Szabolcs Schmidt

FUD 'output.jar' seen from Türkiye @abuse_ch bazaar.abuse.ch/sample/c2fc241…

'Social Security Statement zip' seen from Ukraine @abuse_ch bazaar.abuse.ch/sample/41ac362…

'ID466943.msi' @abuse_ch bazaar.abuse.ch/sample/a47e362… Domain: freegaten(.)com - FUD IP: 144.31.0(.)81 - 1 detection

'plugins zip' @abuse_ch bazaar.abuse.ch/sample/aeb6c84…

@kukuricidius @Dixit_404 @skocherhan @500mk500 @malwrhunterteam Yepp, that's why I stopped markin' it as Gamaredon. Could be 4-5 different group.

@Dixit_404 @smica83 @skocherhan @500mk500 @malwrhunterteam I'm almost certain that it isn't Gamaredon but some other TA. Don't know which one, though.

Seems like #Gamaredon #APT, Targeting military personnel of Ukrainian . RAR: 718465f44c0680740fb61790eda3d2f4c5218c9de0c560299c580fa1602dc9c7 LNK: 1c170b7470d507378ddb78e9d66305f1184e965baaf2d27ededb23a318a58953 @smica83 @skocherhan @500mk500 @malwrhunterteam

'OECD_Update_on_implications_for_energy_markets_of_events_in_the_Middle_East zip' seen from Romania @abuse_ch Looks like #PlugX related. bazaar.abuse.ch/sample/bcd30f2…

'ru1.hta' seen from Germany @abuse_ch bazaar.abuse.ch/sample/2c7a99f… Source from: hxxps://zynaris(.)io/ru1.hta

'Судова_повістка_2_17_8_1906_18.03.2026.rar' seen from Poland @abuse_ch bazaar.abuse.ch/sample/116172d… CVE-2025-8088

Two related EXE files uploaded and tagged @abuse_ch bazaar.abuse.ch/browse/tag/185…

'wishlist87231.bat' seen from China @abuse_ch bazaar.abuse.ch/sample/2828d90… 0 AV and 1 Thor @nextronresearch

'IqtisodiyUZ.jar' seen from Uzbekistan @abuse_ch bazaar.abuse.ch/sample/2de3804…

AKT_ROZSLIDUVANNIA.pdf.lnk' seen from Ukraine again @abuse_ch bazaar.abuse.ch/sample/6b3ce22… Same IP: 151.243.109(.)239

'Dodatok_1_do_zapytu.xlsx.lnk' seen from Ukraine @abuse_ch bazaar.abuse.ch/sample/16b8310… IP: 151.243.109(.)239 @500mk500

'scvhost.dll' seen from Israel @abuse_ch bazaar.abuse.ch/sample/b1317e7… @k3yp0d C2: 144.31.107(.)20:8080 URL: hxxps://pastebin(.)com/raw/R1kQJiUY

hxxps://textbook-alternatives-theta-hydrogen.trycloudflare(.)com/ #WsgiDAV #opendir

'Kfailin.msi' seen from China @abuse_ch bazaar.abuse.ch/sample/e2ef852… C2 domain FUD: fachuoi(.)com IP it resolved to FUD: 43.128.42(.)125

'Raiffeisenbank.tgz' seen from Hungary and Russia @abuse_ch bazaar.abuse.ch/sample/dbd974f…

Two related samples are uploaded @abuse_ch bazaar.abuse.ch/browse/tag/46-…