Hey cuties! After today's gay brunch we have some fresh tea to spill. Meet threat cluster GAY-0001. A cluster we've been tracking since ~2026-10 and are now ready to share. Happy Hunting 💋

Live Infra:

IPs:
182[.]16[.]98[.]83
182[.]16[.]98[.]86
119[.]42[.]148[.]187
182[.]16[.]98[.]90
182[.]16[.]98[.]92
182[.]16[.]98[.]87
182[.]16[.]98[.]82
182[.]16[.]98[.]93
182[.]16[.]98[.]91
182[.]16[.]98[.]94
119[.]42[.]148[.]190
182[.]16[.]98[.]88
182[.]16[.]98[.]85
119[.]42[.]148[.]189
119[.]42[.]148[.]186
182[.]16[.]98[.]89
182[.]16[.]98[.]84

Domains / Certs:
mstsc[.]microsoft365guide[.]com
microsoft365guide[.]com
gateway[.]bliln[.]com
bliln[.]com
micriosoft[.]net

Hunt Fingerprints:

TLS Fingerprint: c7a0e64bbcf3cdf10423ad4a7f640426bcdc6eb6fff5d902e62ed41c82fcd53d

TLS Serial Number:
1790971977

Malware + C2s Used:
VShell
Reverse_SSH

Former members:
Address From To
119[.]42[.]148[.]187 10-04 10-11
182[.]16[.]98[.]82 10-04 10-11
182[.]16[.]98[.]92 10-04 10-11
119[.]42[.]148[.]186 10-04 10-11
119[.]42[.]148[.]189 10-04 10-11
119[.]42[.]148[.]190 10-04 10-11
182[.]16[.]98[.]83 10-04 10-11
182[.]16[.]98[.]84 10-04 10-11
182[.]16[.]98[.]85 10-04 10-11
182[.]16[.]98[.]86 10-04 10-11
182[.]16[.]98[.]87 10-04 10-11
182[.]16[.]98[.]88 10-04 10-11
182[.]16[.]98[.]89 10-04 10-11
182[.]16[.]98[.]90 10-04 10-11
182[.]16[.]98[.]91 10-04 10-11
182[.]16[.]98[.]93 10-04 10-11
182[.]16[.]98[.]94 10-04 10-11

#GAYINT #ThreatIntel