormKitty quickly gathers credentials on the system
- SilentTrinity is used for exfiltration and stealthy long term access
The inclusion of SilentTrinity and StormKitty (both open-source malware tools) indicates the attacker’s dual focus: rapidly harvesting financial credentials and crypto wallets during initial access, while also establishing stealthy, persistent access for potential long-term exploitation. The implications of long term access may include repeat compromise or selling access.
VenomRAT
Observed VenomRAT configurations showed multiple identifiable attributes that allowed for reliable pivots to other samples likely created by the same actor including the reuse of the same IP and port, 67.217.228[.]160:4449, for command and control.
Related samples using the same VenomRAT configurations:
VenomRAT C2 IPs
A reused 3389 service configuration was identified via Shodan “hash:-971903248” allowing for pivots to additional IP addresses with the same configurations. Multiple of the IPs were confirmed to be used as C2s for VenomRAT and are suspected to have also been configured by the same actor.
Delivery Sites:
Credential Harvesting Sites
The lure website domain spoofing as Bitdefender was observed with infrastructure and time proximity overlaps to other malicious domains impersonating banks and generic IT services, suspected of being used for phishing activity.
NameServer: cloudflare.com
IP ISP: cloudflare.com
Registrar:
- PDR Ltd
- GMO Internet
- NameSilo
SSL Issuer:
- Cloudflare TLS
- WE1
Server Type: cloudflare
| idram-secure[.]live Spoofs as Armenian IDBank page |
 |
| idram-secure[.]live Clicking directs to a site titled “ArmCoin” and the content alleges to be IDBank. The text is in Armenian and translates to: “To connect you to Idram Secure, please write to us in the chat. 🎉 Our chat is located in the bottom right corner of the page” |
  |
| royalbanksecure[.]online Spoofs as Royal Bank of Canada online banking login portal |
 |
| dataops-tracxn[.]com Spoofs as Microsoft login page |
 |
Protection from Open-Source Malware
This investigation reveals a deceptive campaign using VenomRAT, a powerful remote access tool, disguised as a legitimate Bitdefender antivirus download. Imagine clicking a button on what looks like a trusted site, only to unleash a trio of malicious programs – VenomRAT, StormKitty, and SilentTrinity – onto your system. These tools work in concert: VenomRAT sneaks in, StormKitty grabs your passwords and digital wallet info, and SilentTrinity ensures the attacker can stay hidden and maintain control. We tracked down the attackers' command centers, identified other malware they likely used, and uncovered their web of fake download sites and phishing traps spoofing as banks and online services.
This campaign underscores a constant trend: attackers are using sophisticated, modular malware built from open-source components. This "build-your-own-malware" approach makes these attacks more efficient, stealthy, and adaptable. While the open-source nature of these tools can help security experts spot them faster, the primary victims here are everyday internet users. These criminals are after your hard-earned money, targeting your bank accounts and cryptocurrency wallets with fake login pages and malware disguised as safe software.
This isn't just a problem for big companies – it's a threat to everyone online. So, what can you do?
- Be extremely cautious when downloading software. Double-check website addresses to make sure they're legitimate, especially for banking or login pages.
- Never enter your credentials on a site you're not 100% sure about.
- Practice safe internet habits: avoid clicking on suspicious links or opening unexpected email attachments.
IOCs on GitHub
https://github.com/DomainTools/SecuritySnacks/blob/main/2025/VenomRAT-Malware-Campaign.csv
If the community has any additional input, please let us know.
Sign Up For DomainTools Investigations’ Newsletter for the Latest Research
Want more from DomainTools Investigations? Be sure to sign up for our monthly newsletter to get the latest research from the team – available on LinkedIn or email.
An unknown actor has been continuously creating malicious Chrome Browser extensions since approximately February, 2024. The actor creates websites that masquerade as legitimate services, productivity tools, ad and media creation or analysis assistants, VPN services, Crypto, banking and more to direct users to install corresponding malicious extensions on Google’s Chrome Web Store (CWS). The extensions typically have a dual functionality, in which they generally appear to function as intended, but also connect to malicious servers to send user data, receive commands, and execute arbitrary code.
