Weekly Threat Advisory: 5 APTs, 200 RATs, 74% High-Severity — The Week the C2 Flood Went Quiet (Jun 29 – Jul 5, 2026)

The C2-flood feeds went quiet this week and the named operators showed up. Five state-aligned APT clusters ran in parallel. AsyncRAT surged to 200+ IOCs — the largest RAT footprint year-to-date. A novel malware family (TONResolver) resolves command-and-control endpoints through a public open blockchain — takedown-resistant by design. Trust-anchor phishing hit at scale (Fake trust-anchor verification-page campaign campaign, 54 IOCs, two subnet anchors). 74 percent of this week’s catalogue is high-severity — roughly ten times the normal baseline. If your SOC was quiet this week, that is the incident.

Sectioned for the working analyst: cluster catalogue, deep-dives on the high-tempo names, ATT&CK technique mapping per adversary, subnet anchors for cheap perimeter blocking, top 15 IOCs per indicator type, four production-ready Sigma rules, 60-minute operationalisation plan. Vendor-neutral. Operator-grade. Archive of prior advisories.

01 · This week in numbers

Look at the topline before you look at anything else: 1,524 unique IOCs, 64 adversary clusters, 1,129 high-severity records (74 percent of the catalogue). That severity share is roughly ten times the normal weekly baseline. The C2-listener-flood feeds that usually dominate the topline volume went quiet, and the named-adversary layer — the intelligence layer — produced the bulk of the intake. Domain volume beat IP volume for the first time in this catalogue’s year-to-date window. That inversion matters: the adversaries were building operator-controlled infrastructure faster than they were burning C2 listeners.

02 · Five headlines — what defined this week

If you read nothing else, read these five.

Headline 01 · The C2 flood went quiet, the operators came out

The largest volume-contributing feeds — the passive C2-listener-flood sources that usually push 50,000+ IPs per week into the catalogue — produced only 126 records this cycle. Instead, the narrow-indicator layer (domains, hashes, URLs) surged. Result: DOMAIN volume beat IP volume for the first time year-to-date, and 74 percent of the catalogue is high-severity (roughly ten times the normal baseline). The operational signal is that infrastructure-building activity outpaced infrastructure-consumption activity — a leading indicator of a coming operational tempo increase. Prepare next week’s SOC for higher signal-to-noise but also higher incident-fidelity alerts.

Headline 02 · AsyncRAT surged to 200+ IOCs — largest RAT footprint YTD

AsyncRAT contributed 204 unique indicators across two cluster entries (a “malware campaign” tier at 132 IOCs and a “C2” tier at 72 IOCs) — the largest single-family RAT footprint recorded in this catalogue year-to-date. The C2-tier entry covered all four primary IOC types (domain, hash, IP, URL); the malware-campaign tier covered domain, hash, and IP. The ATT&CK technique chain (T1566.001 → T1204 → T1105 → T1071.001 → T1041 → T1547.001) is standard for the family; what is unusual is the scale. Push all 204 indicators to the blocking lane; hunt for the spearphish-attachment-then-registry-run-key sequence across the last 90 days.

Headline 03 · TONResolver — malware resolves C2 via a public open blockchain

TONResolver contributed 125 IOCs across DOMAIN, HASH, and URL — and introduces a novel command-and-control pattern the catalogue has not observed at scale before. The malware resolves its C2 endpoints through the a public open blockchain: the operator publishes the current C2 address as a data record on-chain, the implant reads the record, and every rotation is a new blockchain transaction rather than a new DNS registration. The pattern is takedown-resistant by design. Traditional DNS-based blocking cannot break the resolution chain because the resolution never touches conventional DNS. Detection must move to the endpoint layer (observed process behaviour) and the network layer (any outbound connection to public-blockchain RPC endpoints from a non-development host is highly suspicious).

