Mythic C2 Activity at Internet Scale
Censys tracks 131 hosts exposing Mythic to the public Internet. Learn about the C2 framework and how to defend against it.
Author
Andrew Northern
10 posts
The Video That Plays You: Fake MP4 File Carries Malicious Payload
Censys ARC examines the kit that hides malicious payloads within a fake MP4 file that can pass file-type checks. Here's how it works.
The Package That Never Shipped: Following a USPS Smishing Kit Through Censys DNS Data
It Starts With a Text Message You know the message. Everyone has gotten one. A package could not be delivered, there is an unpaid customs fee or a bad address, and here is a helpful link to fix it. This one pointed at: Believe it or not, xupqnqz[.]one is not USPS (United States […]
Oluomo: Microsoft OAuth AiTM Phishing Using a Naturalization-Form Lure
Censys uncovers OLUOMO, a sophisticated AiTM phishing cluster harvesting Microsoft credentials via fake document portals, Azure proxies, and compromised sites.
Cutting Through the Noise: A Technique-Based Approach to Hunting Web-Delivered Malware
**Discover how technique-based HTTP body hunting on Censys surfaced a live ClickFix campaign delivering XWorm V5.6 via PhantomVAI loader—reducing the web to 42 actionable results.**
Under CTRL: Dissecting a Previously Undocumented Russian .Net Access Framework
Censys discovers "CTRL," an undocumented Russian remote access toolkit combining credential phishing, keylogging, RDP hijacking & reverse tunneling. Read the full threat intelligence analysis.
NetSupport Manager: Tracking Dual-Use Remote Administration Infrastructure
Censys sees 25 exposed NetSupport Manager Gateways across global infrastructure. Get the technical overview of NetSupport Manager.
AsyncRAT C2 Activity at Internet Scale
Discover Censys research on AsyncRAT—tracking 57+ active C2 servers via self-signed TLS certificates. Explore threat intelligence on this open-source RAT's infrastructure and capabilities.
Living Off the Web: How Trust Infrastructure Became a Malware Delivery Interface
Discover how Fake Captcha and ClickFix lures exploit trusted web infrastructure to deliver malware. New research reveals fragmented delivery models behind visually uniform campaigns.
EtherHiding: Fake CAPTCHAs, Click-Fix Lures, and Blockchain-Backed Payload Delivery
**Discover how EtherHiding uses blockchain smart contracts to deliver malware via fake CAPTCHAs. Explore the attack chain, threat intelligence, and defense insights.**