ctrlINT What the industry said about every indicator, with the quote

www.archivetj[.]comDomain

Reported by 1 independent source · first reported by Kaspersky Securelist · last reported

Last reported 2 days ago

What the reports say

1 report, newest first · the exact sentence from each

  1. “The decrypted data starts with shellcode followed by a PE file, which is a Rust payload designed to communicate with the www.archivetj[.]com C2 server.”

    Kaspersky SecurelistVendorC2
    How APT41 revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia

Indicators reported together

named in the same reports
Copy these 2 indicators · defanged

Also named with it: CVE-2022-21894

Thanks — we review every report.

Report a wrong value
What is wrong with www.archivetj[.]com here?
No account needed. We do not store your IP address.