adobereader-upgrade[.]inDomain
Reported by 1 independent source · first reported by Zscaler ThreatLabz · last reported
Last reported 8 months ago
What the reports say
1 report, newest first · the exact sentence from each-
APT Attacks Target Indian Government Using GOGITTER, GITSHELLPAD, and GOSHELL | Part 1“…3pkr4ltc.cloudfront.net/adobe_installation.php?file=Adobe_Acrobat_Reader_Installation_SetupDownload URL, GOGITTER payloadhttps://adobereader-upgrade[.]in/adobe_update.php?file=Adobe_Acrobat_Reader_InstallationDownload URL, GOGITTER payloadhttps://adobecloud.site/adobe_installer.php…”
Indicators reported together
named in the same reports- govt-filesharing[.]sitein 1 report
- ingov.myartsonline[.]comin 1 report
- hxxps://raw.githubusercontent[.]com/jaishankai/sockv6/main/adobe_update.zipin 1 report
- directory[.]cdin 1 report
- path[.]runin 1 report
- repo[.]downloadin 1 report
- user[.]netin 1 report
- hxxps://adobe-acrobat[.]in/a.rarClearin 1 report
- adobe-acrobat[.]inin 1 report
- 2e4e4ea817ad2286616f809ca84fc932in 1 report
- d18c3nlvb0n2a6.cloudfront[.]netin 1 report
- workspace1.myartsonline[.]comin 1 report
- d2i8rh3pkr4ltc.cloudfront[.]netin 1 report
- adobecloud[.]sitein 1 report
- domainadobe-acrobat[.]inin 1 report
- domainsgovt-filesharing[.]sitein 1 report
- hxxps://adobe-acrobat[.]inin 1 report
- hxxps://govt-filesharing[.]site/hpc5985.php?key=xvnd54&info=Helloin 1 report
- hxxp://ingov.myartsonline[.]com/hpc5985.php?key=xvnd54&info=Helloin 1 report
Copy these 19 indicators · defanged
Thanks — we review every report.