{
  "name": "Unmasking the Infrastructure of a Spear\u2011phishing Campaign",
  "slug": "unmasking-the-infrastructure-of-a-spearphishing-campaign",
  "description": "Censys researchers uncovered a spear\u2011phishing campaign where threat actors leveraged a cluster of 16 open directories hosting heavily obfuscated Visual Basic Script (VBS) files. The study analyzes how attackers set up these public-accessible directories to store malicious scripts, the obfuscation techniques employed, and the infrastructure's lifecycle.",
  "published": "2025-06-11T07:40:24+00:00",
  "created_at": "2025-06-11T07:40:24+00:00",
  "modified_at": "2025-06-11T08:15:51+00:00",
  "created_at_opencti": "2025-06-11T07:40:24+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-06-11",
    "asyncrat",
    "dcrat",
    "limerat",
    "opendir",
    "remcos",
    "spearphishing"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "89.117.77.234"
      },
      {
        "id": "",
        "name": "78.142.18.221"
      },
      {
        "id": "",
        "name": "45.141.233.60"
      },
      {
        "id": "",
        "name": "216.250.253.13"
      },
      {
        "id": "",
        "name": "213.209.150.22"
      },
      {
        "id": "",
        "name": "213.199.55.238"
      },
      {
        "id": "",
        "name": "193.23.3.29"
      },
      {
        "id": "",
        "name": "193.142.146.50"
      },
      {
        "id": "",
        "name": "154.26.154.57"
      },
      {
        "id": "",
        "name": "186.169.80.199"
      },
      {
        "id": "",
        "name": "http://89.117.77.234:2404"
      },
      {
        "id": "",
        "name": "http://78.142.18.221:2401"
      },
      {
        "id": "",
        "name": "http://45.141.233.60:55330"
      },
      {
        "id": "",
        "name": "http://45.133.180.26:3010"
      },
      {
        "id": "",
        "name": "http://216.250.253.13:2404"
      },
      {
        "id": "",
        "name": "http://213.209.150.22:55140"
      },
      {
        "id": "",
        "name": "http://213.199.55.238:5555"
      },
      {
        "id": "",
        "name": "http://193.23.3.29:2404"
      },
      {
        "id": "",
        "name": "http://193.142.146.50:2404"
      },
      {
        "id": "",
        "name": "http://186.169.80.199:1515"
      },
      {
        "id": "",
        "name": "http://154.26.154.57:2404"
      },
      {
        "id": "",
        "name": "trabajonuevos.duckdns.org"
      },
      {
        "id": "",
        "name": "sosten38999.duckdns.org"
      },
      {
        "id": "",
        "name": "romanovas.duckdns.org"
      },
      {
        "id": "",
        "name": "remc21.duckdns.org"
      },
      {
        "id": "",
        "name": "rem25rem.duckdns.org"
      },
      {
        "id": "",
        "name": "purelogs2025.duckdns.org"
      },
      {
        "id": "",
        "name": "gotemburgoxm.duckdns.org"
      },
      {
        "id": "",
        "name": "dgflex.duckdns.org"
      },
      {
        "id": "",
        "name": "dcupdate.duckdns.org"
      },
      {
        "id": "",
        "name": "ed6643adcd866ebe085c51be955c632a8fce08efce99cf87f8a42dcf1e5ef36a"
      },
      {
        "id": "",
        "name": "d5095fc28d9b189698d2feebe96eceb5ee9d31877a0f2ed970356ff079455d73"
      },
      {
        "id": "",
        "name": "d8119df3e735dba78bc6c528f2737d8acb2e87f442596c810afcb5fa85261ad5"
      },
      {
        "id": "",
        "name": "cfb58601339563b1fc1ecf3f9db1ce704e515cad7eacacf69a7e88704646304f"
