Trusted Design

Still Circling: Inside the Operator Behind the GitHub Loader

概要

An investigation into malware delivery infrastructure reveals an operator using GitHub repositories to stage malicious loaders and RAT payloads. Starting from commit metadata, researchers traced an email address to a compromised machine via stealer log databases. The infected workstation exposed a complete operational pipeline including multiple RAT families (AsyncRAT, DcRat, Remcos, XWorm), phishing templates impersonating Colombian government institutions, bulk email software, and commercial crypter services. The operator maintains delivery infrastructure across GitHub, Bitbucket, AWS S3, and DuckDNS for command-and-control. Phishing campaigns target Colombian organizations using judicial notification and traffic violation lures with password-protected archives. The investigation demonstrates how infrastructure analysis and operational security failures can expose entire malware production workflows beyond individual samples.

Created: 2026-08-31

Indicators

• domain - simpmit.co -
• URL - http://creainovada.xyz/instructions/Wscript.txt -
• hostname - dccomicrat81.duckdns.org -
• URL - http://creainovada.xyz/instructions/ -
• domain - data-encoder.com -
• IPv4 - 64.89.160.17 -
• domain - creainovada.xyz -
• URL - https://simpmit.co/ -
• domain - config.data -
• domain - consultanotificacionesjuridicas.site -

類似Pulses

類似するPulseは見つかりませんでした。

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る