CSuite Targets US and EU Organizations with Device-Code Phishing and Remote Access

Domains/URLs

gddfzxa.online

gddfzxa.online

ghs.coorpes.com

greaterheights.sbs

mmswerod.sbs

greenbullet.ba

emsafetoproceedtaward.top

maillive.sbs

arubanetworks-inc.com

sharepointer-dr.com

stubborn-academy.icu

corporate-sync-gate.net

legacy-bridge-node.net

conferenceuniverses.buzz

zerichoproject.org

pdfsecurtoview.sbs

pdfsecurtoview.cfd

pdfsecurtoview.info

pdfsecurtoview365.sbs

pdfsecurtoview365.cfd

pdfsecurtoviewsuite.sbs

pdfsecurtoviewothers.sbs

pdfsecurtoviewothers.cfd

docsendsr.online

docseed.online

docseedn.online

documentsonitustechnologies.sbs

downloaddocumentcontechbuilding.sbs

documentationreviewdocument2026review.sbs

selectivelife01.sbs

pikecac.cfd

qrcoderuser.cfd

fincapitalxcom.cfd

allshore-io.cam

sharerpoint.cam

voicermailsmessager.cam

keepsecurepasserword.cam

giiro.net

expressdocumentdelivery.org

aviationpioneers.info

ambitiousaboutautismorguk.com

solarengyloanfunds.com

checkingweb.net

cellumbio.com

mail.wirsann.com

mail.boratlongyear.com

sqrd.m365.sharedfile.online

sqrd.m36s.sharedfile.tech

shared.file.nn365.cloud

shared.note.nn365.cloud

shared.file.cnrv.tech

file.shared.cnrv.tech

loq.file.cnrv.online

m36nx.file.cnrv.online

file.shared.m36s.site

file.shared.myscript.sbs

usoffweb69.top

netcoxweb.top

coxnetwork.top

doc.lauraice.xyz

docuread.im

docusign.web-viewww.es

https://localcontex.online/AdobecloudReader/pdf_Reader_en_install.msi

https://localcontex.online/review.signal-doc.cloud/.DocuSign/

IP Address

207.189.19.40

185.174.102.34

190.123.46.122

188.127.227.18

141.133.174.208

91.92.41.114

212.189.40.73

155.254.26.180

64.204.180.203

31.57.147.133

31.57.38.60

102.67.5.132

191.101.130.42

102.88.167.38

Hash

ae7af8159f06a059411411e5e816b415e32213371fb085ced1dc5679a0112c48 

b59e7cb539c0b81a58f60d5ca0ed3df62d1856b29076720efbb7dd9411d99eec 

9a03a0b65b2a2d27b348e583237d512a55f3f8287989abf7ffca0285d5f8e43d 

a89a31ec605c0ed9cd263cbdea6ee4a2c6502ec81e5b3e8a3c9fb3de945405f9 

842f0236ea2c2b7773054920e7a870e07869c4e99f84bd31ccfd215781b4f267 

07682ca34a9bf18beb664088e55035a83306b95b31d4aaba242e9d67f8c378a3 

e769b2b4463e7d39320b65a49183ce4ff8c20459fa183e7b03f02e1b44420eb0 

41734f8e6cc75b66f51638b76780f61a0b21ad9f77586e2665b7ab8d7e131936 

eb9274a1fb6064e784f9c0ce95c78007efcadc279d4ffcac13998a45ebf7b49f 

3a8daf4e992ea34b71b259af85d4d12ca52d80b9e2b262bd5aa5922a5a955f9f 

c0eb04dcfa745653c466c34978a1f3b4e5041f526be8c2e46b8c722498ca746a 

74e306072561731adf55afd4de461ec0736ca22c0b458a78e7512b2701341f28 

394d7be5ecbe326062c1de1fb674bdcbb4dbe3ce03b4227994607047b832debd 

c5f7083722fc5bee4e7a7109495348d3731e6b077919a6b679b9f5af885923cd 

fd98c6881cadc47e7d425bbd4b992237a832e69fdfe872a90ba567ed58a148ad 

375e49680fe4b4a62320bdcfd16b7bd75f6223a15d620c475c6988803b67d416 

fdd171cc26704218b0762a33650c0d1246c42cbe583a858684e1b6ac12b9bbe7 

2b89225801591cd223e0cf0b1faa8e7b12e88d6b6bc6ec9f5e715171137553ac 

7b03111fa24ce01054332f013b3fe8189d2b61897e7306666c73b086588a64a5 

0d6b451bd58b904e7dd15ce3e28ea129f7f95c9d248944fbdacdf6fb1d2adc99 

aac51e4016c50a705a26bd56435f0fd9685e53d6bc0cc6034b7370e76d7cb376 

aefd71902453cc83104aa963d8d9051c875d93ddf40680616e8fa5e68565ea69 

6f62a8380eb5038e253772033c0ebc1ddb951a042c4a1a90ba8755819dc74e53 

d995ea6f1621c29cdd4353cfb8b36cd1336b34bc8b180b73ce52cd939060bf0f 

463786717f51b710dbbb013437141e416b98d810dfaa9f4de90a4c4939bc66b9 

90f8e6259ce27592c460d235aff104d7507dfff4e7889c34ab714cdb19944473 

38ba6bfe0cc2b7c5ff38f1f698e2c9bfdb52dd7937111967fddf785ba001e1f2 

a450a84a60ce6646596feb2d6bea4c89a1b5b4e7d6325d5b7c2000982987411c 

b1e55c9679f9aca94d66fdb08195cf8752f69f1d6896a5b2e60d979fca5a4036 

Detection Query 1 :

