Once in a Blue Moon: State-Linked Actors Adopt Chrome & Windows Zero-Days

Domain/URLs

secboxes.com

msbenefit.com

attcdn.com

recommendation-letter.secboxes.com

asianstudies.secboxes.com

materials-project.secboxes.com

project.secboxes.com

evidence.msbenefit.com

data.attcdn.com

https://project.secboxes.com/ChromeUpdate.exe

https://recommendation-letter.secboxes.com/ChromeUpdate.exe

https://download.secboxes.com:443/dist.zip

https://api-prod.secboxes.com:443/download

https://evidence.msbenefit.com/msgbox.exe

https://zki0y83.msbenefit.com:443/feed

extension-management-portal.centerfjdr658.workers.dev

extension-management-portal.kmjukilo-lkjh.workers.dev

airproducts.ink

precipart.ink

epsilonsystems.net

rocketlabusa.ink

spectrolab.fit

ms.checrity.com

checrity.com

aurexdefense.online

cyclokinetics.online

sncorp.fit

tcomlp.online

bosch-sensortec.site

smxtech.xyz

lindes.ink

silvustechnologies.online

worldview.fit

emcore.ink

airindia.fit

airliquide.lol

apollohospitals.fit

haloengines.net

jetoptera.co

yhv41nji.workers.dev

wcce.joinmacket.com

joinmacket.com

openlumakora.com

publish.openlumakora.com

eduac.workers.dev

daoahueb.workers.dev

https://app.eduac.workers.dev/Service

https://app.eduac.workers.dev/Updateac

https://small-union-7018.daoahueb.workers.dev/

https://snowy-block-ae0a.daoahueb.workers.dev/

getaiexo.com

elixnovorem.com

velodynaity.com

dns.elixnovorem.com

dns.getaiexo.com

dns. velodynaity.com

v93xdd5g.workers.dev

black-flower-9250.v93xdd5g.workers.dev

mailtbox.workers.dev

vncdc.mailtbox.workers.dev

brianwilli.com

homepage.brianwilli.com

1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com

fracons.com

https://homepage.brianwilli.com/d/calibre-launcher.dll

https://homepage.brianwilli.com/d/wint.exe

https://homepage.brianwilli.com/d/85rY.dat

https://homepage.brianwilli.com/d/SysPr.prx

1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com

https://1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com/datago/krita.exe

https://1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com/datago/krita.dll

https://1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com/datago/SysPr.prx