Headline 04 · Trust-anchor phishing at scale — Fake trust-anchor verification-page campaign

A single campaign contributed 54 IOCs across DOMAIN + HASH + IP with two subnet anchors (85.239.149.0/24 and 93.152.224.0/24). The campaign impersonates the visual verification flows used by the internet’s largest trust-anchor providers — the CAPTCHA / verification screens users have been trained by legitimate security infrastructure to trust implicitly. The operational impact is asymmetric: user-awareness training tells users to trust these flows, so the phishing lure defeats the training. Detection must move to the perimeter (subnet blocking) and the DNS layer (the campaign uses generic-looking domain names like 100furniture[.]com and 123clocks[.]com that seem unrelated until you notice the pattern of 100+ such domains registered in a short window). Block both anchor /24s and hunt for the domain-registration-velocity pattern.

Headline 05 · 5 named APTs active — UNC1151, APT36, TeamPCP, Lazarus, BitterAPT + CyberAv3ngers

Five state-aligned threat-actor clusters produced high-severity indicators this cycle. UNC1151 (41 IOCs, DGA pattern targeting account-verification services), APT36 (13 IOCs across all four types), TeamPCP (27 IOCs with a subnet anchor at 83.142.209.0/24), Lazarus (5 URLs with a distinctive REST-API-style C2 path pattern at 216.126.236.244), and BitterAPT (1 hash with a compact TTP set). Separately, CyberAv3ngers produced the week’s largest subnet anchor — 7 IPs concentrated in 185.82.73.0/24. Ransomware category is also active: The Gentlemen (32 IOCs) and Anubis (27 IOCs with a full four-type footprint) are both operationally live. Watch the ransomware layer for double-extortion leak-site infrastructure.

03 · Indicator type, severity, and category mix

The catalogue inverted this week. Where prior weeks saw IP addresses account for 95+ percent of records (from passive C2-listener feeds), this week has DOMAIN as the largest indicator type at 35.4 percent — and only 22.8 percent IP. When the narrow-indicator layer dominates the topline, the intelligence density is higher: every record is more likely to carry adversary attribution and ATT&CK mapping.

By indicator type

By severity

By category

Reading the inversion. When 74 percent of the catalogue is high-severity, treat every SIEM alert this week as more likely to be a real incident than a normal week. Ratchet the SOC’s escalation thresholds tighter for the next seven days. If your normal on-call rotation is calibrated for a 1-2% high-severity baseline, this week’s rotation will hit fatigue faster than expected.

04 · Top 31 adversary clusters by indicator footprint

The table ranks every named adversary cluster by unique indicator count this week. AsyncRAT tops the list at 132 IOCs (with a separate C2 entry at 72 IOCs, totalling 204 across the family). TONResolver is the novel entry at 125 IOCs. Named APT clusters (UNC1151, APT36, TeamPCP) appear in the upper third — a heavier APT week than most.

How to read this. Prioritise clusters that span three or more IOC types — that breadth indicates active operator tempo and a full kill chain. This week’s four-type footprints: AsyncRAT (C2 tier), Backdoor.Mistic, C2, Anubis, ClickFix, LokiBot, APT36. Each is a candidate for retrospective hunt as well as forward blocking.

05 · Cluster deep-dives — the names to act on

05.1 · AsyncRAT surge — 200+ IOCs across the family

Two catalogued cluster entries for the same family contributed 132 IOCs (malware-campaign tier) and 72 IOCs (C2 tier), for a combined 204 unique indicators. The C2-tier entry carries a full four-type footprint (domain, hash, IP, URL); the malware-campaign tier covers domain, hash, and IP. TTP signature is the family standard: T1566.001 spearphishing attachment, T1204 user-execution, T1105 ingress tool transfer, T1071.001 web-protocol C2, T1041 exfil over C2, T1547.001 registry-run-key persistence.

Defensive actions: Push all 204 hashes and IPs to blocking lanes; sinkhole the domains at the resolver. Hunt for the spearphish-attachment-then-registry-run-key sequence across the last 90 days — the sequence is more resilient than any single IOC.

