Essential information

Value / Name

winupdate.ink

Confidence

100/100

Revoked

No

Valid from

03/07/2026 14:13

Valid until

28/11/2026 13:09

Pattern type

stix

Published

06/07/2026 11:30

Modified

06/07/2026 11:30

Author / Source

AlienVault

Description

No description.

Pattern

[domain-name:value = 'winupdate.ink']

Labels / Tags

Labels: aquilarat browser password extraction busysnake stealer credential theft electric power sector go2tunnel government targeting pyarmor obfuscation reverse ssh tunnel spear-phishing

Marking (TLP)

TLP:CLEAR