Weekly Threat Advisory: Intel Briefing — Polygon-Based C2, 4 Chinese-Aligned APTs, 20+ Ransomware Families (Jul 13-19, 2026)

Intelligence week. 59,935 unique IOCs across 116 adversary clusters. A novel command-and-control resolution pattern surfaced — Polygon-Based C2, 314 IOCs, resolving operator infrastructure through the Polygon blockchain rather than DNS. Blockchain-resolved C2 is now a recurring pattern rather than a one-off. Four Chinese-aligned APT clusters ran in parallel: APT-C-60 (121 IOCs, full 5-type spread), UAT-11795 (52 IOCs), APT-C-35 (41 IOCs), APT-Q-27 (15 IOCs). Twenty-plus named ransomware families generated fresh indicators. The TencShell C2 operator concentrated 16 IPs across four subnet blocks — the largest single-cluster subnet footprint of the year. If your CTI team was quiet this week, this briefing has your reading list.

Sectioned for the working analyst: cluster catalogue, deep-dives on the high-tempo names, ATT&CK technique mapping per adversary, subnet + port anchors, top 15 IOCs per indicator type, four production-ready Sigma rules, 60-minute operationalisation plan. Vendor-neutral. Operator-grade. Archive of prior advisories.

01 · This week in numbers

The catalogue produced 59,935 unique IOCs across 116 adversary clusters this cycle — a wide-tempo week. Framework-infrastructure entries dominate the topline volume (as usual), but the narrow-indicator layer (domain / hash / URL / email) contributed 3,382 unique records — approximately double the year-to-date baseline. Every major operator category is elevated: APT +4 named clusters, ransomware 20+ families concurrent, supply-chain double strike, macOS threats surging, and a novel blockchain-resolved C2 pattern surfacing at scale for the second time in a month.

02 · Five headlines — what defined this cycle

Headline 01 · Polygon-Based C2 — novel blockchain-resolved command channel

314 IOCs across DOMAIN + IP. Second observation this month of a malware family that resolves its command-and-control endpoints through a public blockchain rather than conventional DNS. Same operational category as the prior TONResolver cluster observed a fortnight ago. The operator publishes the current C2 address as an on-chain record; the implant queries the chain to retrieve the address; every rotation is a new on-chain transaction. Result: takedown-resistant infrastructure by design. DNS-based blocking cannot break the resolution chain because resolution never touches DNS. Detection has to move to the endpoint layer (process behavioural detection on the blockchain-RPC library calls) and the network layer (any outbound connection to public blockchain RPC endpoints from a non-engineering host).

Headline 02 · APT week — 4 Chinese-aligned clusters active in parallel

Four named Chinese-aligned APT clusters produced fresh indicators this cycle: APT-C-60 (121 IOCs across all 5 primary IOC types — the broadest single-cluster IOC-type spread of the week; subnet anchor at 213.111.158.0/24), UAT-11795 (52 IOCs with developer-and-cryptocurrency-targeting domain infrastructure), APT-C-35 (41 IOCs), and APT-Q-27 (15 IOCs). Combined APT-category footprint: 316 IOCs. Concurrent activity from four named clusters is a load-bearing signal about regional operational tempo.

Headline 03 · Ransomware surge — 20+ families concurrent, RAWorld + Trigona lead

The ransomware-as-a-service category produced 632 IOCs across 20+ named families this cycle. RAWorld led at 213 IOCs (with active leak-site publication observable in the OTHERS category). Trigona followed at 115. Qilin at 56. MedusaLocker at 26. Medusa at 25. Fog at 24. WORLDLEAKS at 15. Spirals at 12. Sorry at 17. Plus a dozen more with 5+ indicators each. Universal ATT&CK signature: the encrypt-plus-inhibit-recovery pair (T1486 → T1490) is present in every family. A single detector fired against volume-shadow-copy deletion catches all of them.