05.2 · TONResolver — blockchain-resolved C2

Novel malware family with 125 IOCs across DOMAIN, HASH, and URL. The distinguishing feature: the malware resolves its C2 endpoints through a public open blockchain rather than DNS. The operator publishes the current C2 address as an on-chain record; the implant reads the record; every rotation is a new blockchain transaction. Result: takedown-resistant infrastructure. Traditional DNS-based blocking cannot break the resolution chain because the resolution never touches conventional DNS.

Defensive actions: Push the 125 catalogued IOCs to blocking. But recognise the strategic limit — when the operator rotates, the new C2 address will not surface in DNS-based catalogues. Detection has to move to (a) endpoint behavioural detection on the process’s TON-RPC library calls or (b) network detection of any outbound connection to public public-blockchain RPC endpoints from a non-development host. Audit your outbound egress policy to explicitly deny public-blockchain RPC traffic unless business use is documented.

05.3 · Fake trust-anchor verification-page campaign — trust-anchor phishing at scale

54 IOCs across DOMAIN + HASH + IP with two subnet anchors: 85.239.149.0/24 and 93.152.224.0/24. The campaign impersonates the visual verification flows used by the internet’s largest trust-anchor providers — the CAPTCHA/verification screens users have been trained by legitimate security infrastructure to accept without hesitation. Domain naming is deliberately generic: 100furniture[.]com, 123clocks[.]com, and dozens more that seem unrelated until you notice the registration-velocity pattern.

Defensive actions: Block both /24 subnets at the perimeter (cost: zero; operational risk: none). Deploy a passive-DNS or CT-log monitor for the domain-registration-velocity pattern (100+ generic-sounding domains registered by the same registrar in a short window). Update user-awareness content to warn users about verification flows on unfamiliar domains — the visual convincingness of these lures defeats standard training.

05.4 · UNC1151 — DGA targeting account-verification services

41 IOCs across DOMAIN + HASH + IP. The domain layer shows a deliberate targeting pattern: every domain has a name adjacent to legitimate account-verification services (account-email-verification[.]cc[.]cd, account-protection-support[.]icu, account.check-profile[.]digital). The naming discipline is the fingerprint — DGA output that looks like legitimate service subdomains rather than random alphanumeric strings.

Defensive actions: Block the 21 catalogued domains at DNS. Deploy a regex-based DNS filter for the account-*-verification.* and account-protection-*.* patterns. Route inbound emails carrying links matching those patterns to secondary review.

05.5 · Lazarus (APT38 sub-cluster) — REST-API-style C2

Small footprint but high-fidelity signal: 5 catalogued URLs to a single infrastructure anchor at 216.126.236.244 with a distinctive REST-API-style path pattern (/api/service/makelog, /api/service/process/, /api/service/98cb54c0b4ac259d30c9c1ca1ae87c68, /upload, and port 4801 / 4806 endpoints). The API-path structure is itself a fingerprint — any other host serving this exact path shape is candidate compromise infrastructure.

Defensive actions: Push the anchor IP to blocking. Hunt for outbound traffic matching the API path patterns (/api/service/makelog, /api/service/process) to any destination other than known-legitimate infrastructure.

05.6 · CyberAv3ngers — the week’s largest subnet anchor

7 IPs concentrated in 185.82.73.0/24 — the week’s largest APT infrastructure anchor. When 7 IPs from a single named cluster land in the same /24, treat the entire /24 as suspect. The 249 addresses outside the catalogued 7 are almost certainly future rotation candidates.

Defensive actions: Block 185.82.73.0/24 at the perimeter now. Cost: zero. Operational risk: bounded (256 addresses). Amortised leverage: every rotation inside the block hits the same wall.

05.7 · The Gentlemen + Anubis (Ransomware)

Two ransomware operators active this week: The Gentlemen (32 IOCs across HASH + IP) and Anubis (27 IOCs across all four IOC types). Both signal typical double-extortion kill-chain infrastructure — encryption-for-impact + recovery inhibition + exfil to operator-controlled leak site.

