check.office365-update[.]comDomain

Reported by 1 independent source · first reported 30 Apr 2026 by Trend Micro Research · last reported 30 Apr 2026

Last reported 5 months ago

What the reports say

1 report, newest first · the exact sentence from each

“The NOODLERAT samples used the domain check.office365-update[.]com as C&C, which was registered on November 19, 2025.”

Trend Micro ResearchVendor30 Apr 2026C2
Inside Shadow-Earth-053: A China-Aligned Cyberespionage Campaign Against Government and Defense Sectors in Asia

Indicators reported together

named in the same reports

4264cfb3980a068a…40e59885f5c8in 1 report
2e8f9fd8213d9f69…93d881c04cd2in 1 report
8d9433e9734dd629…d344de733c78in 1 report
d67197bf407e74ec…7df65cf429b3in 1 report
141.164.46[.]77in 1 report
96.9.125[.]227in 1 report
194.38.11[.]3in 1 report
209.141.40[.]254in 1 report
zimbra-beta[.]infoin 1 report

Copy these 9 indicators · defanged

9 indicators, defanged, one per line

4264cfb3980a068ab36d842c7ee0942f40aaf308f31ed48b41e140e59885f5c8
2e8f9fd8213d9f69044101cd029fd1797ec7afbcad40bb1f04eb93d881c04cd2
8d9433e9734dd629d74abe41ff7024c84b3a28c45671df8f4baed344de733c78
d67197bf407e74ecd77be89d0da107d5f7d37c21bdf55456c6b57df65cf429b3
141.164.46[.]77
96.9.125[.]227
194.38.11[.]3
209.141.40[.]254
zimbra-beta[.]info

Also named with it: CVE-2025-55182, CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065

Thanks — we review every report.

Report a wrong value