Cybercriminals Abandon Domains but Keep the Hosting Networks Behind Malware Campaigns

Black Hills monitoring ties four ClickFix malware delivery chains to bulletproof host AS202412 (OMEGATECH LTD), making ASN-level blocking the durable defense.

Five months of monitoring linked four distinct malware delivery chains to bulletproof hosting ASN AS202412, operated by OMEGATECH LTD, which has expanded to announcing 24 /24 prefixes. All chains began with ClickFix fake verification pages that place a malicious command on the clipboard and instruct victims to run it via Windows+R. Downstream stages varied: direct hosting, Amazon S3 bucket staging, domain-based C2, and EtherHiding-style retrieval of C2 addresses from blockchain smart contracts via public RPC. Researchers recommend blocking the ASN and automating prefix tracking with RIPEstat data, since domains rotate constantly or are unnecessary when compromised legitimate sites inject the lure.