Headline 04 · Package-registry supply-chain double strike

Two concurrent supply-chain campaigns hit public package registries. The malicious game-cheat package campaign (39 IOCs) targeted a public package registry with typosquat packages advertising game-cheat functionality. The malicious Go module campaign (36 IOCs) hit a public Go module registry with similar typosquat-and-payload tradecraft. The coordination across two registries in the same cycle suggests either shared upstream tooling or an operator maturing their supply-chain capability across multiple ecosystems. CI build agents that pull from unrestricted registries are the exposed surface.

Headline 05 · macOS threat layer maturing

Three separate macOS-focused observations in a single cycle: AppleScript-based infostealer (36 IOCs across DOMAIN + HASH + URL), macOS-focused information stealer (11 IOCs across HASH + IP + URL), and Artlist ClickFix Campaign (18 IOCs including a macOS-specific variant). The pattern — multiple concurrent macOS-focused clusters — is new. Historically macOS has been an occasional target; this cycle it is a persistent one. macOS environments are typically under-instrumented for terminal-execution telemetry compared with Windows — this week is a strong prompt to invest in macOS endpoint telemetry parity.

03 · Indicator type, severity, and category mix

The IP indicator layer dominates the topline (94 percent) because the framework-infrastructure feed is running heavy this cycle. The intelligence density sits in the narrow layers: 1,585 unique domains, 1,333 unique hashes, 361 URLs, 103 emails, 61 OTHERS. The C&C category leads the category mix by a wide margin (89 percent) reflecting framework-infrastructure feed output. Ransomware-as-a-Service sits at 632 IOCs (1.1 percent share of records but the most operationally-actionable category).

By indicator type

By severity

By category

04 · Top adversary clusters

38 clusters ranked by unique IOC footprint. Framework-infrastructure entries in grey to preserve visual clarity of the campaign-attributed clusters. Polygon-Based C2 (314 IOCs) and APT-C-60 (121 IOCs full 5-type) are the standouts.

05 · Cluster deep-dives — the names to act on

05.1 · Polygon-Based C2 — blockchain-resolved command channel

314 IOCs across DOMAIN + IP. The malware family resolves its C2 endpoints through the Polygon public blockchain rather than DNS. Operator publishes the current C2 address as an on-chain smart-contract record; implant queries the blockchain to retrieve the address; every rotation is a new on-chain transaction (cheap for the operator, instant for the implant). The pattern is takedown-resistant by design because there is no domain registrar to notify and no DNS record to takedown.

Defensive actions: Push the 314 catalogued indicators to blocking. But recognise the strategic limit — the operator’s next rotation will not surface in DNS-based catalogues. Detection must move to (a) endpoint behavioural detection on the process’s blockchain-RPC library calls, or (b) network detection of any outbound connection to public Polygon RPC endpoints from a non-engineering host. Audit your outbound egress policy to explicitly deny blockchain-RPC traffic unless business use is documented.

05.2 · APT-C-60 — broadest 5-type IOC spread

121 IOCs across all 5 primary IOC types (DOMAIN + EMAIL + HASH + IP + URL) with a subnet anchor at 213.111.158.0/24. The 5-type spread is the broadest single-cluster IOC-type spread this week — indicating a full-ecosystem intrusion, not a single-lure campaign. Standard regional-APT tradecraft: adversary-acquired domains, spearphishing attachments, user-execution, command-interpreter, obfuscated payload, second-stage pull, web-protocol C2, exfil.

Defensive actions: All 121 catalogued indicators to blocking / watchlist by tier. Block the 213.111.158.0/24 subnet anchor. Hunt for outbound to the anchor across the last 90 days.

05.3 · UAT-11795 — developer-and-cryptocurrency-targeting

52 IOCs across DOMAIN + HASH + IP + URL. Adversary-acquired domain infrastructure with distinctive targeting: aipythondevs[.]com targets Python developers; alphabitcapital[.]info targets cryptocurrency-adjacent audiences. Combines two high-value victim populations in a single cluster. Standard APT tradecraft otherwise.

