Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
49 IOCs
A Single Canadian Tax Lure Spread into a 46-Country, US-First RMM Campaign
Malware Families
Excerpt
As ANY.RUN analysis shows, a campaign that initially appears to target Canadians with fake Canada Revenue Agency (CRA) T4 tax documents is actually part of a much broader remote-access campaign spanning 46 countries, with 45% of observed activity associated with the United States. The attackers impersonate trusted organizations and document types to trick victims into installing legitimate remote management software, giving them remote access to compromised systems. Part I.…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →49 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | wurel.sbs | High | Score 68/100 | First seen |
| SHA256 | 41b731279b1778a9f578e4ed2589f46c4bef32793b292862cf96279a3ead1c41 | Medium | Score 53/100 | First seen |
| Domain | cevora.vu | High | Score 68/100 | First seen |
| Domain | electrical-sei.com | High | Score 58/100 | First seen |
| Domain | mornixa.cfd | High | Score 68/100 | First seen |
| SHA256 | 51f0cc172ced2e90acbc01c2872c697644380e597076350a6b286c96ab7ccb42 | Medium | Score 53/100 | First seen |
| IP | 46.62.197.232 | High | Score 58/100 | First seen |
| Domain | voretix.icu | High | Score 58/100 | First seen |
| Domain | ddn3.net2me.me | High | Score 58/100 | First seen |
| Domain | pdfmarchlitestatementsscannedforyou.gixar.sbs | High | Score 58/100 | First seen |
| Domain | f004.backblazeb2.com | High | Score 58/100 | First seen |
| Domain | taurusburgerco.com.au | High | Score 58/100 | First seen |
| Domain | officialsummarybycra.vercel.app | High | Score 58/100 | First seen |
| Domain | dashboarduat.paynnow.com | High | Score 58/100 | First seen |
| Domain | vercel.app | Medium | Score 63/100 | First seen |
| Domain | dcsi23.swoop2.me | High | Score 58/100 | First seen |
| Domain | github.io | High | Score 86/100 | First seen |
| Domain | canadaeast1-mediap.svc.ms | High | Score 58/100 | First seen |
| Domain | swoop2.me | High | Score 58/100 | First seen |
| Domain | 2026t4form17718.vercel.app | High | Score 58/100 | First seen |
| Domain | togotoresolve.com | High | Score 58/100 | First seen |
| Domain | gonzalezjaramilloabogados.com | High | Score 58/100 | First seen |
| Domain | docshared.org | High | Score 58/100 | First seen |
| Domain | 54511.ddnsking.com | High | Score 58/100 | First seen |
| Domain | netlify.app | High | Score 58/100 | First seen |
| Domain | quantechitsolutions.com | High | Score 58/100 | First seen |
| Domain | herculescalgarymovers.ca | High | Score 58/100 | First seen |
| Domain | fillingconfirmation.vercel.app | High | Score 58/100 | First seen |
| Domain | statemendetailsfilessenderderf.netlify.app | High | Score 58/100 | First seen |
| Domain | net2me.me | High | Score 58/100 | First seen |
| Domain | dxy43.ddnsking.com | High | Score 58/100 | First seen |
| Domain | xorlira.vu | High | Score 58/100 | First seen |
| Domain | ypatellawoffice.ca | High | Score 58/100 | First seen |
| Domain | crataxsummary1007341.vercel.app | High | Score 58/100 | First seen |
| Domain | getdl.jorix.cyou | High | Score 58/100 | First seen |
| Domain | gofile.io | Low | Score 35/100 | First seen |
| Domain | quavix.vu | High | Score 58/100 | First seen |
| Domain | reportstastementformarchreviewyourssaast.harnivo.cfd | High | Score 58/100 | First seen |
| URL | https://commonerdays.vercel.app/LogMeInResolve_Unattended.msi | High | Score 58/100 | First seen |
| Domain | 67pon.swoop2.me | High | Score 58/100 | First seen |
| Domain | 1drv.ms | High | Score 58/100 | First seen |
| Domain | sharedconfirmationslip.vercel.app | High | Score 58/100 | First seen |
| Domain | mybcdc.ca | High | Score 58/100 | First seen |
| Domain | ssi11.letsgo2.me | High | Score 58/100 | First seen |
| Domain | hiltonheadislanddeals.com | High | Score 58/100 | First seen |
| SHA256 | 132d864bb199105d639edb115249302243eafdb0fc21efb86cc6b6c0d49866f0 | Medium | Score 53/100 | First seen |
| Domain | dyb32.ddnsking.com | High | Score 58/100 | First seen |
| Domain | letsgo2.me | High | Score 58/100 | First seen |
| Domain | ddnsking.com | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…