Date: 09/11/2026
Severity: High
Summary
We continue tracking infrastructure potentially linked to Com-affiliated threat actors, including Bling Libra and CL-CRI-1116, using known infrastructure fingerprints. Since August 28, 2026, we identified 17 newly created FQDNs, including domains designed to impersonate known brands. Analysis of subdomains associated with these FQDNs identified organizations that may be targeted through vishing campaigns based on previously observed activity. Potentially targeted sectors include Financial Services, High Technology, IT Services, Non-Profit, Professional & Legal Services, Transportation & Logistics, and Wholesale & Retail.
Indicators of Compromise (IOC) List
Domains/URLs | mailchimp-passkey.com passkey-mailchimp.com sg-passkey.com sso-passkey.com passkey-sendgrid.com sendgridpasskey.com passkeymailchimp.com passkey-mfa.com registermymfa.com signinoptions.com mfa-settings.com installpasskey.com register-passkeys.com deploypasskeys.com mfa-registry.com setupmysso.com register-passkey.com |
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "sendgridpasskey.com" or url like "sendgridpasskey.com" or siteurl like "sendgridpasskey.com" or domainname like "passkey-mailchimp.com" or url like "passkey-mailchimp.com" or siteurl like "passkey-mailchimp.com" or domainname like "passkey-mfa.com" or url like "passkey-mfa.com" or siteurl like "passkey-mfa.com" or domainname like "register-passkey.com" or url like "register-passkey.com" or siteurl like "register-passkey.com" or domainname like "mfa-settings.com" or url like "mfa-settings.com" or siteurl like "mfa-settings.com" or domainname like "mfa-registry.com" or url like "mfa-registry.com" or siteurl like "mfa-registry.com" or domainname like "sso-passkey.com" or url like "sso-passkey.com" or siteurl like "sso-passkey.com" or domainname like "register-passkeys.com" or url like "register-passkeys.com" or siteurl like "register-passkeys.com" or domainname like "registermymfa.com" or url like "registermymfa.com" or siteurl like "registermymfa.com" or domainname like "sg-passkey.com" or url like "sg-passkey.com" or siteurl like "sg-passkey.com" or domainname like "signinoptions.com" or url like "signinoptions.com" or siteurl like "signinoptions.com" or domainname like "deploypasskeys.com" or url like "deploypasskeys.com" or siteurl like "deploypasskeys.com" or domainname like "setupmysso.com" or url like "setupmysso.com" or siteurl like "setupmysso.com" or domainname like "passkeymailchimp.com" or url like "passkeymailchimp.com" or siteurl like "passkeymailchimp.com" or domainname like "installpasskey.com" or url like "installpasskey.com" or siteurl like "installpasskey.com" or domainname like "passkey-sendgrid.com" or url like "passkey-sendgrid.com" or siteurl like "passkey-sendgrid.com" or domainname like "mailchimp-passkey.com" or url like "mailchimp-passkey.com" or siteurl like "mailchimp-passkey.com" |
Reference:
https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-09-09-Newly-Observed-Com-Infrastructure.txt