domainname like "voicermailsmessager.cam" or url like "voicermailsmessager.cam" or siteurl like "voicermailsmessager.cam" or domainname like "pdfsecurtoviewothers.sbs" or url like "pdfsecurtoviewothers.sbs" or siteurl like "pdfsecurtoviewothers.sbs" or domainname like "https://localcontex.online/AdobecloudReader/pdf_Reader_en_install.msi" or url like "https://localcontex.online/AdobecloudReader/pdf_Reader_en_install.msi" or siteurl like "https://localcontex.online/AdobecloudReader/pdf_Reader_en_install.msi" or domainname like "legacy-bridge-node.net" or url like "legacy-bridge-node.net" or siteurl like "legacy-bridge-node.net" or domainname like "usoffweb69.top" or url like "usoffweb69.top" or siteurl like "usoffweb69.top" or domainname like "sharerpoint.cam" or url like "sharerpoint.cam" or siteurl like "sharerpoint.cam" or domainname like "m36nx.file.cnrv.online" or url like "m36nx.file.cnrv.online" or siteurl like "m36nx.file.cnrv.online" or domainname like "coxnetwork.top" or url like "coxnetwork.top" or siteurl like "coxnetwork.top" or domainname like "pdfsecurtoview365.sbs" or url like "pdfsecurtoview365.sbs" or siteurl like "pdfsecurtoview365.sbs" or domainname like "emsafetoproceedtaward.top" or url like "emsafetoproceedtaward.top" or siteurl like "emsafetoproceedtaward.top" or domainname like "greaterheights.sbs" or url like "greaterheights.sbs" or siteurl like "greaterheights.sbs" or domainname like "mail.wirsann.com" or url like "mail.wirsann.com" or siteurl like "mail.wirsann.com" or domainname like "shared.note.nn365.cloud" or url like "shared.note.nn365.cloud" or siteurl like "shared.note.nn365.cloud" or domainname like "pdfsecurtoview.sbs" or url like "pdfsecurtoview.sbs" or siteurl like "pdfsecurtoview.sbs" or domainname like "aviationpioneers.info" or url like "aviationpioneers.info" or siteurl like "aviationpioneers.info" or domainname like "selectivelife01.sbs" or url like "selectivelife01.sbs" or siteurl like "selectivelife01.sbs" or domainname like "qrcoderuser.cfd" or url like "qrcoderuser.cfd" or siteurl like "qrcoderuser.cfd" or domainname like "mail.boratlongyear.com" or url like "mail.boratlongyear.com" or siteurl like "mail.boratlongyear.com" or domainname like "sqrd.m36s.sharedfile.tech" or url like "sqrd.m36s.sharedfile.tech" or siteurl like "sqrd.m36s.sharedfile.tech" or domainname like "shared.file.nn365.cloud" or url like "shared.file.nn365.cloud" or siteurl like "shared.file.nn365.cloud" or domainname like "docusign.web-viewww.es" or url like "docusign.web-viewww.es" or siteurl like "docusign.web-viewww.es" or domainname like "maillive.sbs" or url like "maillive.sbs" or siteurl like "maillive.sbs" or domainname like "arubanetworks-inc.com" or url like "arubanetworks-inc.com" or siteurl like "arubanetworks-inc.com" or domainname like "corporate-sync-gate.net" or url like "corporate-sync-gate.net" or siteurl like "corporate-sync-gate.net" or domainname like "checkingweb.net" or url like "checkingweb.net" or siteurl like "checkingweb.net" or domainname like "pikecac.cfd" or url like "pikecac.cfd" or siteurl like "pikecac.cfd" or domainname like "netcoxweb.top" or url like "netcoxweb.top" or siteurl like "netcoxweb.top" or domainname like "docseedn.online" or url like "docseedn.online" or siteurl like "docseedn.online" or domainname like "fincapitalxcom.cfd" or url like "fincapitalxcom.cfd" or siteurl like "fincapitalxcom.cfd" or domainname like "doc.lauraice.xyz" or url like "doc.lauraice.xyz" or siteurl like "doc.lauraice.xyz" or domainname like "giiro.net" or url like "giiro.net" or siteurl like "giiro.net" or domainname like "conferenceuniverses.buzz" or url like "conferenceuniverses.buzz" or siteurl like "conferenceuniverses.buzz" or domainname like "pdfsecurtoviewothers.cfd" or