Defensive actions: Block the 52 catalogued indicators. Brief developer and cryptocurrency-using populations on the domain-adjacent targeting pattern.

05.4 · RAWorld ransomware — 213 IOCs with active leak-site publication

Largest ransomware footprint of the week. HASH + IP + OTHERS. The OTHERS category contains victim-slug patterns published on the operator’s data-leak site — watch this indicator class for early warning that your organisation appears on the site.

Defensive actions: Hash-block the catalogued binaries at endpoint scan. Push IPs to perimeter blocklist. Subscribe to leak-site infrastructure monitoring if your organisation is exposed to double-extortion operators.

05.5 · Trigona — 115 IOCs with operator ransom-negotiation email surface

EMAIL + HASH. The email indicators are ransom-negotiation contact channels the operator uses post-encryption. Detection value: if any email in your environment sent or received communication with a Trigona negotiation address, that is a strong signal of an in-progress or historical intrusion.

Defensive actions: Deploy the catalogued email indicators as SMTP-gateway blocklist AND as a retrospective hunt against the last 90 days of mailbox audit logs.

05.6 · TencShell C2 infrastructure — 4 subnet anchors, 16 IPs

22 IOCs across HASH + IP with the most concentrated subnet footprint of the week: 4 /24 blocks (134.122.200.0/24 with 6 IPs, 192.163.167.0/24 with 4 IPs, 45.64.52.0/24 with 3 IPs, 112.213.124.0/24 with 3 IPs). 16 IPs across 4 anchor blocks is the largest single-cluster hosting concentration observed this year. Rotation resilience is low from the defender’s perspective — new IPs are highly likely to fall in the same blocks.

Defensive actions: Block all four /24 anchors at the perimeter now. Cost: zero. Operational risk: bounded (~1,024 addresses across 4 blocks). Amortised leverage: every rotation inside any block hits the same wall.

05.7 · Malicious package-registry double strike (game-cheat + Go module)

Two concurrent supply-chain campaigns. Game-cheat campaign: 39 IOCs across all 4 IOC types. Typosquat packages advertising game-cheat functionality delivered obfuscated payloads at install time. Go module campaign: 36 IOCs across DOMAIN + EMAIL + HASH + URL. Compromised Go modules with post-install command execution. Together they suggest an operator maturing their supply-chain capability across multiple language ecosystems.

Defensive actions: Package allow-listing in CI build agents. Outbound-domain monitoring from build runners. Publisher-identity verification. Hunt for install-time process trees where a package installer spawns a shell that pulls from an unfamiliar domain.

05.8 · macOS threat layer maturing

Three concurrent macOS-focused clusters: AppleScript-based infostealer (36 IOCs), macOS-focused information stealer (11 IOCs), and Artlist ClickFix Campaign (18 IOCs including macOS variants). The concurrent activity is the signal — macOS has moved from occasional target to persistent one.

Defensive actions: Update user-awareness content for macOS users on the ClickFix technique. Block catalogued endpoints at DNS resolver. Deploy macOS endpoint content flagging AppleScript execution from unusual parents, and terminal execution of curl-piped-to-shell / bash-piped commands. Invest in macOS endpoint telemetry parity with Windows if you have not already.

05.9 · The TTF Trap — font-parsing exploit campaign

42 IOCs across all 4 IOC types. Drive-by compromise via malicious TrueType Font parsing. T1189 exploitation-for-client-execution is the initial-access technique — user visits a compromised or attacker-controlled page, browser/document viewer parses malicious font data, exploit triggers, second-stage pull follows.

Defensive actions: Block the 42 catalogued endpoints. Hunt for browser or document-viewer process crashes followed by unexpected process spawn within 30 seconds — the canonical drive-by kill-chain fingerprint.

06 · ATT&CK mapping per named cluster

Per-cluster technique mapping with operational narrative. Detection content that fires on these techniques catches the cluster even after IOC rotation.

