Threat actor

ChenLun

0 mentions in 7 days · 2 in 30 days · 2 total · first seen Sep 3, 2026 · last 12d ago

Timeline2 articles

ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories

Microsoft warns of Teams IT-impersonation intrusions deploying Node.js implants; Spring Ring vishing hit 150+ employees across 10 companies; The Gentlemen ransomware claims 683 victims.

Microsoft warned of a human-operated campaign abusing Teams external collaboration to impersonate IT help desk staff, deploy malicious MSI packages staging Node.js runtimes and obfuscated JavaScript implants, then pivot to domain controllers over WinRM. Unit 42 documented the Spring Ring vishing operation targeting over 150 employees across at least 10 companies using 26 attacker identities, including an NTLM relay variant against domain controllers. Sophos reported The Gentlemen ransomware (Gold Sherwood) reached 683 total victims by end of July 2026, adding 169 in July, with a playbook using BYOVD-based EDR killers and backup tampering. Group-IB found the Outsider phishing-as-a-service platform created 700+ new phishing pages within a month despite law enforcement takedowns.

The Hacker NewsSep 3, 18:02 UTC · 12d agoThreat actor in the wild1

Outsider Phishing Kit Survives Takedown With 700 New Pages

Group-IB found the Outsider phishing kit kept generating 700+ new phishing pages within a month of Operation Ghost Hook's takedown.

Group-IB linked the Outsider Phishing Kit, operated by a threat actor known as ChenLun, to more than 100,000 phishing pages across 54+ countries between December 2025 and May 2026. After the FBI, Google, and Lumen's Black Lotus Labs seized core admin servers, a Shopify storefront, about $100,000, and thousands of domains under Operation Ghost Hook in June, over 700 new phishing domains appeared within a month. The kit offered 267 templates, adversary-in-the-middle MFA interception, WebSocket-based live operator communication, and SMS delivery via a Telegram affiliate ecosystem with more than 5,000 subscribers.

Infosecurity MagazineSep 3, 14:00 UTC · 12d agoPhishing & fraud in the wild1

Appears with

vendor Group-IB 2 threat actor Spring Ring 1 threat actor The Gentlemen 1 malware BlueKit 1 malware The Outsider 1 organization FBI 1 organization iZOOlogic 1 organization Operation Ghost Hook 1 organization ZeroBEC 1 product Black Lotus Labs 1 product Microsoft Teams 1 product Node.js 1 product Outsider Phishing Kit 1 product ScreenConnect 1 vendor Google 1 vendor Lumen 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.