Trusted Design

Ransomware(Locky?) Spam campagin

概要

We have received a pile of spam lately that has the following links in it, and they all redirect to https://n3plcpnl0058.prod.ams3.secureserver.net:2083. I believe it to be a Locky variant, our firewall initially caught it as JS/Ransom.AP. I have reported the sites to godaddy as they seem to host them all. The 404testpage and 404javascript seem like old wordpress/joomla redirectors. I did some more research in it today after a week off we had another today with a new final redirect server, 0053 at secureserver.net instead of 0056. The address 160.153.129.36 shows up at scumware.org with 91 hits, mostly of the same design, random url, First_Last of "From" on email, and all redirected via the 404 redirect to the malware. Previously they were using the 160.153.129.34 address, and it has another 81 hits. 160.153.129.35 has 58. I continued getting hits from 160.153.129.33 up to 160.153.129.40 that all look this same way.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

Ransomware - Redirects and File (score: 0.66)
WordPress Compromise Campaign (score: 0.62)
Thousands of compromised WordPress websites redirect to exploit kits (score: 0.62)
Locky Ransomware Download URL (score: 0.61)
Compromised Wordpress sites serving multiple malware payloads (score: 0.61)

このPulseに関連する脅威アクター (事実ベース)

Turla

Score: 4.78

Matched TTPs:

T1059.007 - JavaScript
T1566.002 - Spearphishing Link
T1204.001 - Malicious Link

MITREへのリンク →

APT32

Score: 11.08

Matched TTPs:

T1059.007 - JavaScript
T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1550.003 - Pass the Ticket
T1204.001 - Malicious Link

MITREへのリンク →

Saint Bear

Score: 3.33

Matched TTPs:

T1059.007 - JavaScript
T1204.001 - Malicious Link

MITREへのリンク →

Sidewinder

Score: 7.24

Matched TTPs:

T1059.007 - JavaScript
T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1204.001 - Malicious Link

MITREへのリンク →

MuddyWater

Score: 4.78

Matched TTPs:

T1059.007 - JavaScript
T1566.002 - Spearphishing Link
T1204.001 - Malicious Link

MITREへのリンク →

Earth Lusca

Score: 4.78

Matched TTPs:

T1059.007 - JavaScript
T1566.002 - Spearphishing Link
T1204.001 - Malicious Link

MITREへのリンク →

TA577

Score: 4.78

Matched TTPs:

T1059.007 - JavaScript
T1566.002 - Spearphishing Link
T1204.001 - Malicious Link

MITREへのリンク →

Winter Vivern

Score: 3.33

Matched TTPs:

T1059.007 - JavaScript
T1204.001 - Malicious Link

MITREへのリンク →

Contagious Interview

Score: 3.33

Matched TTPs:

T1059.007 - JavaScript
T1204.001 - Malicious Link

MITREへのリンク →

LazyScripter

Score: 4.78

Matched TTPs:

T1059.007 - JavaScript
T1566.002 - Spearphishing Link
T1204.001 - Malicious Link

MITREへのリンク →

TA505

Score: 4.78

Matched TTPs:

T1059.007 - JavaScript
T1566.002 - Spearphishing Link
T1204.001 - Malicious Link

MITREへのリンク →

FIN7

Score: 4.78

Matched TTPs:

T1059.007 - JavaScript
T1566.002 - Spearphishing Link
T1204.001 - Malicious Link

MITREへのリンク →

Cobalt Group

Score: 4.78

Matched TTPs:

T1059.007 - JavaScript
T1566.002 - Spearphishing Link
T1204.001 - Malicious Link

MITREへのリンク →

Kimsuky

Score: 7.24

Matched TTPs:

T1059.007 - JavaScript
T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1204.001 - Malicious Link

MITREへのリンク →

Molerats

Score: 4.78

Matched TTPs:

T1059.007 - JavaScript
T1566.002 - Spearphishing Link
T1204.001 - Malicious Link

MITREへのリンク →

Mustang Panda

Score: 11.37

Matched TTPs:

