dc.cathaypacifice[.]comDomain
Reported by 2 independent sources · first reported by Sophos X-Ops · last reported
Last reported 3 days ago
What the reports say
2 reports, newest first · the exact sentence from each-
China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors“In addition, version 1.1.5 has been observed using dc.cathaypacifice[.]com and net.dpworldto.com for command-and-control (C2).”
-
BRONZE SANDCASTLE deploys modified Meterpreter shells“Version 1.1.5 contacted C2 servers dc.cathaypacifice[.]com and net.dpworldto.com.”
Indicators reported together
named in the same reports- net.dpworldto[.]comin 2 reports
- hxxps://api.github[.]com/repos/LatonyCharnleyaWin 1 report
- main.3ku8inqb.js[.]mapin 1 report
- main.lhxjkkai.js[.]mapin 1 report
- main.y8hnze7q.js[.]mapin 1 report
Copy these 5 indicators · defanged
Thanks — we review every report.