Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
48 IOCs
Introducing Doublecup, a Clickfix Loader Delivering Countloader and Devicemanager Rats
Threat Actors
Malware Families
Excerpt
https://socradar.io/blog/doublecup-clickfix-loader-devicemanager-rats/ Introducing DOUBLECUP, a ClickFix Loader Delivering CountLoader and DeviceManager RATs By ameer Published: 2026-08-03 · Archived: 2026-10-08 02:01:00 UTC SOCRadar’s Threat Research Unit (STRU) identified and analyzed DOUBLECUP, a Russian Loader-as-a-Service (LaaS) for ClickFix campaigns. Operating in a client-server architecture, each client can configure campaigns that host the DOUBLECUP logic on specific…
Read the original report →Diamond Model
Adversary(4)
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →48 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | cloud-electronic.com | High | Score 70/100 | First seen |
| Domain | login-hubspot.com | High | Score 70/100 | First seen |
| IP | 103.22.137.227 | High | Score 70/100 | First seen |
| Domain | doublecap.ltd | High | Score 70/100 | First seen |
| Domain | setup.sh | High | Score 86/100 | First seen |
| URL | https://appleid-customertelemetry.gl/setup.sh | High | Score 68/100 | First seen |
| Domain | cap.spec-connectweb3.tv | High | Score 70/100 | First seen |
| URL | http://67.219.107.181/hgflssvslvidfugvbldiuv | Medium | Score 45/100 | First seen |
| IP | 167.148.201.131 | High | Score 68/100 | First seen |
| SHA256 | afe273533d6f9d0b8852988f6a4b34571dd52af4c690e54723a86257aa8a015d | High | Score 67/100 | First seen |
| Domain | login-netsuite.com | High | Score 70/100 | First seen |
| Domain | cap-t1.spec-connectweb3.tv | High | Score 70/100 | First seen |
| URL | https://appleid-customertelemetry.gl/AppleIDVerificationService | Low | Score 31/100 | First seen |
| Domain | canva-arts.com | High | Score 70/100 | First seen |
| Domain | dm_task.py | High | Score 67/100 | First seen |
| Domain | login-odoo.com | High | Score 70/100 | First seen |
| SHA256 | bdf28e611d77362c40a0445655a35943c03accf21bb9a5af755da7eac5ea5e40 | High | Score 67/100 | First seen |
| Domain | examcanvas.com | High | Score 70/100 | First seen |
| IP | 80.96.109.229 | High | Score 70/100 | First seen |
| Domain | storagepioneer.com | High | Score 70/100 | First seen |
| Domain | verification-salesforce.com | High | Score 70/100 | First seen |
| Domain | pending-verification.com | High | Score 70/100 | First seen |
| Domain | api.com | High | Score 67/100 | First seen |
| IP | 1.5.0.0 | High | Score 67/100 | First seen |
| SHA256 | 8585721cbc46780903bd727e37a9ed07a33463852046ff65bc718ded4c80dfb1 | High | Score 67/100 | First seen |
| Domain | python-3.13.13-embed-amd64.zip | High | Score 67/100 | First seen |
| SHA256 | 6e08cb5602f63bee2b40739167b4aef77763bc8fb47b4839ca2fc1607ad35cba | High | Score 67/100 | First seen |
| URL | https://s3.us2.lyve.seagate.com/fullstack09/MicroUpdaterV1.exe | Low | Score 33/100 | First seen |
| Domain | app.py | Medium | Score 59/100 | First seen |
| Domain | login-salesforce.com | High | Score 71/100 | First seen |
| Domain | cloudscraft.com | High | Score 70/100 | First seen |
| IP | 146.70.124.154 | Medium | Score 69/100 | First seen |
| Domain | nxtdrcliam.site | High | Score 68/100 | First seen |
| SHA256 | ea70895620f955b0712b85c3fee41de7437d5068267966f0b4fb6fa2704c3a50 | High | Score 66/100 | First seen |
| SHA256 | 08730fda7366104b1461b12834f55723381bf34a234947689c708b1ee431af69 | High | Score 73/100 | First seen |
| Domain | ticgo-cloud.com | High | Score 70/100 | First seen |
| URL | dns://91.92.240.100 | High | Score 68/100 | First seen |
| Domain | roqqcloud.com | High | Score 70/100 | First seen |
| Domain | srv641398444.host.ultaserver.net | High | Score 70/100 | First seen |
| Domain | wscript.shell.run | High | Score 67/100 | First seen |
| Domain | alphastore.vg | High | Score 70/100 | First seen |
| IP | 213.139.77.109 | High | Score 70/100 | First seen |
| SHA256 | 882914f9014f14e89123e835f103ac8f9d4b2e358c1f21c1cbc7f1054e6afed6 | High | Score 70/100 | First seen |
| SHA256 | 28cbbca8099bb1b27668d135314842c69ceb478a7d6b4b08f063d106a06c8f9d | High | Score 67/100 | First seen |
| IP | 89.124.117.12 | High | Score 68/100 | First seen |
| Domain | supercloudsaver.com | High | Score 70/100 | First seen |
| Domain | cap-t2.spec-connectweb3.tv | High | Score 70/100 | First seen |
| Domain | doublecap.live | High | Score 70/100 | First seen |
IOC Relationship Graph
Building graph…