Example: A DeepSeek Chrome Extension themed lure website ‘deepseek-ai[.]link’
![A DeepSeek Chrome Extension themed lure website ‘deepseek-ai[.]link’](https://cdn.prod.website-files.com/6941445776ba1afe6af83186/695263b288864d7f5afb84ac_AD_4nXfqv6WgEBSGGa9_Bsv0MYP90Secxk_dKkttE-g2s221Rt6rHn7MXFquTqsGoKFiV6aDrfoY8L5EdDRu5ZQ8Vf2X0TkaMhxiJw8vl8UHc80lHb90m5jURP8jc7IMPuGVoqqNcok2Bg.png)
The extensions analyzed appear to have working or partially working functionality and are commonly configured with excessive permissions to interact with every site the browser visits and retrieve and execute arbitrary code from a network of other actor controlled domains.
While each extension was found to be relatively different, the hosting infrastructure and code structures were consistent. Multiple extensions were observed using a “onreset” event handler trick on a temporary document object model (DOM) element to execute code, likely to bypass content security policy (CSP). The extensions hardcode one of the actor’s API servers, typically in a file named “background.js” or “background.iife.js” or for older extensions “src/pages/background/index.js.” These files were also found to typically contain the majority of the malicious functionality of the extensions.
Registration Patterns for Actor Lure Websites
Common registration patterns were observed going back to October 2024.
- Registrar: NameSilo, LLC
- NameServer: cloudflare.com
- IP ISP: CloudFlare Inc.
- SSL Issuer Common Name: WE1
- Registrant: Domain Administrator
- Server Type:
- cloudflare
- proxygen-bolt
- MX Server: cloudflare.net
Additionally, the use of Facebook Tracker IDs were commonly used.
- Facebook ID
- 2696720993868113
- 416208351532463
- 312497404888286
- 993764766100733
- 2901646833326404
- 541163625350468
- 965666115394891
- 1151077320148683
- 965666115394891
The following are a sampling of the lure websites, which cover a wide range of topics and themes. The list of identified domains are provided on GitHub.
 |
 |
 |
 |
 |
 |
 |
Malicious Extensions
It’s worth noting, the extensions appear to be at least partly functional as it relates to the theme of their lure. However, in the cases where extensions interact with third party services to provide that functionality such as FortiVPN or DeepSeek AI, the extensions hard code the third party API keys into the extension code. An extremely poor security practice.
Example 1: Lure Site of Manus AI to Install an AI Assistant Extension
 |
| Lure Domain: manusai[.]sbs Extension Name: manus-ai-free-ai-assistan Extension ID: aeibljandkelbcaaemkdnbaacppjdmom CWS: https[:]//chromewebstore.google[.]com/detail/manus-ai-free-ai-assistan/aeibljandkelbcaaemkdnbaacppjdmom Extension Filename: aeibljandkelbcaaemkdnbaacppjdmom.crx Extension File Sha256: 3131d15ebea5eb68e636eb804b2de86cc04d8be5d1257c83f2042a391b8e9415 Actor API Domain: api.sprocketwhirl[.]top |
The first things to note about the extension are the extensive permissions it attempts to grant itself in the manifest.json file.
The “background.js” script fetches and applies declarativeNetRequest rules from the backend. This allows the author to modify network requests (block, redirect, modify headers) after the extension is installed, bypassing Chrome Web Store review for those changes. This could be used for malicious redirects, ad injection, or tracking.
The background script communicates with api.sprocketwhirl[.]top, sending encrypted system information (platform, language, memory, cores, timezone, IP, country code) and receiving dynamic declarativeNetRequest rules and potentially executable code.
The content script (injected into all pages) executes arbitrary code retrieved from chrome.storage.local (report key), which was placed there by the background script after fetching it from api.sprocketwhirl[.]top.
Example 2: Lure Site of FortiVPN Client Extension
 |
| Lure Domain: forti-vpn[.]com Extension Name: fortivpn Extension ID: ccollcihnnpcbjcgcjfmabegkpbehnip CWS: https[:]//chromewebstore.google[.]com/detail/fortivpn/ccollcihnnpcbjcgcjfmabegkpbehnip Extension Filename: ccollcihnnpcbjcgcjfmabegkpbehnip.crx Extension File Sha256: f4fe36cdc9bd1f16d9385e56155aca3723a267bcdf575e925e20bb9a6526b576 Actor API Domain: api.infograph[.]top |
The extension also attempts to grant itself extensive permissions as seen from its manifest.json file.
The extension has a dual functionality in which it provides some of the advertised purpose. In this case, a browser extension based VPN service by connecting to wss[:]//leviathan.whale-alert[.]io/ws using a hardcoded API key. At the same time, however, the extension also connects to a malicious backend client wss[:]//api.infograph[.]top/api and listens for commands. It uses a websocket keep-alive mechanism to maintain connectivity to the backend server as well as sending periodic ping and report messages.