Detection-engineering takeaway. The universal ransomware pair (T1486 → T1490) is present in every ransomware cluster this cycle. The universal APT chain (T1583.001 → T1566 → T1105 → T1071.001 → T1041) covers all four Chinese-aligned clusters. Two well-designed detectors catch the entire APT and ransomware surface with minimal per-family tuning.

07 · ATT&CK tactic-pressure roll-up

08 · Subnet anchors — the shared-infrastructure signal

The asymmetric block. TencShell C2 operates across four distinct subnet anchors with 16 concentrated IPs — unusually large single-cluster hosting concentration. Blocking all four /24s at the perimeter costs the defender nothing (no legitimate business use) and forces the operator to rebuild across four different hosting tenants simultaneously to defeat the block.

08b · Predictive intelligence — forecast weaponisation

Retrospective indicators tell you what has happened; predictive indicators tell you what is about to. This week’s catalogue-driven forecast layer surfaces three infrastructure blocks with a high forward-looking probability of adversary weaponisation. The forecast is derived from a mix of signals: passive-DNS drift, registration-velocity clustering, hosting-tenant reputation drift, and pattern-match against previously-catalogued operator behaviours. Each forecast carries a days-to-weaponisation estimate. Push these into your perimeter watchlist now — not because they are compromised today, but because they are the highest-probability rotation candidates for adversary use over the next week.

How the forecast is derived

The forward-looking signal combines four inputs. Passive-DNS drift — the rate at which the block’s resolutions are changing relative to its historical baseline. Registration-velocity clustering — comparison of adjacent-block domain-registration rates against operator-fingerprint baselines from previously-catalogued campaigns. Hosting-tenant reputation drift — whether the anchor block’s hosting tenant is trending toward or away from adversary-adjacent reputation classes. And pattern-match against catalogued operator behaviours — whether the block’s early observable signature (open ports, TLS fingerprints, self-signed cert patterns) resembles any known operator anchor from the last 90 days. When two or more inputs converge, the block enters the forecast layer with a days-to-weaponisation estimate.

Operational actions

• Perimeter watchlist — add all three anchors to a watchlist lane (not automatic block) that alerts on any outbound contact.
• Countdown-based escalation — the 3-day forecast (194.46.X.X) warrants tighter monitoring than the 6-day forecasts. Consider provisional blocking of 194.46.0.0/16 at the perimeter if your environment has no legitimate business use in that range.
• CIDR-level block — for the discrete 45.114.106.0/24 anchor, a direct /24 block is the cheapest defensive control (256 addresses, no legitimate business use in most enterprises).
• Retrospective hunt — run a 90-day historical lookback for any past contact with these anchor ranges. Any historical touch is a candidate compromise regardless of the forward-looking forecast.

What predictive intelligence actually gives you. The classical intelligence catalogue tells you what has been observed already; the predictive layer tells you what is about to be observed. In defensive terms, that shift buys the SOC a lead time it does not otherwise have — the difference between blocking an operator anchor after your first compromise vs. blocking it before the operator’s rotation reaches you. The forecast is probabilistic, not deterministic — treat the days-to-weaponisation estimates as watchlist priorities, not automated-blocking triggers.

09 · Top 15 IOCs per indicator type

All indicators defanged (re-fang on import: [.] → . and hxxp → http).

Top 15 · IP addresses (High severity)

Top 15 · Domains (High severity)

Top 15 · File hashes (High severity)

Top 15 · URLs (High severity)

10 · Sigma detection rules

Sigma 01 · Blockchain-RPC outbound (Polygon C2 detector)