IP Address

79.133.56.90

Hash

779b3e1a470e589d492b99154ba11622fbaebb19b3de694f660c725411b7096d

ff1b49aaec994f4c11f2c9331e739abb4bc3d6abf66ec50ce99709fba35d782b

7d6f6dcb17a423bdd7715f8a4e34f2939501a761bc9bf7aa005f805ef1f82288

e950d03c58d49e28e31df8afeefca1f3b3d2cd6b697c40adfee1a4f6fe18f004

353b5bd2780c1b0c07c1283d83cf16cf1e9ec226c17b2d09d56848893f9d98ee

a4a6a04d85eca8d584d939d2437c85a4f291207d8042f2ec002838e336b72ef5

295fc584f75e94108c9be945977db33ed80421f5d374eab188587c911dffd915

Bc7d24f5cf8937b334966201bdcce8ca9bab6ec5889d40a399d4094dcad73360

b34802a646fc4a8f07ffa09a5fda8bf7327446b22e3d7bb5163dafa1e2a8bb2b

8453c42904b7b2fea5671b7bff06b2d937632ae29545fd11bc13095627a2805f

f3c64014221a58f3fde88e562662dbd5a1b3dd2b59c86e9e2bc5cb8f671664e7

87b6b24c06f99900a8aa579caedee1e402015884c925a98dcfb0fb38dfa2de22

ac6bbc4b1f1c62e308781329183a46e18f454c27e66bffa09f343b53ac622b69

ac6806c89e294f390838cb07c015dabec1c8ada06ce5161a0ad50b8a72828141

3594ad58fb6217fafe9839e53999a90608c2e9f335fa20aece3d53f8c0802726

3ec3151d8d1278ed966941ac89ea495ef6a80c70613dd9138cc85fc28c9df432

6e6378d8d404166da89d982e80bc52e19a3f677201258dec1775f100a027a92d

Email Address

zfg.rc.420@gmail.com

laylowthiago@gmail.com

susan.thomas.90@outlook.com

mariedubois1917@outlook.com

reallifetalktv2@gmail.com

faizus123@outlook.com

firda.kemkes@outlook.com

faizus123@proton.me

dewiinpermata@outlook.com

radhikadas07@outlook.com

jeannifer.suryajaya@outlook.com

siti.nurhaliza2026@outlook.com

ditjenpajakri2026@outlook.com

Detection Query 1 :

domainname like "getaiexo.com" or url like "getaiexo.com" or siteurl like "getaiexo.com" or domainname like "https://snowy-block-ae0a.daoahueb.workers.dev/" or url like "https://snowy-block-ae0a.daoahueb.workers.dev/" or siteurl like "https://snowy-block-ae0a.daoahueb.workers.dev/" or domainname like "data.attcdn.com" or url like "data.attcdn.com" or siteurl like "data.attcdn.com" or domainname like "recommendation-letter.secboxes.com" or url like "recommendation-letter.secboxes.com" or siteurl like "recommendation-letter.secboxes.com" or domainname like "daoahueb.workers.dev" or url like "daoahueb.workers.dev" or siteurl like "daoahueb.workers.dev" or domainname like "tcomlp.online" or url like "tcomlp.online" or siteurl like "tcomlp.online" or domainname like "lindes.ink" or url like "lindes.ink" or siteurl like "lindes.ink" or domainname like "wcce.joinmacket.com" or url like "wcce.joinmacket.com" or siteurl like "wcce.joinmacket.com" or domainname like "publish.openlumakora.com" or url like "publish.openlumakora.com" or siteurl like "publish.openlumakora.com" or domainname like "epsilonsystems.net" or url like "epsilonsystems.net" or siteurl like "epsilonsystems.net" or domainname like "https://download.secboxes.com:443/dist.zip" or url like "https://download.secboxes.com:443/dist.zip" or siteurl like "https://download.secboxes.com:443/dist.zip" or domainname like "https://evidence.msbenefit.com/msgbox.exe" or url like "https://evidence.msbenefit.com/msgbox.exe" or siteurl like "https://evidence.msbenefit.com/msgbox.exe" or domainname like "sncorp.fit" or url like "sncorp.fit" or siteurl like "sncorp.fit" or domainname like "https://homepage.brianwilli.com/d/calibre-launcher.dll" or url like "https://homepage.brianwilli.com/d/calibre-launcher.dll" or siteurl like "https://homepage.brianwilli.com/d/calibre-launcher.dll" or domainname like "rocketlabusa.ink" or