Exploring the Cybercrime Underground: Part 3 – Into the RAT Nest
Summary: Unit 42 traced a real attack from a third-party report linking an Adwind sample to a C2 domain, then used Autofocus to find a dozen more samples on the same C2 - almost all LuminosityLink RAT - plus five further C2 domains and several thousand malware files, nearly all commodity RATs such as DarkComet, NJRAT, NanoCore, Remcos and Orcus. The infrastructure ran largely on dynamic DNS, including legitimate providers like NoIP and DynDNS and deliberately misleading domains such as fagdns[.]net, with the email campaigns sent from a legitimate Nigerian commercial organization to 16 recipients per message from an incrementally parsed address database.
What's compelling: Unit 42 concluded this was an unskilled, opportunistic, financially-motivated Nigerian criminal rather than the APT activity the original report described - and the domains of just two dynamic DNS providers were contacted by almost 3000 unique malware samples, with full RAT setups sold cheaply on underground forums.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026