CSIRT Central Asia

⚠️ Important Note: home[.]kg 🇰🇬 is a public FreeDNS zone hosted on afraid.org, allowing anyone to freely create subdomains. The presence of the .kg TLD does NOT imply that #Kyrgyzstan is the intended target of this campaign.

🎯 Target of the Attack: This campaign specifically targets developers. The subdomain vscode.auth.home[.]kg was crafted to mimic a legitimate Visual Studio Code OAuth redirect URI. Threat actors utilize these malicious domains to harvest authentication tokens.

🌐 Current Resolutions: auth.home[.]kg 🇰🇬 • IP Address: 80.68.237.36 • Location / ISP: Poland 🇵🇱 vscode.auth.home[.]kg 🇰🇬 • IP Address: 153.75.247.209 • Location / ISP: USA 🇺🇸, Interserver (VPS)

🚨 Suspicious domains detected in the home[.]kg zone 🇰🇬 Domains: 🔹 auth.home[.]kg 🇰🇬 🔹 vscode.auth.home[.]kg 🇰🇬 Both domains are flagged in Maltrail (apt_kimsuky.txt) and are linked to infrastructure attributed by OSINT sources to #Kimsuky / #APT43 / Emerald Sleet.