Attackers changed lure domains, payload sources and command-and-control methods across four malware chains observed over five months.
But every chain began with a browser loading a page from the same hosting provider, AS202412, registered to Seychelles-based OMEGATECH LTD.
Researchers saw at least seven addresses across six /24 networks serving those entry pages. The provider expanded during the observation period and now announces 24 /24 prefixes. Its persistence made it a more useful defensive target than any individual domain.
Attackers Rotate Domains Sustain Malware
The chains used fake human-verification pages that resembled CAPTCHA or Cloudflare checks. Most victims arrived through advertising redirects; others encountered malicious content on compromised legitimate websites. One user followed a shortened link delivered by email.
The pages told users to press Windows+R, paste a command and run it. Some had already copied the command to the clipboard when the user clicked a button. Padding pushed parts of certain commands out of view in the Run dialog.
What happened next varied. One chain fetched a script from an address inside AS202412 and ran it in memory. Another pulled a batch script from an Amazon S3 bucket.
A third delivered a password-protected archive containing a trojanized installer that placed an unsigned obs.dll beside a signed OBS executable and established persistence.
Another installed a Node.js-based implant that obtained its command-and-control address from a blockchain smart contract, avoiding a conventional C2 domain.
The domain churn was substantial. Researchers observed 12 domains resolving to one lure address, 178.16.52[.]101, while public scans showed 11 more.
Compromised websites presented a different problem, their genuine domains could host the apparent verification page while an injected script contacted the provider’s infrastructure. Blocking newly registered domains alone would miss those cases.
In one observed sequence, a browser reached a lure page and the user executed its command just 41 seconds later. Endpoint protection alerted one second after execution.
The researchers found no evidence that the planned second-stage files or persistence mechanism landed in that case. Across roughly 150 alerts, researchers confirmed four executions.
Most contacts stopped at the page, without a follow-on process or payload. A browser visit to the ASN therefore warrants investigation, but does not by itself establish compromise, blackhillsinfosec said.
The researchers recommend checking local egress logs for legitimate dependencies, then blocking AS202412’s currently announced space while retaining logs of denied traffic.
The announced prefixes must be rechecked against BGP data, the provider added five prefixes beyond an earlier list, while another prefix had been de-announced and reallocated. A stale address list can both miss attacks and disrupt unrelated traffic.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