Defensive actions: Push all ransomware-tagged hashes to endpoint quarantine. Hunt for the classic ransomware kill-chain sequence: valid-account login from unusual source → remote-management tool execution → large outbound transfer to non-corporate domain within 1 hour.

05.8 · StegoAd — steganography-based ad malware

47 IOCs across DOMAIN + URL. Steganographic malware family where the payload data is hidden inside image files delivered through legitimate ad-serving infrastructure. Detection must inspect the image content, not the transport. Traditional URL and domain blocking works only against the delivery hosts (which the campaign will rotate); the harder problem is content inspection at the image-decode layer.

Defensive actions: Block the 47 catalogued endpoints. If your environment runs an ad-network gateway, enable image-content inspection where feasible (recognising the false-positive cost). For most environments, network-perimeter blocking of the catalogued endpoints is the operational answer.

05.9 · Phishing AI agents cluster — AI-agent-driven phishing

21 IOCs across DOMAIN + URL. A campaign in which the lure-generation and victim-conversation layers are automated by AI agents — each phishing target receives a personalised, contextually-aware lure. Traditional pattern-based phishing detection (template matching, common-phrase lexical filters) fails because the lure content is unique per victim. Detection has to move to behavioural layers: outbound clicks from the lure landing on unfamiliar domains, credential-entry telemetry, unusual authentication sequences.

Defensive actions: Block the 21 catalogued endpoints. Promote hardware-bound credentials (FIDO2 / passkeys) so successful credential capture cannot replay against your services. For long-term defence, invest in identity-verification workflows that survive AI-generated social-engineering pressure.

05.10 · Hijacked package-registry entries

15 IOCs across IP + OTHERS + URL. Compromised package-registry entries with command-interpreter execution at install-time. CI build agents that pull from an unrestricted public package registry are the exposed surface. This continues the multi-week supply-chain trend and is now a routine background campaign category rather than an exotic one.

Defensive actions: Package allow-listing in CI build agents. Outbound-domain monitoring from build runners. Publisher-identity verification on the package registry.

06 · ATT&CK technique mapping per named cluster

The table below maps each named cluster to the ATT&CK techniques observed in its catalogued indicators, with an operational narrative on how the technique chain plays in practice. Use this table to drive detection-engineering priorities this week — content that fires on these techniques catches the cluster even after IOC rotation.

Detection-engineering takeaway. The technique catalogue this week is dominated by T1071/T1071.001 (web-protocol C2), T1105 (ingress tool transfer), T1059 (command-interpreter), and T1041 (exfil over C2). If your environment lacks coverage on those four techniques specifically, you are blind to roughly 75 percent of this week’s adversary tradecraft. Prioritise coverage above any single-IOC blocklist work.

07 · Tactic-pressure roll-up

Aggregation of technique tags across every IOC where the source feed published an ATT&CK mapping. Rolls up to the parent tactic.

08 · Subnet clustering — shared-infrastructure anchors

The /24 subnet group-by surfaces five operator anchors this week — the highest count in three weeks. Each is a candidate for subnet-level perimeter blocking. The 185.82.73.0/24 anchor (CyberAv3ngers) is the week’s highest-leverage block.

The asymmetric block. Two subnets serve the same “Fake trust-anchor verification-page campaign” campaign (85.239.149.0/24 and 93.152.224.0/24). Same operator, different hosting tenants — the pattern is a hedge against one tenant being taken down. Block both to defeat the hedge.

09 · Top 15 IOCs per indicator type

Operator-grade extractions. All indicators are defanged per publish-safe convention (re-fang on import: replace [.] with . and hxxp with http).

Top 15 · IP addresses (High severity)

Top 15 · Domains (High severity)

Top 15 · File hashes (High severity)

Top 15 · URLs (High severity)

10 · Sigma detection rules — four for this week’s standout patterns

Drop into your detection-content pipeline, normalise field names to your SIEM’s schema, tune the false-positive filters against your allowlist, ship.