url like "pdfsecurtoviewothers.cfd" or siteurl like "pdfsecurtoviewothers.cfd" or domainname like "file.shared.cnrv.tech" or url like "file.shared.cnrv.tech" or siteurl like "file.shared.cnrv.tech" or domainname like "shared.file.cnrv.tech" or url like "shared.file.cnrv.tech" or siteurl like "shared.file.cnrv.tech" or domainname like "loq.file.cnrv.online" or url like "loq.file.cnrv.online" or siteurl like "loq.file.cnrv.online" or domainname like "expressdocumentdelivery.org" or url like "expressdocumentdelivery.org" or siteurl like "expressdocumentdelivery.org" or domainname like "docseed.online" or url like "docseed.online" or siteurl like "docseed.online" or domainname like "sqrd.m365.sharedfile.online" or url like "sqrd.m365.sharedfile.online" or siteurl like "sqrd.m365.sharedfile.online" or domainname like "pdfsecurtoviewsuite.sbs" or url like "pdfsecurtoviewsuite.sbs" or siteurl like "pdfsecurtoviewsuite.sbs" or domainname like "documentsonitustechnologies.sbs" or url like "documentsonitustechnologies.sbs" or siteurl like "documentsonitustechnologies.sbs" or domainname like "docsendsr.online" or url like "docsendsr.online" or siteurl like "docsendsr.online" or domainname like "keepsecurepasserword.cam" or url like "keepsecurepasserword.cam" or siteurl like "keepsecurepasserword.cam" or domainname like "greenbullet.ba" or url like "greenbullet.ba" or siteurl like "greenbullet.ba" or domainname like "sharepointer-dr.com" or url like "sharepointer-dr.com" or siteurl like "sharepointer-dr.com" or domainname like "downloaddocumentcontechbuilding.sbs" or url like "downloaddocumentcontechbuilding.sbs" or siteurl like "downloaddocumentcontechbuilding.sbs" or domainname like "zerichoproject.org" or url like "zerichoproject.org" or siteurl like "zerichoproject.org" or domainname like "ghs.coorpes.com" or url like "ghs.coorpes.com" or siteurl like "ghs.coorpes.com" or domainname like "documentationreviewdocument2026review.sbs" or url like "documentationreviewdocument2026review.sbs" or siteurl like "documentationreviewdocument2026review.sbs" or domainname like "solarengyloanfunds.com" or url like "solarengyloanfunds.com" or siteurl like "solarengyloanfunds.com" or domainname like "cellumbio.com" or url like "cellumbio.com" or siteurl like "cellumbio.com" or domainname like "pdfsecurtoview365.cfd" or url like "pdfsecurtoview365.cfd" or siteurl like "pdfsecurtoview365.cfd" or domainname like "allshore-io.cam" or url like "allshore-io.cam" or siteurl like "allshore-io.cam" or domainname like "pdfsecurtoview.cfd" or url like "pdfsecurtoview.cfd" or siteurl like "pdfsecurtoview.cfd" or domainname like "ambitiousaboutautismorguk.com" or url like "ambitiousaboutautismorguk.com" or siteurl like "ambitiousaboutautismorguk.com" or domainname like "file.shared.m36s.site" or url like "file.shared.m36s.site" or siteurl like "file.shared.m36s.site" or domainname like "pdfsecurtoview.info" or url like "pdfsecurtoview.info" or siteurl like "pdfsecurtoview.info" or domainname like "mmswerod.sbs" or url like "mmswerod.sbs" or siteurl like "mmswerod.sbs" or domainname like "docuread.im" or url like "docuread.im" or siteurl like "docuread.im" or domainname like "file.shared.myscript.sbs" or url like "file.shared.myscript.sbs" or siteurl like "file.shared.myscript.sbs" or domainname like "https://localcontex.online/review.signal-doc.cloud/.DocuSign/" or url like "https://localcontex.online/review.signal-doc.cloud/.DocuSign/" or siteurl like "https://localcontex.online/review.signal-doc.cloud/.DocuSign/" or domainname like "stubborn-academy.icu" or url like "stubborn-academy.icu" or siteurl like "stubborn-academy.icu" or domainname like "gddfzxa.online" or url like "gddfzxa.online" or siteurl like "gddfzxa.online"

