devtunnels[.]msDomain
Reported by 3 independent sources · first reported by ESET WeLiveSecurity · last reported
Last reported 1 month ago
What the reports say
3 reports, newest first · the exact sentence from each-
NightEagle targets Russian companies“This is a legitimate Microsoft mechanism that allows local web services to be published for internet access on *.*.devtunnels[.]ms domains.”
-
Gamaredon en 2025: uso de túneles, workers, dead drops y nuevas alianzas“…servar que el grupo ocultaba servidores de C&C detrás de workers de Cloudflare (workers.dev), y en junio añadió devtunnels[.]ms de Microsoft y Loophole (loophole.site).”
-
Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances“In May, we began seeing the group hide C&C servers behind Cloudflare workers (workers.dev), and in June it added Microsoft’s devtunnels[.]ms and Loophole (loophole.site).”
Indicators reported together
named in the same reports- loophole[.]sitein 2 reports
- loca[.]ltin 2 reports
- bore[.]pubin 2 reports
- cleverapps[.]ioin 2 reports
- teletype[.]inin 2 reports
- write[.]asin 2 reports
- lesma[.]euin 2 reports
- nopaste[.]netin 2 reports
- pastee[.]devin 2 reports
- tebi[.]ioin 2 reports
- de-fra.i3storage[.]comin 2 reports
- hxxps://github[.]com/mirror-js/mirror-js/refs/heads/main/js/js-webpack.zipin 1 report
- hxxps://github[.]com/mirror-js/mirror-js/refs/heads/main/js/jsonp-pack.zipin 1 report
- hxxps://github[.]com/browserthemes/resourcepack/releases/download/main/resource-pack.zipin 1 report
- 1dcafb7f8448683281106b06dd22409ain 1 report
- 1f3034b706c78b35d8e34044e68c693ain 1 report
- 3ecd1cd627d0340c92901a478a7caad8in 1 report
Copy these 17 indicators · defanged
Also named with it: CVE-2025-8088, CVE-2020-0688, CVE-2019-0708
Thanks — we review every report.