Dark Scepter

Dark Scepter is a recently identified Iranian-aligned threat actor described as overlapping with APT34/OilRig. The reporting ties the actor to infrastructure-level overlap with Dust Specter, including shared or overlapping domains such as lecturegenieltd[.]pro and girlsbags[.]shop, suggesting either shared infrastructure management or a common provisioning parent. Dark Scepter is reported to use Cloudflare to proxy command-and-control infrastructure and obscure origin IP addresses. Hunt.io infrastructure analysis identified Dark Scepter by pivoting on certificate subject alternative names and reused webpage titles; pivoting on certificate hostnames for web14[.]info identified backend infrastructure at 38.180.239[.]161 hosted by M247 Europe SRL. Associated domains directly listed in the reporting include anythingshere[.]shop, cside[.]site, footballfans[.]asia, menclub[.]it, musiclivetrack[.]website, stone110[.]store, and web14[.]info. No additional high-confidence victimology, malware families, or sub-groups were directly provided in the content.