d32tpl7xt7175h.cloudfront[.]netDomain
Reported by 2 independent sources · first reported by Cisco Talos · last reported
Last reported 22 days ago
What the reports say
2 reports, newest first · the exact sentence from each-
Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign“A JavaScript downloader associated with UAT-11587 that references "d32tpl7xt7175h.cloudfront[.]net," a CloudFront domain previously flagged by Arctic Wolf in connection with a campaign conducted by a China-affiliated threat actor known as UNC6384 targeting European diplomatic and g…”
-
China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor“During our investigation, Talos also identified a JavaScript downloader associated with UAT-11587 that referenced “d32tpl7xt7175h.cloudfront[.]net”, the same CloudFront distribution previously reported by Arctic Wolf in China-nexus UNC6384 delivery activity.”
Indicators reported together
named in the same reports- rsproxy[.]cnin 2 reports
- osc-cdn[.]comin 1 report
- page[.]devin 1 report
- oisadjfoinsiduhfnoisdnfosdnoifnsoid.pages[.]devin 1 report
- abfa7742e315485a98a5fafd6dbfb68ein 1 report
- hxxps://microsoft-flash[.]com/download/flashcenter_pp_ax_install_en.exe%E2%80%9Din 1 report
- microsoft-flash[.]comin 1 report
- wps-cn[.]comin 1 report
- hxxps://www.wps-cn[.]com/downloads/flashcenter_pp_ax_install_en.exe%E2%80%9Din 1 report
- www.wps-cn[.]comin 1 report
- e809da86bd814633…aa8f57778a34in 1 report
- e6ff096a0562c004…f765a8dc8bcfin 1 report
- 4d0fdce4c098635f…e7e50da3ca3fin 1 report
- f1ef5fe4c0cdcff1…1ae1f3edb4e8in 1 report
- 01b5c6acb20e4179…cb15cc93b31ain 1 report
- 5a35fcd4458e808a…5cad3d839562in 1 report
- 17b53ffa8e005f0e…137f627c5b4bin 1 report
- 484ab497072ea09f…0a2a3c8c6506in 1 report
- 3a94910eb8022592…71d3e95ed02ain 1 report
- 6a1dbbfcfe6867ac…66dfd0e8fa56in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.