Tracking BigBear 2.0 Evilginx2 Phishing Campaign

Domains/URLs

konceptenterprises.com

ccpipharma.com

annastudios-paros.com

dnsforward.com

hotelmidtownsurat.com

dataclust.com

cifutura.com

hoaivt.com

dronalms.com

virextec.com

offtic.com

rootreseller.com

management.michaelmarcotte.com

kgsscans.com

soil-management.com

daengrentacar.com

arrmmy.com

captelind.com

planisteradmin.com

hnospascualfadon.com

haliotisbar.com

knowncontractor.com

valtteri.net

IP Address

38.60.250.157

95.179.233.79

80.240.27.55

65.20.103.58

38.54.124.88

208.85.20.79

95.179.169.154

107.191.46.14

130.94.82.180

38.54.124.58

208.85.18.18

45.32.147.239

208.76.222.214

130.94.82.230

65.20.102.80

70.34.208.46

130.94.113.184

78.141.193.59

64.176.72.180

136.244.114.85

70.34.244.122

199.247.10.14

152.39.137.60

91.245.235.208

45.32.64.165

Telegram Bot

@comeandget_bot

@botterxyz_bot

@PackingitonG_bot

@donplayer_bot

@bolywan_bot

@rdsxtdytguyg75d_bot

Detection Query 1 :

domainname like "soil-management.com" or url like "soil-management.com" or siteurl like "soil-management.com" or domainname like "planisteradmin.com" or url like "planisteradmin.com" or siteurl like "planisteradmin.com" or domainname like "hotelmidtownsurat.com" or url like "hotelmidtownsurat.com" or siteurl like "hotelmidtownsurat.com" or domainname like "captelind.com" or url like "captelind.com" or siteurl like "captelind.com" or domainname like "valtteri.net" or url like "valtteri.net" or siteurl like "valtteri.net" or domainname like "rootreseller.com" or url like "rootreseller.com" or siteurl like "rootreseller.com" or domainname like "virextec.com" or url like "virextec.com" or siteurl like "virextec.com" or domainname like "dronalms.com" or url like "dronalms.com" or siteurl like "dronalms.com" or domainname like "haliotisbar.com" or url like "haliotisbar.com" or siteurl like "haliotisbar.com" or domainname like "hnospascualfadon.com" or url like "hnospascualfadon.com" or siteurl like "hnospascualfadon.com" or domainname like "knowncontractor.com" or url like "knowncontractor.com" or siteurl like "knowncontractor.com" or domainname like "ccpipharma.com" or url like "ccpipharma.com" or siteurl like "ccpipharma.com" or domainname like "management.michaelmarcotte.com" or url like "management.michaelmarcotte.com" or siteurl like "management.michaelmarcotte.com" or domainname like "dnsforward.com" or url like "dnsforward.com" or siteurl like "dnsforward.com" or domainname like "arrmmy.com" or url like "arrmmy.com" or siteurl like "arrmmy.com" or domainname like "konceptenterprises.com" or url like "konceptenterprises.com" or siteurl like "konceptenterprises.com" or domainname like "offtic.com" or url like "offtic.com" or siteurl like "offtic.com" or domainname like "annastudios-paros.com" or url like "annastudios-paros.com" or siteurl like "annastudios-paros.com" or domainname like "cifutura.com" or url like "cifutura.com" or siteurl like "cifutura.com" or domainname like "kgsscans.com" or url like "kgsscans.com" or siteurl like "kgsscans.com" or domainname like "dataclust.com" or url like "dataclust.com" or siteurl like "dataclust.com" or domainname like "daengrentacar.com" or url like "daengrentacar.com" or siteurl like "daengrentacar.com" or domainname like "hoaivt.com" or url like "hoaivt.com" or siteurl like "hoaivt.com"

Detection Query 2 :

dstipaddress IN ("95.179.169.154","65.20.103.58","65.20.102.80","208.85.18.18","130.94.82.180","130.94.113.184","199.247.10.14","64.176.72.180","80.240.27.55","136.244.114.85","45.32.64.165","38.54.124.58","38.60.250.157","70.34.208.46","208.85.20.79","70.34.244.122","45.32.147.239","95.179.233.79","130.94.82.230","38.54.124.88","152.39.137.60","91.245.235.208","208.76.222.214","107.191.46.14","78.141.193.59") or srcipaddress IN ("95.179.169.154","65.20.103.58","65.20.102.80","208.85.18.18","130.94.82.180","130.94.113.184","199.247.10.14","64.176.72.180","80.240.27.55","136.244.114.85","45.32.64.165","38.54.124.58","38.60.250.157","70.34.208.46","208.85.20.79","70.34.244.122","45.32.147.239","95.179.233.79","130.94.82.230","38.54.124.88","152.39.137.60","91.245.235.208","208.76.222.214","107.191.46.14","78.141.193.59")