Signed Malware Installers and Live C2 Infrastructure Fuel Multiple Loader Campaigns

Breakglass Intelligence identified several active malware delivery operations using signed installers, compromised websites, and live command-and-control infrastructure to distribute loaders, stealers, and remote access tools. One campaign used the newly registered domain maybedontbanplease[.]com as CastleLoader C2 on 3NT Solutions LLP infrastructure, with a large NSIS installer embedding Python 3.14, AES-encrypted payloads, and in-memory shellcode execution via pythonw.exe; the installer was signed with an EV certificate issued to the likely fictitious entity SERPENTINE SOLAR LIMITED. The activity was attributed with medium-high confidence to GrayBravo and linked to delivery of LummaC2, StealC, RedLine, Rhadamanthys, DeerStealer, NetSupport RAT, and SectopRAT, with targeting that included U.S. government, critical infrastructure, IT, and logistics organizations.

A separate operation distributed a trojanized MSTeamsSetup.exe that installed a weaponized RustDesk client and communicated with mon.systemautoupdater[.]com on EvoXT infrastructure, while presenting a TLS certificate for calipology[.]com, tying the activity to the GeorgeGinx/Striker operator. In another live campaign, attackers used the compromised Syrian web development site allsydevs[.]com to host an obfuscated .NET loader masquerading as a WordPress image and connected victims to 172[.]93[.]167[.]12:4263 over HTTPS using a self-signed certificate with the fake common name Mesh Data; at least six related samples were linked to the same C2, with lure names suggesting targeting of Middle Eastern construction and export firms. Together, the investigations show financially motivated actors expanding malware distribution through fraudulent code-signing, trojanized business software, and hijacked web infrastructure.