title: Outbound Traffic to Public Blockchain RPC — Blockchain-Resolved C2 Detector
id: 4c9e7b1d-5a82-4630-b791-6f8d3c1e5a20
status: experimental
description: Detects outbound connections from non-engineering hosts to public
  blockchain RPC endpoints (Polygon, TON, Ethereum, and similar). Blockchain-
  resolved C2 is now a recurring pattern (Polygon-Based C2 this week, TONResolver
  a fortnight ago). Any outbound blockchain-RPC traffic from a non-engineering
  host is candidate compromise.
references:
  - https://hackforlab.com/weekly-threat-advisory-july-13-19-2026/
author: HackForLab Threat Intelligence
date: 2026/07/20
tags:
  - attack.command_and_control
  - attack.t1102
  - attack.t1568
logsource:
  category: proxy
detection:
  selection:
    cs-host|contains:
      - 'polygon-rpc'
      - 'polygonscan'
      - '.polygon.io'
      - 'maticvigil'
      - 'infura.io'
      - 'alchemy.com'
      - 'ton-rpc'
      - 'toncenter'
      - 'tonapi'
  exclusion:
    src-ip|cidr: '10.engineering.0.0/16'   # replace with your engineering subnet
  condition: selection and not exclusion
falsepositives:
  - Blockchain-adjacent engineering workloads (allowlist explicitly)
level: high

Sigma 02 · Universal ransomware kill-chain (VSS delete)

title: Universal Ransomware Kill-Chain — Volume Shadow Copy Deletion
id: 8e2c1a4f-6d93-4720-a581-3f9b5c2e8d10
status: experimental
description: Detects the universal ransomware pre-encrypt step — volume shadow
  copy deletion. Every catalogued ransomware family this week (RAWorld, Trigona,
  Qilin, MedusaLocker, Medusa, Fog, WORLDLEAKS, Spirals, Sorry, and 15+ more)
  executes this step. A single detector catches the ransomware bucket.
references:
  - https://hackforlab.com/weekly-threat-advisory-july-13-19-2026/
author: HackForLab Threat Intelligence
date: 2026/07/20
tags:
  - attack.impact
  - attack.t1490
  - attack.t1486
logsource:
  category: process_creation
  product: windows
detection:
  vssadmin_delete:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains|all: ['delete', 'shadows']
  wmi_delete:
    Image|endswith: '\wmic.exe'
    CommandLine|contains|all: ['shadowcopy', 'delete']
  powershell_delete:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'Remove-CimInstance'
      - 'Win32_ShadowCopy'
  condition: 1 of them
falsepositives:
  - Legitimate backup operations (verify + allowlist known-good scripts)
level: critical

Sigma 03 · TencShell C2 subnet anchors

title: TencShell C2 Subnet Anchor Contact
id: 3b7f9d2c-1a84-4560-b731-5c9e6d4f2b40
status: experimental
description: Detects outbound connections to the TencShell C2 operator's four
  concentrated subnet anchors. 16 IPs across 4 /24 blocks — the year's largest
  single-cluster hosting concentration.
references:
  - https://hackforlab.com/weekly-threat-advisory-july-13-19-2026/
author: HackForLab Threat Intelligence
date: 2026/07/20
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
detection:
  selection:
    DestinationIp|cidr:
      - '134.122.200.0/24'
      - '192.163.167.0/24'
      - '45.64.52.0/24'
      - '112.213.124.0/24'
  condition: selection
falsepositives:
  - Unlikely — none of these CIDRs has documented legitimate business use
level: critical

Sigma 04 · APT-C-60 multi-type cluster

title: APT-C-60 Multi-Type Cluster Detection
id: 5d1a8c3f-4b72-4820-a591-2e8c7d5b1a90
status: experimental
description: Detects contact with APT-C-60's catalogued anchor infrastructure OR
  DNS queries matching the cluster's acquired-domain naming pattern. APT-C-60
  had the broadest single-cluster IOC-type spread this week (5 IOC types).
references:
  - https://hackforlab.com/weekly-threat-advisory-july-13-19-2026/
author: HackForLab Threat Intelligence
date: 2026/07/20
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.resource_development
  - attack.t1583.001
logsource:
  category: network_connection
detection:
  subnet_anchor:
    DestinationIp|cidr: '213.111.158.0/24'
  known_domains:
    QueryName:
      - 'altzserberin.info'
      # (add remaining catalogued APT-C-60 domains at deploy time)
  condition: subnet_anchor or known_domains
falsepositives:
  - Very rare — the subnet + domain pattern has no legitimate business use
level: critical