Detection Query 2 :

dstipaddress IN ("188.127.227.18","64.204.180.203","190.123.46.122","31.57.38.60","207.189.19.40","212.189.40.73","155.254.26.180","141.133.174.208","31.57.147.133","102.67.5.132","185.174.102.34","191.101.130.42","91.92.41.114","102.88.167.38") or srcipaddress IN ("188.127.227.18","64.204.180.203","190.123.46.122","31.57.38.60","207.189.19.40","212.189.40.73","155.254.26.180","141.133.174.208","31.57.147.133","102.67.5.132","185.174.102.34","191.101.130.42","91.92.41.114","102.88.167.38")

Detection Query 3 :

sha256hash IN ("394d7be5ecbe326062c1de1fb674bdcbb4dbe3ce03b4227994607047b832debd","c0eb04dcfa745653c466c34978a1f3b4e5041f526be8c2e46b8c722498ca746a","463786717f51b710dbbb013437141e416b98d810dfaa9f4de90a4c4939bc66b9","a89a31ec605c0ed9cd263cbdea6ee4a2c6502ec81e5b3e8a3c9fb3de945405f9","d995ea6f1621c29cdd4353cfb8b36cd1336b34bc8b180b73ce52cd939060bf0f","aac51e4016c50a705a26bd56435f0fd9685e53d6bc0cc6034b7370e76d7cb376","74e306072561731adf55afd4de461ec0736ca22c0b458a78e7512b2701341f28","ae7af8159f06a059411411e5e816b415e32213371fb085ced1dc5679a0112c48","b59e7cb539c0b81a58f60d5ca0ed3df62d1856b29076720efbb7dd9411d99eec","9a03a0b65b2a2d27b348e583237d512a55f3f8287989abf7ffca0285d5f8e43d","842f0236ea2c2b7773054920e7a870e07869c4e99f84bd31ccfd215781b4f267","07682ca34a9bf18beb664088e55035a83306b95b31d4aaba242e9d67f8c378a3","e769b2b4463e7d39320b65a49183ce4ff8c20459fa183e7b03f02e1b44420eb0","41734f8e6cc75b66f51638b76780f61a0b21ad9f77586e2665b7ab8d7e131936","eb9274a1fb6064e784f9c0ce95c78007efcadc279d4ffcac13998a45ebf7b49f","3a8daf4e992ea34b71b259af85d4d12ca52d80b9e2b262bd5aa5922a5a955f9f","c5f7083722fc5bee4e7a7109495348d3731e6b077919a6b679b9f5af885923cd","fd98c6881cadc47e7d425bbd4b992237a832e69fdfe872a90ba567ed58a148ad","375e49680fe4b4a62320bdcfd16b7bd75f6223a15d620c475c6988803b67d416","fdd171cc26704218b0762a33650c0d1246c42cbe583a858684e1b6ac12b9bbe7","2b89225801591cd223e0cf0b1faa8e7b12e88d6b6bc6ec9f5e715171137553ac","7b03111fa24ce01054332f013b3fe8189d2b61897e7306666c73b086588a64a5","0d6b451bd58b904e7dd15ce3e28ea129f7f95c9d248944fbdacdf6fb1d2adc99","aefd71902453cc83104aa963d8d9051c875d93ddf40680616e8fa5e68565ea69","6f62a8380eb5038e253772033c0ebc1ddb951a042c4a1a90ba8755819dc74e53","90f8e6259ce27592c460d235aff104d7507dfff4e7889c34ab714cdb19944473","38ba6bfe0cc2b7c5ff38f1f698e2c9bfdb52dd7937111967fddf785ba001e1f2","a450a84a60ce6646596feb2d6bea4c89a1b5b4e7d6325d5b7c2000982987411c","b1e55c9679f9aca94d66fdb08195cf8752f69f1d6896a5b2e60d979fca5a4036")