When commanded, it uses chrome.cookies.getAll({}) to retrieve all browser cookies, compresses them using pako, encodes them in Base64, and sends them back to the backend infograph[.]top server.
It can be commanded to establish a separate WebSocket connection to act as a network proxy, potentially routing the user’s traffic through malicious servers. The proxy target is provided by the backend command and also implements proxy authentication handling.
The extension fetches arbitrary scripts from an actor-controlled server. It then injects the scripts into active browser tabs by using chrome.tabs.sendMessage to the tab’s content scripts, triggering their execution within the tabs.
Additionally, the extension enables dynamic network rules via setup response from the backend that can contain declarativeNetRequest rules which are then applied, allowing the backend to modify network traffic post-install.
Example 3: Lure of SiteStats Extension
 |
| Lure Domain: sitestats[.]world Extension Name: site-stats Extension ID: fcfmhlijjmckglejcgdclfneafoehafm CWS: https[:]//chromewebstore.google[.]com/detail/site-stats/fcfmhlijjmckglejcgdclfneafoehafm?pli=1 Extension Filename: fcfmhlijjmckglejcgdclfneafoehafm.crx Extension File Sha256: d6e179dcab901e81b3340aebaa3e517bb98b09f9fea01e667e594416c10efc44 Actor API Domain: api.zorpleflux[.]top |
Like the previous examples, this extension also grants itself extensive permissions and script execution on every site as seen from its manifest.json file.
The extension allows modifying network requests via rules. It is also able to make web requests, which is primarily observational in MV3, but combined with broad host permissions, it can still be used for tracking or reconnaissance.
Similar to the other extensions identified, it connects to an actor controlled backend server, api.zorpleflux[.]top, defined in the “background.iife.js” file. It also sends periodic ping and report messages to the backend server.
It is capable of setting up a secondary proxy WebSocket connection, allowing traffic routing via the user’s browser, commanded by the backend. It implements a reverse proxy functionality by handling proxied requests via fetch, compressing responses with pako, and relaying back to the backend.
The extension also conducts arbitrary script execution it receives from the backend server and uses chrome.tabs.sendMessage to send it to the content script declared in the manifest.json file for execution.
Actor API Endpoints
The extensions hardcode one of the actor’s API servers, typically in a file named “background.js” or “background.iife.js.” In the case of the malicious extension from deepseek-ai[.]link, which directs users to an installation of Chrome extension ID: “pocfdebmmcmfanifcfeeiafokecfkikj.” This extension upon installation actively communicates with another actor domain api.glimmerbloop[.]top to report installation/fingerprinting data and receive instructions/payloads.
Many of the analyzed extensions had variations in functionality and implementation of the API payload execution steps including what browser fingerprinting information was sent in the initial transaction. The following were consistent elements observed:
- Hardcoding actor API domain in “background.js” or “background.iife.js” file
- Use of HMAC with SHA-256 signing algorithm
- Use of JWT authentication
- Use of extension ID in UTF-8 bytes format as a secret key to sign the JWT payload
- Base64 encoding the payload prior to sending to the API server
In order to establish connection to the actor’s API server, the extensions create a token using the standard JWT library that combines a UUID, the extension ID, version, and country code. It then uses HMAC using SHA-256 signing algorithm before adding JWT claims to the payload (Issued At, Expiration Time). Finally, a secret key is used to sign the payload, which was consistently observed as being the UTF-8 bytes of the extension ID string. The output is then Base64 encoded using btoa() and sent to the API server as an authentication mechanism to retrieve arbitrary code to execute by the extension.
The domain registration details of the API endpoints were found to be nearly identical to those of the malicious lure websites with the additional commonalities in website title and content.
- Website Title: SiteName
- Website Content:
A pivot on these domain registration patterns identified the domains provided at the end of this post, suspected to be owned by the actor and used by malicious extensions. Analysis of several extensions identified hard coded domains that were all found to be in the list of identified API domains, further validating the findings.
Fake Websites and Malicious Chrome Extensions
Since at least February 2024, this malicious actor has deployed over 100 fake websites and malicious Chrome extensions with dual functionalities. Analysis revealed these extensions can execute arbitrary code from attacker-controlled servers on all visited websites, enabling credential theft, session hijacking, ad injection, malicious redirects, traffic manipulation, and phishing via DOM manipulation. Some extensions were also observed attempting to steal all browser cookies, which may lead to account compromises.
