Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
Malspam Campaign Uses DoubleClick Redirects to Deliver .NET Loader
Malware Families
Excerpt
A sophisticated malspam campaign discovered by the Hunterss exploits Google’s DoubleClick ad-tracking infrastructure to bypass email security gateways before deploying a multi-stage. According to Hunterss, initial access begins with a malicious HTML attachment Bestellung_2026.html (“order” in German) containing a zero-second meta-refresh redirect to a legitimate ad.doubleclick[.]net click-tracking URL. Because DoubleClick is a…
Read the original report →Diamond Model
Adversary
Infrastructure(5)
Capability(2)
Victim
Attack Flow10 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | xtadts.ddns.net | High | Score 58/100 | First seen |
| Domain | catalogo.castrouria.com | High | Score 72/100 | First seen |
| Domain | afxwd.ddns.net | High | Score 88/100 | First seen |
| Domain | ipapi.co | High | Score 63/100 | First seen |
| Domain | ad.doubleclick.net | High | Score 55/100 | First seen |
IOC Relationship Graph
Building graph…