Loading story…
Security reporting identified enter-press-cdn.info as a high-confidence suspicious domain tied to botnet command-and-control activity, with ThreatFox tagging it as C2 and ErrTraffic and URLScan observing it resolving to 178.16.52.101 and returning direct 403 responses. Investigators said alerts involving the domain do not by themselves prove endpoint compromise, because traffic may stem from blocked browser requests, abused notification permissions, malicious extensions, redirects, service workers, or user execution of a ClickFix-style copied command.
Separate threat-intelligence records classified rinomobile.ink and cosmetic-deals.store as dangerous Botnet C&C infrastructure associated with Trojan.Win64.Agentb and Trojan.Win64.Agent, respectively. Both domains were registered through NameCheap and use Cloudflare name servers, while telemetry linked them to multiple URLs, dozens of IPv4 addresses, and significant hit volumes, reinforcing concerns that newly registered consumer-themed domains are being used for malware operations and should not be allowlisted; defenders were advised to review browser artifacts first and escalate to endpoint investigation if there are signs of execution or persistence.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
The Trojan Killer article states that ThreatFox recorded enter-press-cdn.info as first seen on July 31, 2026. It describes the domain as a high-confidence botnet command-and-control indicator tagged c2 and ErrTraffic and associated with an unknown loader.
WHOIS data in the Kaspersky report states that cosmetic-deals.store was created on 28 March 2026. The report classifies the domain as dangerous and categorizes it as Botnet C&C associated with Trojan.Win64.Agent.
WHOIS data in the Kaspersky report states that rinomobile.ink was created on 28 March 2026. The same report classifies the domain as dangerous and as Botnet C&C associated with Trojan.Win64.Agentb.
The Kaspersky report says the WHOIS record for rinomobile.ink was updated on 27 May 2026. The domain is listed in the report as dangerous Botnet C&C infrastructure.
The Kaspersky report says the WHOIS record for cosmetic-deals.store was updated on 2 April 2026. The domain remained registered through NameCheap and used Cloudflare name servers.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
trojan-killer.net
Open sourceopentip.kaspersky.com
Open sourceopentip.kaspersky.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat intelligence sources identified two malware command-and-control domains tied to separate campaigns. Kaspersky classified `api.aliyung.org` as **dangerous**, labeling it a Botnet C&C associated with **`Trojan.AndroidOS.SparkCat`**; the domain showed roughly 1,000 hits, about 10 related URLs, and 336 linked IPv4 addresses. WHOIS data indicates the parent domain `aliyung.org` was registered through Dynadot and uses Cloudflare name servers, suggesting recently established infrastructure supporting observed malware activity. Cisco Talos separately documented a spear-phishing operation targeting Palestinian entities, especially law enforcement agencies, to deliver the Delphi-based **MICROPSIA** remote access trojan. The campaign used deceptive `.r10` RAR archives with executables disguised as documents and paired them with convincing decoy files, while related drive-by downloads reused the same malware family and infrastructure. Talos said MICROPSIA communicated over HTTP with the C2 domain `camilleoconnell[.]website`, registered infected hosts, gathered system and security-product information through WMI, and could download and execute additional payloads; more than 500 systems appeared to have been registered with the infrastructure.
Jul 3, 2026
Threat researchers reported multiple active campaigns focused on **stealthy malware delivery** by abusing trusted execution paths and deceptive distribution. Trellix described attackers using **DLL side-loading** against a legitimate, signed `ahost.exe` binary associated with the *c-ares* ecosystem (commonly seen with GitKraken Desktop) by placing a malicious `libcares-2.dll` alongside the executable to trigger search-order hijacking and execute attacker code. The activity was linked to delivery of commodity malware families including **Agent Tesla, Formbook, Remcos RAT, Quasar RAT, DCRat, XWorm, Vidar Stealer, Lumma Stealer, CryptBot**, and others, with targeting observed across business functions (finance, procurement, supply chain, administration) and lures in multiple languages, suggesting regionally focused operations. Separately, Malwarebytes documented a **fake RustDesk download site** (`rustdesk[.]work`) that installs legitimate RustDesk while silently deploying a persistent backdoor framework (**Winos4.0**) via a trojanized installer (e.g., `rustdesk-1.4.4-x86_64.exe`), relying on user deception rather than exploiting a software vulnerability. Sucuri detailed a WordPress compromise where attackers modified `index.php` to perform **selective content injection/SEO cloaking**, using IP-verified logic with hardcoded **Google ASN CIDR ranges** to serve malicious content to Googlebot while showing normal content to human visitors and site owners—an evasion technique that can facilitate downstream malware distribution while reducing the chance of detection.
Jun 29, 2026
Breakglass Intelligence identified several active malware delivery operations using signed installers, compromised websites, and live command-and-control infrastructure to distribute loaders, stealers, and remote access tools. One campaign used the newly registered domain `maybedontbanplease[.]com` as CastleLoader C2 on 3NT Solutions LLP infrastructure, with a large NSIS installer embedding Python 3.14, AES-encrypted payloads, and in-memory shellcode execution via `pythonw.exe`; the installer was signed with an EV certificate issued to the likely fictitious entity **SERPENTINE SOLAR LIMITED**. The activity was attributed with medium-high confidence to **GrayBravo** and linked to delivery of **LummaC2, StealC, RedLine, Rhadamanthys, DeerStealer, NetSupport RAT,** and **SectopRAT**, with targeting that included U.S. government, critical infrastructure, IT, and logistics organizations. A separate operation distributed a trojanized `MSTeamsSetup.exe` that installed a weaponized **RustDesk** client and communicated with `mon.systemautoupdater[.]com` on EvoXT infrastructure, while presenting a TLS certificate for `calipology[.]com`, tying the activity to the **GeorgeGinx/Striker** operator. In another live campaign, attackers used the compromised Syrian web development site `allsydevs[.]com` to host an obfuscated .NET loader masquerading as a WordPress image and connected victims to `172[.]93[.]167[.]12:4263` over HTTPS using a self-signed certificate with the fake common name **Mesh Data**; at least six related samples were linked to the same C2, with lure names suggesting targeting of Middle Eastern construction and export firms. Together, the investigations show financially motivated actors expanding malware distribution through fraudulent code-signing, trojanized business software, and hijacked web infrastructure.
Jun 29, 2026