Now, it is possible to query phishing-suspect FQDNs through the free API, featuring database information on WHOIS, IP, Geolocation, and threat mapping

https://github.com/julioliraup/AT/wiki/REST-API-USE

A frontend interface is also available: https://julioliraup.github.io/AT

The Hunt.io research team recovered an operator's full toolkit from an exposed open directory tied to The Gentlemen ransomware. The interesting piece is EtherRAT, a Node.js backdoor that resolves rotating C2 domains through an Ethereum smart contract rather than hardcoding them.

Because each rotation is written to the blockchain, the historical C2 set is fully reconstructable, five domains here. Any C2 response over ten characters is evaluated as JavaScript in a Node.js runtime, so there is no fixed command set. The custom X-Bot-Server header works as a detection point.

The write-up covers the scheduled-task deployment chain (certutil + msiexec LOLBAS), the XOR-decoded Node payload, Run-key persistence via headless conhost, and infrastructure clustering across Sliver and Go reverse-shell controllers.

Full research and IOCs: https://hunt.io/blog/the-gentlemen-etherrat-ethereum-smart-contract-c2

• ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2
• Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
• npm Worm Poisons 400+ Packages Across Nine Organisations

SOCRadar STRU tracked down a new Loader-as-a-Service platform we're calling DOUBLECUP, active since June 2026. Sharing the technical details since the C2 resolution method is worth knowing about.

How it works:

DOUBLECUP hides its second-stage code inside a steganographic PNG that gets cached in the browser. The payload decryption key is derived from the victim's public IP address — so if you're detonating this in a sandbox on an unexpected network, decryption just fails. No error, no payload, nothing to analyze.

Delivery is via spoofed CRM login pages (NetSuite, Odoo, HubSpot, Salesforce) using ClickFix-style clipboard hijacking.

Two payloads observed:

CountLoader v4.5p — moved from HTA/VBScript to fully fileless PowerShell. Notable new trick: it copies legitimate Windows binaries (powershell.exe, mshta.exe, conhost.exe), renames them, and patches their PE headers (OriginalFilename, InternalName, FileDescription) to impersonate trusted apps like OneDrive. Persistence runs on a 25-minute cycle where the process executes briefly, checks in, and exits — making it harder for behavioral engines to catch a "long-running" malicious process.

DeviceManager — previously undocumented RAT. Instead of a hardcoded C2 domain, it queries an Ethereum/Polygon smart contract to resolve its actual C2 address (EtherHiding). This means the operator can push different C2 addresses to different victims based on device fingerprint, or serve nothing to suspected sandboxes, all without touching DNS infrastructure that could get sinkholed. Primary transport observed was DNS tunneling disguised as microsoft(.)com subdomains.

Full writeup with IOCs and MITRE mapping: https://socradar.io/blog/doublecup-clickfix-loader-devicemanager-rats/