Notably, the Chrome Web Store has removed multiple of the actor’s malicious extensions after malware identification. However, the actor’s persistence and the time lag in detection and removal pose a threat to users seeking productivity tools and browser enhancements. Malware distributors such as this often exploit current trends, such as the recent DeepSeek AI media attention, to lure users into installing infected extensions, potentially gaining control over their browsing activity and sensitive data.
All users should protect themselves by exercising caution when installing extensions. Stick to the Chrome Web Store and verified developers, carefully review requested permissions, read reviews, and be wary of lookalike extensions. Keep your browser and antivirus software updated, and regularly review your installed extensions, removing any you don’t need or find suspicious. Vigilance is key to avoiding these threats.
IOCs on GitHub
https://github.com/DomainTools/SecuritySnacks/blob/main/2025/DualFunction-Malware-Chrome-Extensions
If the community has any additional input, please let us know.
Sign Up For DomainTools Investigations’ Newsletter for the Latest Research
Want more from DomainTools Investigations? Be sure to sign up for our monthly newsletter to get the latest research from the team – available on LinkedIn or email.
In the fast-paced digital landscape, viral media events capture global attention. From natural disasters and geopolitical shifts to groundbreaking tech releases and cultural phenomena, these moments dominate headlines and online conversations. But as the world's eyes turn towards these events, a different group also takes notice: malicious actors looking to capitalize on the public's interest and urgency.
Our security research team recently undertook a project to identify and analyze scam and malicious domains and websites that emerge in the wake of high-profile viral media events. Leveraging AI-driven research capabilities, we aimed to understand how threat actors exploit these moments for financial gain and other nefarious purposes.
AI-Powered Approach to Identify Viral Media Events
Our research methodology involved using AI to first identify viral media events that occurred between January 1, 2025, and the present. The AI research capability was prompted to pinpoint the approximate start, peak, and end of each event's virality across mass media and wide coverage.
For each identified event, we then tasked the AI with generating a list of keywords likely to appear in domain names or website titles seeking to associate with the event. The prompt for keyword generation was specifically designed to identify terms that scammers might use to create deceptive sites.
We sampled multiple event topics from the AI's output for deeper analysis, including the Los Angeles Fire, "NoKings," DeepSeek / China AI developments, the ongoing Trade War, and the Ukraine/Russia conflict.
An example of the AI's output for a significant tech event is as follows:
By searching for these keywords or similar terms in domain registrations and website titles within the estimated first and last observed timeframes, we detected several domains that appeared to be malicious. It was anticipated that most scam-related or malicious domains would emerge around the peak of viral activity and potentially persist until the latest observed dates.
A sampling of the malicious findings from the AI-generated keywords for the “Deepseek AI Release & Market Impact” event are shown below.
| Malicious Browser Extensions |  |
| Windows Trojan Delivery |  |
| Windows Trojan Delivery |  |
| Fake DeepSeek Meme Coins BeInCrypto site reported similarly appearing sites to market a fake DeepSeek meme coin. |
 |
Multiple scams were identified. Perhaps the most financially successful ones relating to the DeepSeek event were fake cryptocurrency meme coins created to capitalize on a growing trend of novice investors looking for the next hyped up moonshot meme coin. In the case of DeepSeek, according to BeInCrypto (cited in the table above), fake meme coins accrued over 46 million dollars worth before the rug was pulled, presumably indicating the scammers had cashed out.
Additionally, multiple malware delivery websites were observed primarily delivering Windows trojans and malicious browser extensions. One extension in particular was observed with capabilities to legitimately use DeepSeek API for working functionality, but also connected to a remote domain to retrieve and execute arbitrary JavaScript files likely for the purpose of credential harvesting or session hijacking.
Expected vs. Actual Findings Regarding Viral Events
Based on the nature of viral events, we anticipated finding websites and domains attempting to:
- Amplify or create spin-off movements to gain attention.
- Sell merchandise related to the event.
- Collect user information (contact details, experiences, etc.) for spam, resale, or phishing.
- Push deceptive or derisive narratives to further enthral individuals in alleged movements, leading to potential merchandise sales, information gathering, or fraudulent donations.
- Act as "ambulance chasers," with alleged law firms soliciting victims of tragedies for potential profit.
- Delivery of malware, adware, or spyware through deceptive downloads.
While we did observe instances of these expected tactics, our research consistently revealed a predominant motivation across the sampled events: direct financial profit.
