Mirrors/cert-orangecyberdefense-cti
1
0
Fork 0
mirror of https://github.com/cert-orangecyberdefense/cti synced 2026-06-11 07:51:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

Create readme

Browse Source
This commit is contained in:
Mar-Pic
2026-03-25 14:43:28 +01:00
committed by GitHub
parent 11b4117f51
commit 0e95328841
1 changed files with 24 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cancoillotte/readme
+24
View File
@@ -0,0 +1,24 @@
Orange Cyberdefense CERT is observing since early 2026 an ongoing malvertising campaign leading to ScreenConnect RMM.
We track this cluster as Cancoillotte.
Delivery infrastructure consist of domains spoofing:
- AntiMicroX
- Bandicam
- CPU-Z
- CrystalDiskMark
- Defender Control
- DNS Jumper
- DS4Windows
- Ferdium
- GOM Player
- mGBA
- Process Hacker
- SteamTools
- tModLoader
Such domains are often hosted on 2[.]59.134.97 (ASN 58212 - Dataforest Gmbh)
Clicking on "Download" fetches a ZIP archive containing a ScreenConnect binary, from direct-download.giize[.]com.
Most of the ScreenConnect C2 we observed are hosted on ASN 58212 as well:
185[.]254.97.249
176[.]96.137.225