lesma[.]euDomain
Reported by 3 independent sources · first reported by Sekoia.io · last reported
Last reported 3 months ago
What the reports say
4 reports, newest first · the exact sentence from each-
Gamaredon en 2025: uso de túneles, workers, dead drops y nuevas alianzas“…ype (teletype.in), rentry.co, write.as, Dropbox, GoFile, las redes sociales DEV Community (dev.to) y Mastodon (mastodon.social), lesma (lesma[.]eu), nopaste.net y Paste.ee (pastee.dev)..”
-
Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances“…type.in) platforms, rentry.co, write.as, Dropbox, GoFile, social networks DEV Community (dev.to) and Mastodon (mastodon.social), lesma (lesma[.]eu), nopaste.net, and Paste.ee (pastee.dev).”
-
FSB’s matryoshka #3/3: Gamaredon's Gammasteel Infostealer“Identified services used in this campaign include Telegram, Telegraph, Teletype, Lesma[.]eu, check-host.net, Rentry.co, Write.as, and Mastodon.”
-
FSB’s matryoshka #2/3: Gamaredon's Gammaload Malware“hxxps://lesma[.]eu/qowuzeco?raw”
Indicators reported together
named in the same reports- write[.]asin 3 reports
- tebi[.]ioin 3 reports
- de-fra.i3storage[.]comin 3 reports
- devtunnels[.]msin 2 reports
- loophole[.]sitein 2 reports
- loca[.]ltin 2 reports
- bore[.]pubin 2 reports
- cleverapps[.]ioin 2 reports
- teletype[.]inin 2 reports
- nopaste[.]netin 2 reports
- pastee[.]devin 2 reports
- check-host[.]netin 2 reports
- s3.tebi[.]ioin 1 report
- hxxps://justsstop[.]ru/in 1 report
- justsstop[.]ruin 1 report
- hxxps://165.22.170[.]129/in 1 report
- 165.22.170[.]129in 1 report
- norosta[.]ruin 1 report
- selltosell[.]ruin 1 report
Copy these 19 indicators · defanged
Also named with it: CVE-2025-8088
Thanks — we review every report.