url like "rocketlabusa.ink" or siteurl like "rocketlabusa.ink" or domainname like "secboxes.com" or url like "secboxes.com" or siteurl like "secboxes.com" or domainname like "smxtech.xyz" or url like "smxtech.xyz" or siteurl like "smxtech.xyz" or domainname like "velodynaity.com" or url like "velodynaity.com" or siteurl like "velodynaity.com" or domainname like "homepage.brianwilli.com" or url like "homepage.brianwilli.com" or siteurl like "homepage.brianwilli.com" or domainname like "https://recommendation-letter.secboxes.com/ChromeUpdate.exe" or url like "https://recommendation-letter.secboxes.com/ChromeUpdate.exe" or siteurl like "https://recommendation-letter.secboxes.com/ChromeUpdate.exe" or domainname like "worldview.fit" or url like "worldview.fit" or siteurl like "worldview.fit" or domainname like "yhv41nji.workers.dev" or url like "yhv41nji.workers.dev" or siteurl like "yhv41nji.workers.dev" or domainname like "attcdn.com" or url like "attcdn.com" or siteurl like "attcdn.com" or domainname like "1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com" or url like "1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com" or siteurl like "1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com" or domainname like "black-flower-9250.v93xdd5g.workers.dev" or url like "black-flower-9250.v93xdd5g.workers.dev" or siteurl like "black-flower-9250.v93xdd5g.workers.dev" or domainname like "precipart.ink" or url like "precipart.ink" or siteurl like "precipart.ink" or domainname like "https://small-union-7018.daoahueb.workers.dev/" or url like "https://small-union-7018.daoahueb.workers.dev/" or siteurl like "https://small-union-7018.daoahueb.workers.dev/" or domainname like "https://app.eduac.workers.dev/Service" or url like "https://app.eduac.workers.dev/Service" or siteurl like "https://app.eduac.workers.dev/Service" or domainname like "msbenefit.com" or url like "msbenefit.com" or siteurl like "msbenefit.com" or domainname like "https://project.secboxes.com/ChromeUpdate.exe" or url like "https://project.secboxes.com/ChromeUpdate.exe" or siteurl like "https://project.secboxes.com/ChromeUpdate.exe" or domainname like "cyclokinetics.online" or url like "cyclokinetics.online" or siteurl like "cyclokinetics.online" or domainname like "silvustechnologies.online" or url like "silvustechnologies.online" or siteurl like "silvustechnologies.online" or domainname like "https://1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com/datago/krita.dll" or url like "https://1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com/datago/krita.dll" or siteurl like "https://1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com/datago/krita.dll" or domainname like "https://1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com/datago/krita.exe" or url like "https://1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com/datago/krita.exe" or siteurl like "https://1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com/datago/krita.exe" or domainname like "https://1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com/datago/SysPr.prx" or url like "https://1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com/datago/SysPr.prx" or siteurl like "https://1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com/datago/SysPr.prx" or domainname like "asianstudies.secboxes.com" or url like "asianstudies.secboxes.com" or siteurl like "asianstudies.secboxes.com"