For almost all events sampled, we identified websites explicitly seeking to profit by:
- Allegedly to be part of a legitimate donation foundation supporting the cause (e.g., for the LA Fire, the Ukraine/Russia conflict, and other tragedies like the Myanmar earthquakes).
- Selling merchandise related to the event topic.
- Creating and promoting meme cryptocurrency coins based on the event.
Beyond direct financial scams, we also confirmed the presence of websites designed for:
- Malware delivery.
- Information collection schemes.
- Disinformation campaigns aimed at pushing deceptive and derisive narratives.
Emerging Patterns and Linked Actors Across Viral Events
A significant observation was the emergence of common elements across multiple relatively unique-looking websites covering different viral events. This suggests the likelihood of the same actor or group being behind these diverse scams.
One example was websites that appeared to create meme cryptocurrency coins in response to several highly publicized events in the recent US political landscape and natural disasters, including US tariffs, the trade war, and the LA fire. Several sites appeared to share design, language, or infrastructure elements across these seemingly distinct scam sites points towards a connected operation.
One suspected cluster focused on scamming meme coins commonly utilized IP ISP: Vercel Inc, Registrar: Namecheap, SSL Issuer CN: R10 or R11, and commonly had website titles with a meme coin name in all caps such as LAFIRE, $LAFIRE, GROK and TOOT. Pivots from this pattern identified several other suspected scam meme coin websites including $TittsFart, $TUCHI, $TOOT, $GWOK, and $SUNG, which is a meme of the top Anime show Solo Leveling’s main character Sung Jinwoo.
The most prevalent scams observed were those pushing newly created cryptocurrency meme coins, which attracted novice traders seeking to ride the hype of the viral event to make easy money. Once the meme coin reaches a certain threshold of time or sale price, the scammers would cash out selling all of their coins and the meme coin would subsequently collapse. These meme coin scams were observed in a wide range of events including international conflicts such as the Russian attacks on Ukraine, the US Trade War, the LA Fire, and the Myanmar Earthquake.
The following are example findings of similar websites, each associated with inactive social media accounts that claim to sell cryptocurrency coins linked to widely publicized media events.
tradewar[.]space, tradewar[.]lol, tradewar[.]site attempt to persuade others to purchase Trade War themed cryptocurrency coins.
 |
 |
lafirebrigade.co[.]uk and lafireonsol[.]xyz attempt to persuade others to purchase a LA Fire-themed cryptocurrency coin.
![lafirebrigade.co[.]uk, lafireonsol[.]xyz attempt to persuade others to purchase a LA Fire themed cryptocurrency coin](https://cdn.prod.website-files.com/6941445776ba1afe6af83186/695263adcee67731ab0f4b98_AD_4nXcW1mcqkE3HlkIVrjj_H5Ld5Ta0zChrygeWpSwauXAt3reS5WxgVSOHbLQN5HusW4Verqd8Fh-keX9vuoM_5TGWDPgF_FDCtKvu70h36AwocpeU-jOgWwuyyNvgZlKUue8AJ4iJ8A.png)
lafire[.]io is another website attempting to pawn off scam crypto coin LAFIRE as a donation fund tactic.
![lafire[.]io is another website attempting to pawn off scam crypto coin LAFIRE as a donation fund tactic.](https://cdn.prod.website-files.com/6941445776ba1afe6af83186/695263adcee67731ab0f4b95_AD_4nXeTPwO0WvgKdnPjmL3T0e9TVMWo_uSJ_zTkRIAvt96XjOJlNAdLjpxCSaCaIoXhKQ6yYUrkxz1sshbhPWrN4KK3iJqIz2kK6NaRPD281mRG4HlrHxZZp6P1EB45aTC9BI4Pk3xy2Q.png)
Myanmar Meme coin myanmarmeme[.]top
![Myanmar Meme coin myanmarmeme[.]top](https://cdn.prod.website-files.com/6941445776ba1afe6af83186/695263adcee67731ab0f4b88_AD_4nXdL0VvE3fe3lV1aqfTBVWCX0npkinxZaM93ilorsB2LZgzAo9ToEYLw6P4-sFmQJkevRYtiA_x3v-FGskdxMHw-YseSqB8e2GWJYDtf7xFKv-drkwDSxGSdZsfsGDoX0T8b9NsvnA.png)
tootonsol[.]xyz
![tootonsol[.]xyz](https://cdn.prod.website-files.com/6941445776ba1afe6af83186/695263adcee67731ab0f4b7c_AD_4nXfaLyaUv6_eQKUtLyaEfbqgZ31ZwiftmI0Y8pNCwbytzn5fWk0CrPIEIyU1_fMvX4htgvM1-Jz6yHWy_bm-rBbFNXdj2D5kPxCCh2p-CRWgJI1yt9XSbXQJArtnnfrVQ3COCJm88A.png)
gork[.]ink suspected scam meme coin attempted to capitalize on the recent news hype of the Elon Musk-owned xAI Grok AI model. Decrypt reported the alleged scam meme coin achieved $160 million in market capitalization before crashing.
