Cybercriminals Abandon Domains but Keep the Hosting Networks Behind Malware Campaigns

Cybercriminals are rapidly rotating lure domains, cloud storage buckets and command-and-control channels, but one infrastructure component is proving far harder to replace: the bulletproof hosting network that delivers the initial fake verification page.

Five months of monitoring linked four distinct malware delivery chains to AS202412, operated by OMEGATECH LTD, making the ASN not individual domains the most durable blocking point.

The activity illustrates a growing defensive problem. Domains are cheap, disposable and often unnecessary.

Across roughly 150 alerts, researchers confirmed four execution chains that differed sharply in payload delivery, staging and C2 design. One campaign hosted payloads directly in the provider’s address space.

Another loaded a first-stage script from an Amazon S3 bucket. One used conventional domain-based C2, while another retrieved its C2 address from a smart contract through public blockchain RPC infrastructure.

Yet every chain began with a browser reaching infrastructure announced by AS202412. At least seven observed IP addresses, distributed across six separate /24 networks, served fake verification content.

The ASN has also expanded since monitoring began, reportedly announcing 24 /24 prefixes underscoring why static IP blocklists can age badly.

AS202412 is associated with OMEGATECH LTD, while public ASN data also identifies Pfcloud UG in its upstream or origin context.

RIPEstat’s announced-prefixes API can be used to track the live route announcements of an ASN and periodically update controls as address space changes.

The initial-access technique was ClickFix: fake CAPTCHA, Cloudflare or human-verification pages that place a malicious command on the victim’s clipboard and instruct them to press Windows+R, paste it, and execute it.

This approach avoids traditional malicious attachments and can bypass controls that focus on downloaded files or suspicious links.

The victim opens a legitimate Windows utility under their own account, then launches the command themselves. Attackers commonly obscure the malicious part of the command with whitespace or use a benign-looking instruction as the visible text in the Run dialog.

Microsoft has warned that ClickFix campaigns often direct victims to execute commands through the Windows Run dialog, Terminal or PowerShell, and recommends investigating RunMRU entries for signs of PowerShell, mshta, rundll32, wscript, curl and wget abuse.

The technique relies on social engineering rather than a software exploit: a fake verification control silently writes a command to the clipboard, then persuades the user to execute it.

Observed lure domains used predictable naming patterns built around terms such as “auth,” “authorization,” “code,” “verification,” “browser,” “enter” and “cdn.” The operators could burn through one name and activate another with little operational cost.

More importantly, domains were not required at all. In multiple cases, legitimate websites had been compromised and modified to load injected JavaScript from AS202412 infrastructure.

The user remained on a real website with a valid address bar and valid hosting, while the malicious script fetched the ClickFix page or next-stage content remotely.

That defeats conventional URL-blocking logic. A compromised retail, restaurant or contractor website may have no malicious domain to blacklist. The meaningful indicator is the outbound connection to attacker-controlled infrastructure.

Malware Hosting Networks

Blackhills Researchers said that, Attackers can abuse compromised websites, cloud buckets, URL shorteners and blockchain-based command retrieval while retaining a stable hosting provider for the one stage that consistently matters.

One observed PowerShell variant fetched and executed a script directly from a bare IP address. Another used cloud-hosted content, piping a first-stage batch script from an S3 location into cmd.

A network block on the ASN would stop the lure page, but downstream cloud delivery requires separate DNS, web-filtering and endpoint controls.

Advice to check the URL before trusting a page does nothing here. Step two reads “Press Ctrl + V to open Spotlite”, a misspelt macOS concept on a Windows lure: the kit is a template, reused across platforms without anybody proofreading it.

The campaigns also demonstrated why defenders cannot rely solely on domain indicators.

One implant ran Node.js from a user-writable directory and queried blockchain infrastructure to obtain its C2 endpoint, an EtherHiding-style design that removes traditional DNS from the C2 discovery path.

In another chain, attackers used msiexec to retrieve a package remotely, with Unicode characters embedded in command-line switches to undermine brittle string-matching detections.

These behaviors reinforce the need to detect execution patterns, not just malware hashes or specific domains.

High-value signals include browsers spawning command interpreters, PowerShell or curl pipelines launched from Explorer, msiexec retrieving remote URLs, signed runtimes such as Python or Node.js executing from %LOCALAPPDATA%, and a single unsigned DLL appearing beside otherwise vendor-signed files.

The central recommendation is to block AS202412 at the ASN level after validating that no legitimate business dependency uses its currently announced prefixes.

Blocking only known domains leaves defenders chasing an endlessly rotating list; blocking a handful of addresses misses newly added prefixes and attacker failover infrastructure.

Organizations should automate prefix reviews using BGP or RIPEstat data, retain firewall logs rather than silently dropping traffic, and distinguish browser contact from confirmed compromise.

A browser connection may represent an ad-redirect chain or an aborted ClickFix attempt, while non-browser connections, suspicious child processes or activity from user-writable directories warrant immediate escalation.

The user-facing guidance is simpler: no legitimate website needs a visitor to press Windows+R, paste clipboard content into a system prompt, and run it. Closing the page is the correct response not completing the “verification.”

IOCs

Indicator Type	Indicator	Observed Activity
IPv4 Address	178.16.54[.]40	Outbound contact
IPv4 Address	178.16.55[.]232	Outbound contact
IPv4 Address	91.92.241[.]111	Outbound contact
IPv4 Address	158.94.211[.]76	Outbound contact
IPv4 Address	130.12.180[.]63	Lure host reached from an emailed short link
IPv4 Address	130.12.180[.]174	Outbound contact

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC