The Domains Keep Disappearing, but the Malware Infrastructure Behind Them Never Moves
ActiveSOC found fake-CAPTCHA malware lures rotating domains while Seychelles hosting infrastructure stayed put.
Over five months ActiveSOC tracked four attack chains that began on the same Seychelles-registered hosting network, AS202412, while lure domains, downloads, and command servers changed. Most victims reached fake CAPTCHA pages through ads, and one arrived via an emailed link; the pages copied a command for the Windows Run dialog. Reviewing about 150 alerts, analysts found four cases reached command execution, including a reboot-persistent stealer and a Node.js implant active for nearly two days. One implant retrieved its command server through a blockchain lookup rather than a conventional domain.
62