![gork[.]ink suspected scam meme coin attempted to capitalize on the recent news hype of Elon Musk owned xAI Grok AI model](https://cdn.prod.website-files.com/6941445776ba1afe6af83186/695263adcee67731ab0f4b8e_AD_4nXd8obIUxOaX5UXJx98HBhqo6FA3Sju-qaL6zle5_MnOTf0J1Tw9q4VhBCvTFbDEZUDdI3dN7GUU2-nl0W-AgqafyIw14_OBYIlNNKL-9avwkX0RU3MwV0IXXVJNyPmeX5xALlYXKg.png)
The second most prevalent scam tactic observed involved fake donations, sometimes masquerading as established entities such as the American Red Cross, World Food Program or LA Fire departments.
Specifically relating to the LA fire event, BforeAI published a report highlighting a similar method of identifying these types of scam domains in which a variety of websites were identified. Their report also noted multiple consistencies in the types of domains and websites being created in the aftermath of natural disasters.
lafirevictimsupport[.]com and lafireonsol[.]xyz purported to collect donations on behalf of the American Red Cross.
![lafirevictimsupport[.]com, lafireonsol[.]xyz purported to collect donations on behalf of the American Red Cross](https://cdn.prod.website-files.com/6941445776ba1afe6af83186/695263adcee67731ab0f4b82_AD_4nXdVvQbUD_x8SGl5a5vyY4-73xb1Ul1wuwQKfc33rDMHab3VS0DYP7HyC9aq2hZWHRA7jJPLIVuFVdBaubzIAbHbJVe-tZ78gi_tPJf0ma_5v8ogBQUXrlhRDg1JzC6yb4JZWZnBMg.png)
donorsee-charitable[.]com cryptocurrency donation scheme for Myanmar earthquake victims purporting to be part of the World Food Program (WFPUSA).
Malicious Actors Leveraging Viral Media Events for Financial Gain
Our research highlights the clear and present danger posed by malicious actors who quickly leverage viral media events for their own gain. The speed at which these events unfold provides a fertile ground for scammers to deploy a variety of schemes primarily focused on financial exploitation through fake donations, merchandise sales, and cryptocurrency scams. The observed connections between scam sites operating across different viral topics underscore the adaptive and potentially organized nature of these threat actors.
Staying vigilant and critically evaluating any website or domain seeking engagement related to a viral event is crucial. Always verify the legitimacy of organizations, especially those requesting donations or personal information, and be wary of unsolicited offers or urgent calls to action tied to breaking news. As security researchers, we will continue to monitor this evolving threat landscape and share our findings to help the public stay safe online.
Sign Up For DomainTools Investigations’ Newsletter for the Latest Research
Want more from DomainTools Investigations? Be sure to sign up for our monthly newsletter to get the latest research from the team – available on LinkedIn or email.
Like any garden, the digital landscape experiences the emergence of unexpected blooms. Among the helpful flora of browser and application extensions, some appear with intentions less than pure. These deceptive ones, often born from a fleeting desire for illicit gain or mischievous disruption, may possess a certain transient beauty in their ingenuity. They arrive, sometimes subtly flawed in their execution, yet are driven by an aspiration to infiltrate our digital lives, to harvest our data, or to simply sow chaos.
We see them not in complete, monolithic forms, but in their evolving iterations. A small crack in their initial design might be patched in the next update, a vulnerability exploited and then hastily concealed. Their existence is a dance of adaptation, a response to the ever-watchful gaze of security systems. They are, in a sense, perfectly imperfect – their flaws often intertwined with the very mechanisms that allow them to function, however briefly.
On the other side of this digital ecosystem reside the forces of security and risk awareness. These are the gardeners, constantly tending to the health of the digital space, pruning away the harmful growths. Security measures, with their own imperfections and constant striving for improvement, represent the human desire for safety and control. Risk, then, is the shadow cast by these deceptive extensions, a reminder of the potential cost of their transient existence – the loss of privacy, the compromise of personal information, the erosion of trust in the digital tools we rely upon.