11 · Hunt queries — SIEM-agnostic pseudo-syntax

Hunt 01 · Blockchain-RPC outbound from non-engineering hosts

// Pseudo-query
FROM proxy_logs
WHERE dest_host MATCHES regex '(?i)(polygon-rpc|polygonscan|\.polygon\.io|maticvigil|infura|alchemy|toncenter|\.ton\.org)'
  AND src_host NOT IN (allowlisted_engineering_hosts)
| AGGREGATE BY src_host, dest_host
  COUNT(*) AS req_count,
  MIN(request_time) AS first_seen
| SORT BY first_seen DESC

Hunt 02 · TencShell C2 anchor first-seen contact

// Pseudo-query
FROM network_flows
WHERE dest_ip IN CIDR('134.122.200.0/24', '192.163.167.0/24', '45.64.52.0/24', '112.213.124.0/24')
  AND first_seen_pair(src_ip, dest_ip) WITHIN 60d
| AGGREGATE BY src_ip, dest_ip
| SORT BY flow_count DESC

Hunt 03 · APT anchor first-seen (all 4 Chinese-aligned clusters)

// Pseudo-query
FROM network_flows
WHERE dest_ip IN CIDR('213.111.158.0/24')                    -- APT-C-60
   OR dest_ip = '104.248.233.104'                             -- UAT-11795
  AND first_seen_pair(src_ip, dest_ip) WITHIN 90d
| PROJECT src_ip, dest_ip, first_seen
| SORT BY first_seen DESC

Hunt 04 · Font-exploit drive-by kill-chain (TTF Trap)

// Pseudo-query
FROM process_crash_events
WHERE process_name IN ('chrome.exe', 'firefox.exe', 'edge.exe', 'AcroRd32.exe', 'winword.exe')
  AND crash_module MATCHES regex '(?i)(font|ttf|otf)'
| JOIN process_creates AS pc
  ON process_crash_events.host = pc.host
  AND pc.create_time BETWEEN process_crash_events.event_time
                        AND process_crash_events.event_time + 30s
  AND pc.process_name NOT IN (allowlisted_children)
| PROJECT host, process_crash_events.process_name, pc.command_line
| SORT BY event_time DESC

12 · Operationalise in 60 minutes

Minute 00 – 15 · Block + sinkhole

• Block all four TencShell subnet anchors: 134.122.200.0/24, 192.163.167.0/24, 45.64.52.0/24, 112.213.124.0/24.
• Block 213.111.158.0/24 (APT-C-60 anchor).
• Block 92.38.177.0/24 (Lucide Proxy DDoS botnet).
• Block 45.156.87.0/24 (Sorry ransomware).
• Deploy outbound-deny for public blockchain RPC endpoints (Polygon + TON) from non-engineering hosts.

Minute 15 – 30 · Detection content

• Deploy Sigma 01 (blockchain-RPC detector) — catches Polygon-Based C2 + TONResolver family without knowing the C2 IPs.
• Deploy Sigma 02 (universal VSS-delete detector) — catches every ransomware family this week.
• Deploy Sigma 03 (TencShell subnet anchors).
• Deploy Sigma 04 (APT-C-60 multi-type).

Minute 30 – 45 · Retrospective hunt

• Run Hunt 01 (blockchain-RPC outbound) baseline scan.
• Run Hunt 02 (TencShell anchor first-seen) across last 60 days.
• Run Hunt 03 (APT anchor first-seen) across last 90 days.
• Run Hunt 04 (font-exploit drive-by) across last 30 days.

Minute 45 – 60 · Awareness + policy

• Brief developers on the package-registry supply-chain double strike; package allow-listing is not optional.
• Brief cryptocurrency-adjacent users on the UAT-11795 domain targeting pattern.
• Update macOS user-awareness content on ClickFix.
• Audit outbound egress policy for blockchain-RPC traffic. Deny by default from non-engineering hosts.

13 · Frequently asked questions