      },
      {
        "id": "",
        "name": "bf7fd17c0c92daa075224804a037b5940872ac4011f161e49bc0c790bbfa7d43"
      },
      {
        "id": "",
        "name": "bc017dce8d74cef666069fa07d66e3f1ea952d0b1a0e50f51a8cc3b920da0966"
      },
      {
        "id": "",
        "name": "b7d205a1560b07a92d744053744c29823064e2c415a71887fccd8524a3cad3fb"
      },
      {
        "id": "",
        "name": "ad8ff8bba2c5ebc9781993dd7512f904b4acd65337e134951ed47432ceb554a2"
      },
      {
        "id": "",
        "name": "b0ae166bcd563139925f2203f90e31efd0b067cf16fcce390a0e149f57d4c94d"
      },
      {
        "id": "",
        "name": "b07d45eff14b4f083365d736010157724ac0e2f89770aece807fe67fa59ef7ce"
      },
      {
        "id": "",
        "name": "95f61fba6418c812c4c62d0c7ee4c8e5c369fc76e044cab6de3b6ddf787db2ed"
      },
      {
        "id": "",
        "name": "81d75922646f0d7fab2613307117867cba27e9c71c3f57d8ca6627666df709c7"
      },
      {
        "id": "",
        "name": "7dde62518fe19b2e6c8a17b29339e7c11f655da8adfbfc8d1c6d499c967f0a15"
      },
      {
        "id": "",
        "name": "657e021f0dfdd8c628a428a824da278d14d674aefd248f86a58f5bbe4472f0dc"
      },
      {
        "id": "",
        "name": "59339b7d2ca67b55eef533e66eede5cda4b6b62e5823786ef881d387dff902a5"
      },
      {
        "id": "",
        "name": "4ff7dc3005e7c33836c224ef8715ab09280d0d2c4e0c441e19bd59bc3af6b7b9"
      },
      {
        "id": "",
        "name": "4297de28d569560bf2cd287e1a44771ec4f8deac993cb69b54b36fa497af52d3"
      },
      {
        "id": "",
        "name": "474ce68f3ade2dd6a215ea7ae6d5d9fb6a1298bdda55417e9ed58ca8ad143955"
      },
      {
        "id": "",
        "name": "41781819707c4d4b0173d63da71b0c3b7b2ae8794b08c4cc26dc201e1adb5f0f"
      },
      {
        "id": "",
        "name": "319a560130015fa1c53149234321ba5313e5a93f06de6675f5da4a8c2dfa1cf1"
      },
      {
        "id": "",
        "name": "3a98f55acd11e08e9a8090f8955bc51cb7de692c865074f9f5a68de813860df2"
      },
      {
        "id": "",
        "name": "274db7b7ec6f0e233a791b06f00bf82fe570a6869ed7df804e5b3e47006c3763"
      },
      {
        "id": "",
        "name": "147d83d58ba5ab7429dea557c9d5579a609b8d460522a745b841ee22e73c5b33"
      },
      {
        "id": "",
        "name": "06469b3dd05621ecca3f37422c35d29a9225247b518e88788ae5b2d36d6ad765"
      }
    ],
    "malware": [
      {
        "id": "29d292f7-f50d-4c23-900d-035ab7488290",
        "name": "Remcos",
        "slug": "remcos"
      },
      {
        "id": "f652280f-9661-498c-b39b-3032baa01ce4",
        "name": "LimeRAT",
        "slug": "limerat"
      },
      {
        "id": "eb832bdd-0dcb-4866-8f63-4dd299798562",
        "name": "dcrat",
        "slug": "dcrat"
      },
      {
        "id": "f200fb60-5446-493f-9712-9f26d65956cc",
        "name": "AsyncRAT",
        "slug": "asyncrat"
      }
    ],
    "attack_patterns": [
      {
        "id": "9e784d22-5a6c-4da6-968a-5fab2f019efd",
        "name": "T1059.005"
      },
      {
        "id": "16e26db7-7376-40c1-b8a9-23d56c44f7ee",
        "name": "T1571"
      },
      {
        "id": "8e0fea81-4d54-4e88-a7dd-3aa8b26558ed",
        "name": "T1113"
      },
      {
        "id": "5dee2969-7083-430e-9083-73bab54c3a18",
        "name": "T1590"
      },
      {
        "id": "dc410646-9cdd-427b-92e7-179a54f78f90",
        "name": "T1566.001"
      }
    ]
  },
  "external_refs": [
    "https://otx.alienvault.com/pulse/68494f081b7474f8fb19f291"
  ]
}