Campaign · active
Repeated static TTP
Correlated evidence: js_obfuscated_fetch_exec:hex-decoded literal + network fetch + child-process exec — staged obfuscated-loader / dropper (hides the c2 url from literal-url detection).
25 releases259 max score90 confidence
Member releases
Timeline
| Date (UTC) | Event |
|---|---|
| 2026-06-20 | expanded_campaign |
| 2026-06-20 | expanded_campaign |
| 2026-06-20 | expanded_campaign |
| 2026-06-20 | expanded_campaign |
| 2026-06-20 | expanded_campaign |
| 2026-06-20 | expanded_campaign |
| 2026-06-20 | expanded_campaign |
| 2026-06-20 | expanded_campaign |
| 2026-06-20 | expanded_campaign |
| 2026-06-20 | expanded_campaign |
| 2026-06-20 | expanded_campaign |
| 2026-06-20 | expanded_campaign |
| 2026-06-20 | expanded_campaign |
| 2026-06-20 | expanded_campaign |
| 2026-06-20 | expanded_campaign |
| 2026-06-20 | new_campaign |