Detection Query 2 :

domainname like "emcore.ink" or url like "emcore.ink" or siteurl like "emcore.ink" or domainname like "materials-project.secboxes.com" or url like "materials-project.secboxes.com" or siteurl like "materials-project.secboxes.com" or domainname like "https://api-prod.secboxes.com:443/download" or url like "https://api-prod.secboxes.com:443/download" or siteurl like "https://api-prod.secboxes.com:443/download" or domainname like "https://zki0y83.msbenefit.com:443/feed" or url like "https://zki0y83.msbenefit.com:443/feed" or siteurl like "https://zki0y83.msbenefit.com:443/feed" or domainname like "extension-management-portal.centerfjdr658.workers.dev" or url like "extension-management-portal.centerfjdr658.workers.dev" or siteurl like "extension-management-portal.centerfjdr658.workers.dev" or domainname like "https://app.eduac.workers.dev/Updateac" or url like "https://app.eduac.workers.dev/Updateac" or siteurl like "https://app.eduac.workers.dev/Updateac" or domainname like "elixnovorem.com" or url like "elixnovorem.com" or siteurl like "elixnovorem.com" or domainname like "fracons.com" or url like "fracons.com" or siteurl like "fracons.com" or domainname like "https://homepage.brianwilli.com/d/wint.exe" or url like "https://homepage.brianwilli.com/d/wint.exe" or siteurl like "https://homepage.brianwilli.com/d/wint.exe" or domainname like "airliquide.lol" or url like "airliquide.lol" or siteurl like "airliquide.lol" or domainname like "checrity.com" or url like "checrity.com" or siteurl like "checrity.com" or domainname like "brianwilli.com" or url like "brianwilli.com" or siteurl like "brianwilli.com" or domainname like "eduac.workers.dev" or url like "eduac.workers.dev" or siteurl like "eduac.workers.dev" or domainname like "dns.elixnovorem.com" or url like "dns.elixnovorem.com" or siteurl like "dns.elixnovorem.com" or domainname like "ms.checrity.com" or url like "ms.checrity.com" or siteurl like "ms.checrity.com" or domainname like "airindia.fit" or url like "airindia.fit" or siteurl like "airindia.fit" or domainname like "v93xdd5g.workers.dev" or url like "v93xdd5g.workers.dev" or siteurl like "v93xdd5g.workers.dev" or domainname like "apollohospitals.fit" or url like "apollohospitals.fit" or siteurl like "apollohospitals.fit" or domainname like "dns.getaiexo.com" or url like "dns.getaiexo.com" or siteurl like "dns.getaiexo.com" or domainname like "evidence.msbenefit.com" or url like "evidence.msbenefit.com" or siteurl like "evidence.msbenefit.com" or domainname like "https://homepage.brianwilli.com/d/SysPr.prx" or url like "https://homepage.brianwilli.com/d/SysPr.prx" or siteurl like "https://homepage.brianwilli.com/d/SysPr.prx" or domainname like "project.secboxes.com" or url like "project.secboxes.com" or siteurl like "project.secboxes.com" or domainname like "jetoptera.co" or url like "jetoptera.co" or siteurl like "jetoptera.co" or domainname like "bosch-sensortec.site" or url like "bosch-sensortec.site" or siteurl like "bosch-sensortec.site" or domainname like "extension-management-portal.kmjukilo-lkjh.workers.dev" or url like "extension-management-portal.kmjukilo-lkjh.workers.dev" or siteurl like "extension-management-portal.kmjukilo-lkjh.workers.dev" or domainname like "vncdc.mailtbox.workers.dev" or url like "vncdc.mailtbox.workers.dev" or siteurl like "vncdc.mailtbox.workers.dev" or domainname like "openlumakora.com" or url like "openlumakora.com" or siteurl like "openlumakora.com" or domainname like "https://homepage.brianwilli.com/d/85rY.dat" or url like "https://homepage.brianwilli.com/d/85rY.dat" or siteurl like "https://homepage.brianwilli.com/d/85rY.dat" or domainname like "mailtbox.workers.dev" or url like "mailtbox.workers.dev" or siteurl like "mailtbox.workers.dev" or domainname like "airproducts.ink" or url like "airproducts.ink" or siteurl like "airproducts.ink" or domainname like "haloengines.net" or url like "haloengines.net" or siteurl like "haloengines.net" or domainname like "spectrolab.fit" or url like "spectrolab.fit" or siteurl like "spectrolab.fit" or domainname like "joinmacket.com" or url like "joinmacket.com" or siteurl like "joinmacket.com" or domainname like "aurexdefense.online" or url like "aurexdefense.online" or siteurl like "aurexdefense.online" or domainname like "dns. velodynaity.com" or url like "dns. velodynaity.com" or siteurl like "dns. velodynaity.com"

Detection Query 3 :

dstipaddress IN ("79.133.56.90") or srcipaddress IN ("79.133.56.90")

Detection Query 4 :

sender IN (

"zfg.rc.420@gmail.com","laylowthiago@gmail.com","susan.thomas.90@outlook.com","mariedubois1917@outlook.com","reallifetalktv2@gmail.com","faizus123@outlook.com","firda.kemkes@outlook.com","faizus123@proton.me","dewiinpermata@outlook.com","radhikadas07@outlook.com","jeannifer.suryajaya@outlook.com","siti.nurhaliza2026@outlook.com","ditjenpajakri2026@outlook.com") or recipient IN (

"zfg.rc.420@gmail.com","laylowthiago@gmail.com","susan.thomas.90@outlook.com","mariedubois1917@outlook.com","reallifetalktv2@gmail.com","faizus123@outlook.com","firda.kemkes@outlook.com","faizus123@proton.me","dewiinpermata@outlook.com","radhikadas07@outlook.com","jeannifer.suryajaya@outlook.com","siti.nurhaliza2026@outlook.com","ditjenpajakri2026@outlook.com") or from IN (

"zfg.rc.420@gmail.com","laylowthiago@gmail.com","susan.thomas.90@outlook.com","mariedubois1917@outlook.com","reallifetalktv2@gmail.com","faizus123@outlook.com","firda.kemkes@outlook.com","faizus123@proton.me","dewiinpermata@outlook.com","radhikadas07@outlook.com","jeannifer.suryajaya@outlook.com","siti.nurhaliza2026@outlook.com","ditjenpajakri2026@outlook.com")