T1059.007 - JavaScript
T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1027.007 - Dynamic API Resolution
T1204.001 - Malicious Link

MITREへのリンク →

TA578

Score: 3.33

Matched TTPs:

T1059.007 - JavaScript
T1204.001 - Malicious Link

MITREへのリンク →

Evilnum

Score: 4.78

Matched TTPs:

T1059.007 - JavaScript
T1566.002 - Spearphishing Link
T1204.001 - Malicious Link

MITREへのリンク →

Star Blizzard

Score: 4.43

Matched TTPs:

T1059.007 - JavaScript
T1598.003 - Spearphishing Link

MITREへのリンク →

Mustard Tempest

Score: 7.34

Matched TTPs:

T1566.002 - Spearphishing Link
T1608.006 - SEO Poisoning
T1204.001 - Malicious Link

MITREへのリンク →

Sandworm Team

Score: 5.27

Matched TTPs:

T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1204.001 - Malicious Link

MITREへのリンク →

Lazarus Group

Score: 5.58

Matched TTPs:

T1566.002 - Spearphishing Link
T1027.007 - Dynamic API Resolution

MITREへのリンク →

ZIRCONIUM

Score: 5.27

Matched TTPs:

T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1204.001 - Malicious Link

MITREへのリンク →

Magic Hound

Score: 5.27

Matched TTPs:

T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1204.001 - Malicious Link

MITREへのリンク →

OilRig

Score: 7.34

Matched TTPs:

T1566.002 - Spearphishing Link
T1137.004 - Outlook Home Page
T1204.001 - Malicious Link

MITREへのリンク →

APT29

Score: 11.19

Matched TTPs:

T1566.002 - Spearphishing Link
T1550.003 - Pass the Ticket
T1090.004 - Domain Fronting
T1204.001 - Malicious Link

MITREへのリンク →

Patchwork

Score: 5.27

Matched TTPs:

T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1204.001 - Malicious Link

MITREへのリンク →

APT28

Score: 12.89

Matched TTPs:

T1598.003 - Spearphishing Link
T1498 - Network Denial of Service
T1137.002 - Office Test
T1204.001 - Malicious Link

MITREへのリンク →

BRONZE BUTLER

Score: 3.84

Matched TTPs:

T1550.003 - Pass the Ticket

MITREへのリンク →

APT38

Score: 5.90

Matched TTPs:

T1562.013 - Disable or Modify Network Device Firewall
T1204.001 - Malicious Link

MITREへのリンク →

Gamaredon Group

Score: 5.90

Matched TTPs:

T1001 - Data Obfuscation
T1204.001 - Malicious Link

MITREへのリンク →

Equation

Score: 4.13

Matched TTPs:

T1564.005 - Hidden File System

MITREへのリンク →

Strider

Score: 4.13

Matched TTPs:

T1564.005 - Hidden File System

MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

APT28

Score: 0.83

Matched TTPs:

T1204.001 - Malicious Link
T1137.002 - Office Test
T1498 - Network Denial of Service
T1598.003 - Spearphishing Link

MITREへのリンク →

APT29

Score: 0.72

Matched TTPs:

T1090.004 - Domain Fronting
T1550.003 - Pass the Ticket
T1204.001 - Malicious Link
T1566.002 - Spearphishing Link

MITREへのリンク →

APT32

Score: 0.72

Matched TTPs:

T1059.007 - JavaScript
T1550.003 - Pass the Ticket
T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1204.001 - Malicious Link

MITREへのリンク →

Mustang Panda

Score: 0.69

Matched TTPs:

T1059.007 - JavaScript
T1027.007 - Dynamic API Resolution
T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1204.001 - Malicious Link

MITREへのリンク →

Mustard Tempest

Score: 0.55

Matched TTPs:

T1204.001 - Malicious Link
T1566.002 - Spearphishing Link
T1608.006 - SEO Poisoning

MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクターグラフ

← Pulse一覧に戻る