The human experience at the heart of this is one of vulnerability and resilience. We, the users, navigate this landscape, often unaware of the subtle battles being waged. We place our trust in the extensions we install, hoping for enhanced functionality or convenience. When that trust is betrayed by a deceptive app or extension, it leaves a mark, a subtle crack in our digital confidence.
This story is a reminder that the digital world, like the natural one, is in constant flux, and our experience within it is shaped by this delicate and ever-shifting balance between aspiration and risk, between the fleeting beauty of innovation and the enduring need for security.
Browser Extensions’ Security Risk
Browser extensions can pose a security risk to individuals and organizations. Data from the user’s browser or inputs to the extensions can be sent to third parties who may not practice effective security measures to protect user data and privacy. This report highlights a network of approximately 20 newly registered websites intended to lure people to install new browser extensions from the Google Store. The domains and extensions were likely created by a single author, which exhibit patterns of deceptive practices and potential security risks. While the extensions do not display overtly malicious behavior, their design choices raise concerns regarding user privacy and data security.
The Network and Its Characteristics:
The extensions, available on the Google Chrome Web Store, share several common traits:
Manipulated Ratings: All extensions employ a deceptive rating system, funneling positive reviews to the Chrome Web Store while discarding negative feedback.
External Data Transmission: Some extensions, particularly those offering AI-powered features, transmit user data to domains owned by the author. This includes chat history, input data, and potentially sensitive information.
Misleading Branding: Certain extensions use misleading branding, falsely associating themselves with well-known services (e.g., "DeepSeek AI").
Functional Diversity: The extensions offer a range of functionalities, including AI writing and ad creation tools, URL shortening, PDF to JPG conversion, and AI chatbots.
Security Researcher's Guide: Investigating Suspicious Browser Extensions:
Investigative Steps:
- Initial Observation:
- Note the extension's stated functionality and its perceived utility.
- Examine user reviews for consistency and authenticity. Be wary of overwhelmingly positive reviews with limited negative feedback.
- Record the developer's name and any associated websites or domains.
- Extension Retrieval:
- Obtain the Extension ID: Locate the extension on the Chrome Web Store or via a URL from a website directing to download the extension
- Download the Extension: Use a tool like chrome-stats[.]com to download the extension's .crx file.
- Unpack the Extension: One method is to use a file archiving tool (e.g., 7-Zip) to extract the contents of the .crx file.
- Analyze the Files:
- Examine the manifest.json file for permissions requests and service worker details. Pay attention to permissions that seem excessive for the extension's stated functionality.
- Analyze Javascript files for suspicious code, external API calls, and data transmission patterns. Look for obfuscated or unusual code that may warrant further investigation.
- Review the Domains: Research the domains that the extension uses, and be suspicious of generic or unknown domains. Assess the domain's registration information, hosting provider, and overall reputation.
- Data Flow Assessment:
- Identify the types of data being transmitted and the purpose of the transmission. Evaluate the security and privacy implications of the data transmission.
Examples:
An interested user might see the reviews are 4.8 stars and at least 1,000 users. Not an insubstantial number given the recent global proliferation of DeepSeek AI related apps in the past few months.
A closer look at the reviews shows 4 ratings.
The extension's core functionality involves capturing user input and the entire ongoing chat history, then transmitting this data to an external server (ai-chat-bot.pro) with every message sent by the user. This presents a significant privacy risk, as potentially sensitive conversation data is processed by an unverified third party.
Common among all the observed extensions by this author is code that includes a rating widget that actively filters user feedback. Users providing low ratings (1-3 stars) are redirected to a private feedback form on the ai-chat-bot[.]pro domain, while users providing high ratings (4-5 stars) are sent to the official Chrome Web Store (CWS) review page. This artificially inflates the extension's public rating and violates CWS policy.
A background script directs users to pages hosted on the same suspicious ai-chat-bot[.]pro domain upon extension installation (welcome page) and sets it as the target URL upon uninstallation. This allows the external server to track install/uninstall events.
The code opens a new tab that loads the following page:
This page then sets multiple Yandex tracking cookies without permissions and retrieves browser information from the user.
Even without overtly malicious intent, the observed review manipulation and external transmission of the user’s IP, browser information and associated chat history raise concerns. This grants the website owner access to sensitive user interactions, a potentially serious issue given the increasing data leakage associated with AI productivity tools. The rapid adoption of AI integrations, facilitated by accessible browser extensions, can lead to a gradual erosion of security practices as users develop a false sense of trust. This "out of sight, out of mind" mentality risks exposing sensitive data, such as code, personal searches, and AI chatbot inputs, to malicious third parties who may engage in eavesdropping, data selling, or exploitation.