Sigma 01 · public-blockchain RPC outbound traffic (TONResolver detection)

title: Outbound Traffic to Non-Development public-blockchain RPC Endpoints
id: 8f2e1c9a-4b7d-4023-a591-6d8f3c1e5b90
status: experimental
description: Detects outbound connections from non-development hosts to public
  the public open blockchain RPC endpoints. TONResolver-family malware resolves
  C2 addresses via a public open blockchain — takedown-resistant by design. Any
  outbound public-blockchain RPC traffic from a non-engineering host is candidate compromise.
references:
  - https://hackforlab.com/weekly-threat-advisory-june-29-july-5-2026/
author: HackForLab Threat Intelligence
date: 2026/07/06
tags:
  - attack.command_and_control
  - attack.t1102
  - attack.t1568
logsource:
  category: proxy
detection:
  selection:
    cs-host|contains:
      - '.ton.org'
      - 'toncenter'
      - 'ton-rpc'
      - 'tonapi'
  exclusion:
    src-ip|cidr: '10.engineering.0.0/16'   # replace with your engineering subnet
  condition: selection and not exclusion
falsepositives:
  - Blockchain-adjacent engineering workloads (allowlist explicitly)
level: high

Sigma 02 · UNC1151 account-verification DGA

title: UNC1151 Account-Verification DGA Pattern
id: 3c1b7d5f-9a82-4e60-b471-2f8e6d4a1c93
status: experimental
description: Detects DNS queries or HTTP host headers matching the UNC1151
  domain-generation pattern targeting account-verification and profile-check
  services.
references:
  - https://hackforlab.com/weekly-threat-advisory-june-29-july-5-2026/
author: HackForLab Threat Intelligence
date: 2026/07/06
tags:
  - attack.initial_access
  - attack.t1566
  - attack.resource_development
  - attack.t1583.001
logsource:
  category: dns_query
detection:
  selection:
    QueryName|re:
      - '^account-(email|emails)-verification\.'
      - '^account-protection-(support|team)\.'
      - '^account\.check-profile\.'
      - '^account-profile-check\.'
  condition: selection
falsepositives:
  - Very rare — this naming convention is not used by legitimate services
level: critical

Sigma 03 · CyberAv3ngers subnet anchor

title: CyberAv3ngers Subnet Anchor Contact
id: b7c9e2a4-6d13-4820-a58f-3e9b7c1d4f60
status: experimental
description: Detects any outbound connection to the CyberAv3ngers subnet anchor
  observed this cycle (185.82.73.0/24, 7 concentrated APT IPs). Treat entire /24
  as suspect — the remaining 249 addresses are likely rotation candidates.
references:
  - https://hackforlab.com/weekly-threat-advisory-june-29-july-5-2026/
author: HackForLab Threat Intelligence
date: 2026/07/06
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1105
logsource:
  category: network_connection
detection:
  selection:
    DestinationIp|cidr: '185.82.73.0/24'
  condition: selection
falsepositives:
  - Unlikely — the /24 has no documented business use
level: critical

Sigma 04 · Lazarus REST-API-style C2 pattern

title: Lazarus REST-API-Style C2 Path Pattern
id: 4d6b8f1c-3a92-4570-b108-9e2c7d5f6a41
status: experimental
description: Detects HTTP requests matching the distinctive REST-API-style C2
  path pattern observed in the Lazarus sub-cluster this cycle. The path shape
  itself is a fingerprint — any host serving this exact API shape is candidate
  compromise infrastructure.
references:
  - https://hackforlab.com/weekly-threat-advisory-june-29-july-5-2026/
author: HackForLab Threat Intelligence
date: 2026/07/06
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.exfiltration
  - attack.t1041
logsource:
  category: proxy
detection:
  selection_path:
    cs-uri-stem|re:
      - '^/api/service/makelog$'
      - '^/api/service/process/?'
      - '^/api/service/[a-f0-9]{32}$'
      - '^/upload$'
  selection_port:
    cs-server-port:
      - 4801
      - 4806
  condition: selection_path or (selection_port and cs-uri-stem|startswith: '/api/')
falsepositives:
  - Internal legacy services on those ports (audit and allowlist)
level: high