Looking For More: Domain Registration Patterns
- IP Resolved: 164.90.199[.]205
- IP ISP: DigitalOcean LLC
- Use Yandex Trackers: 99419511 / 99794673 / 99764413
- Registrar: Porkbun LLC
- SSL Issuer: R10 / R11
- NameServer Domain: messagingengine[.]com
- Server Type: Apache/2.4.52 (Ubuntu)
- MX Domain: messagingengine[.]com
 |
Domain: ai-sentence-rewriter[.]com Extension Name: ai-sentence-rewriter Extension ID: ihdnbohcfnegemgomjcpckmpnkdgopon |
 |
pdf-to-jpg[.]app Extension Name: convert-pdf-to-jpg Extension ID: oeefjlikahigmlnplgijgeeecbpemhip |
 |
Domain: htmlvalidator[.]app Extension Name: html-validator Extension ID: aofddmgnidinflambjlfkpboeamdldbd |
 |
Domain: email-checker[.]pro Extension Name: email-checker-verify-emai Extension ID: eheagnmidghfknkcaehacggccfiidhik |
 |
Domain: u99[.]pro Extension Name: link-shortener Extension ID: oliiideaalkijolilhhaibhbjfhbdcnm |
AI Slop
"AI Slop" refers to low-quality, often generic and repetitive content, including text and images, generated by artificial intelligence, indicating a lack of human oversight and effort. In this case, the presence of many uniformly structured websites, each with minimal, repetitive content and duplicated code across their associated browser extensions, may suggest it is the product of AI Slop. The generic stock imagery, boilerplate text, and superficial explanations of extension functionality, align with the definition, indicating a potential reliance on automated AI generation rather than thoughtful development.
A Surge in AI Slop
Continuing our exploration of the digital landscape, we now see a new element stirring the garden: a surge of growth we might call "AI Slop." This refers to the rapidly increasing volume of apps and extensions, often born with the assistance of artificial intelligence, that flood the digital stores without the careful cultivation of thoughtful development, particularly around ethical considerations, privacy and security.
This influx amplifies the transient nature of the deceptive Chrome extensions we've discussed. AI tools can accelerate their creation and deployment, leading to a more rapid cycle of appearance, exploitation, and eventual detection. The digital garden becomes overgrown, making it harder to discern the true blooms from the weeds.
Deceptions and user risks over privacy and security we observe in hand-crafted malicious extensions can be magnified in those influenced by AI Slop. While AI can generate code quickly, it might lack the nuanced understanding of security vulnerabilities or the ethical considerations that human developers often bring. This can result in extensions riddled with unintentional flaws that are nonetheless exploitable, or even intentionally deceptive features woven into the code with algorithmic efficiency.
The "aspirations" of these AI-assisted deceptive extensions might be less about ingenious design and more about sheer volume. The ease with which they can be generated lowers the barrier for malicious actors, potentially leading to a flood of mediocre but still harmful extensions aimed at overwhelming users and security systems alike. The digital storefronts become crowded marketplaces where discerning genuine value from deceptive imitation becomes an increasingly difficult task for the average user.
The human experience is significantly impacted by this AI Slop. Users, already faced with a bewildering array of choices, are now confronted with an even greater volume of extensions and apps, many of them indistinguishable from legitimate options at a glance. The ability to pick the "perfect" extension becomes an exercise in futility, as the sheer quantity dilutes the quality and increases the risk of encountering a deceptive one. This overabundance erodes trust not just in individual extensions and apps, but in the platforms themselves.
The forces of security now face an even greater challenge. The volume and rapid evolution of AI-Slop-driven extensions and apps make detection and mitigation a constant uphill battle. Traditional signature-based approaches struggle to keep pace with the algorithmic generation of new threats. The gardeners of the digital space must now adapt to a landscape where weeds can sprout with unprecedented speed and in overwhelming numbers.
IOCs on GitHub
https://github.com/DomainTools/SecuritySnacks/blob/main/2025/DeceptiveBrowserExtensions-AISlop
If the community has any additional input, please let us know.
Sign Up For DomainTools Investigations’ Newsletter for the Latest Research
Want more from DomainTools Investigations? Be sure to sign up for our monthly newsletter to get the latest research from the team – available on LinkedIn or email.