11 · Hunt queries — SIEM-agnostic pseudo-syntax

Hunt 01 · First-seen contact with this week’s APT anchors

// Pseudo-query
FROM network_flows
WHERE dest_ip IN (
  '111.88.74.246',       -- UNC1151
  '135.181.171.40',      -- Fake trust-anchor verification
  '144.202.14.75',       -- Anubis
  '146.19.248.120',      -- Fake trust-anchor verification
  '149.28.66.79',        -- Anubis
  '216.126.236.244'      -- Lazarus
)
  AND first_seen_pair(src_ip, dest_ip) WITHIN 60d
| AGGREGATE BY src_ip, dest_ip
| SORT BY flow_count DESC

Any new first-seen pairing to these anchors within the last 60 days is an in-progress incident.

Hunt 02 · public-blockchain RPC outbound from non-engineering hosts

// Pseudo-query
FROM proxy_logs
WHERE dest_host MATCHES regex '(?i)(toncenter|\.ton\.org|ton-rpc|tonapi)'
  AND src_host NOT IN (allowlisted_engineering_hosts)
| AGGREGATE BY src_host, dest_host
  COUNT(*) AS req_count,
  MIN(request_time) AS first_seen
| SORT BY first_seen DESC

Catches TONResolver-style malware without needing to know the C2 IP — the resolution behaviour itself is the signal.

Hunt 03 · Account-verification lookalike domain queries

// Pseudo-query
FROM dns_queries
WHERE query_name MATCHES regex '^(account-.*(verification|protection|profile-check)|.*check-profile\.)'
  AND query_name NOT IN (allowlisted_verification_services)
| AGGREGATE BY src_host, query_name
| SORT BY COUNT DESC

Catches UNC1151-style DGA output at the resolver.

Hunt 04 · REST-API-style C2 pattern (Lazarus shape)

// Pseudo-query
FROM proxy_logs
WHERE cs_uri_stem MATCHES regex '^/api/service/(makelog|process|[a-f0-9]{32})'
  OR (cs_server_port IN (4801, 4806) AND cs_uri_stem STARTS WITH '/api/')
| AGGREGATE BY src_host, dest_host
| SORT BY request_count DESC

12 · Operationalise this advisory in 60 minutes

Minute 00 – 15 · Block + sinkhole

• Block 185.82.73.0/24 at the perimeter (CyberAv3ngers APT anchor). Cost: zero. Risk: none.
• Block 85.239.149.0/24 and 93.152.224.0/24 (Fake trust-anchor verification-page campaign anchors).
• Block 83.142.209.0/24 (TeamPCP APT anchor).
• Block 216.126.236.244 (Lazarus sub-cluster anchor).
• Push the 15 top IPs and 15 top hashes to blocking lanes.

Minute 15 – 30 · Detection content

• Deploy the four Sigma rules from Section 10.
• Add explicit outbound-deny for public-blockchain RPC endpoints from non-engineering hosts (blocks TONResolver-style malware even after C2 rotation).
• Tune false-positive filters against your engineering allowlist.

Minute 30 – 45 · Retrospective hunt

• Run Hunt 01 (APT anchor first-seen) across the last 60 days.
• Run Hunt 03 (account-verification DGA queries) baseline scan.
• Run Hunt 04 (Lazarus REST-API path pattern) against the last 30 days.

Minute 45 – 60 · Awareness + policy

• Update user-awareness content on trust-anchor phishing — verification flows on unfamiliar domains should be treated as suspicious.
• Audit outbound egress policy for public-blockchain RPC and any blockchain-adjacent RPC traffic. Deny by default from non-engineering hosts.
• Brief developers on the sustained supply-chain trend. Package allow-listing and publisher-identity verification remain non-optional.

13 · Frequently asked questions