rabbit holeMalware
Last reported 8 days ago, by Rapid717 reports
ATT&CK techniques
6 of 23 · each with the sentence it comes from- T1684Social Engineering
“For many years, cybercriminals have used social engineering and phishing attacks to trick unsuspected victims into providing their credentials.”
- T1021.001Remote Desktop Protocol
“…known as EternalBlue; whereas LOCKBIT variants tend to infect using phishing emails, exploit kits, or by leveraging compromised Remote Desktop Protocol (RDP) credentials.”
- T1110Brute Force
“…ten implemented as a form of enterprise identity security to protect organizations against credential theft , dictionary attacks, and brute force techniques.”
- T1003OS Credential Dumping
“OS Credential Dumping: LSASS”
- T1003.001LSASS Memory
“T1003.001”
- T1012Query Registry
“T1012”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
17 reports, newest first · the exact sentence from each-
Rapid7 Intelligence Wins the 2026 Péter Szőr Award for Outstanding Research“…a CERT spots something in their environment, an analyst notices the one odd function nobody looked at twice, and you're back down the rabbit hole.”
-
New Browser Guard features add protection before and after you click“Scam sites are uncannily good at imitating brands, and one misleading link can send you down a dangerous rabbit hole.”
-
Bulbature, beneath the waves of GobRAT“Down the rabbit hole: Infrastructure overall”
-
The ADWS Architecture That Hides PowerShell AD Enumeration“That realization sent me down a weeks-long rabbit hole: why was PowerShell AD enumeration, obfuscated or not, completely invisible to everything I'd built?”
-
A Threat Actor Abuses Another Free Trial“Immediately, we wanted to share threat intelligence on the intrusions, but amongst that investigation, we uncovered a new rabbit hole—live threat actor infrastructure they used for their campaigns.”
-
SDFlags“Down the rabbit hole: What even is nTSecurityDescriptor?”
-
Reflecting on AI in 2025: Faster Attacks, Same Old Tradecraft“…characters—whether an artifact kept in the script by a lazy adversary or a false flag to send an investigator down a Russian-speaking rabbit hole.”
-
Proactive Account Review Uncovers Unauthorized“After performing some routine account reviews, I came across an interesting find that led me down a rabbit hole.”
-
Analyzing a Malicious Advanced IP Scanner Google Ad Redirection“The question I asked myself that caused me to go down this rabbit hole was, “What does this file do?” To answer this question, my initial intention was to download the original malicious file so I could analyze its behavior.”
-
Ransomware in the honeypot: how we capture keys with sticky canary files“Going farther into the rabbit hole, we realized that cryptbase!SystemFunction036 itself is nothing more than a light wrapper for bcryptprimitives!ProcessPrng, which – by the name of the function – seems to match our expectations.”
-
Investigation into PostalFurious: a Chinese-speaking phishing gang targeting Singapore and Australia“Down the rabbit hole: phishing website”
-
ConnectWise/R1Soft RCE & Supply Chain Risks“We went down rabbit hole after rabbit hole, decompiling Java classes and digging through code, trying different routes or attack chain avenues.”
-
Roasting 0ktapus: The phishing campaign going after Okta identity credentials“From here, we went down the rabbit hole of Internet clues that led us to the alleged identity of Subject X.”
-
“We find many things that others do not even see”“The more you read, the more you realize how deep the rabbit hole is.”
-
Targeted APT Activity: BABYSHARK Is Out for Blood“Once our 24/7 Security analysts identified the activity, we began an investigation to identify how deep the rabbit hole went.”
-
Cobalt Strikes Again: An Analysis of Obfuscated Malware“How deep can a rabbit hole go?”
-
How One Criminal Tried to Sell an MSP on the Dark Web“In a rare encounter, we found ourselves directly interacting with a cybercriminal that took us down a dark web rabbit hole.”
Indicators in its reports
named in the reports above- 38.60.221[.]63in 1 report
- 38.60.221[.]174in 1 report
- 38.60.223[.]51in 1 report
- 38.60.223[.]81in 1 report
- nbt201.dynamic-dns[.]netin 1 report
- eyh.ocry[.]comin 1 report
- af4ad0bd9221ffc63ae5acff4034834ain 1 report
- hxxps://38.54.85[.]21:52208/in 1 report
- 38.54.85[.]21in 1 report
- hxxps://38.60.221[.]145/static/in 1 report
- 38.60.221[.]145in 1 report
- quieresmail[.]comin 1 report
- firstmail[.]ltdin 1 report
- 7c00a38569a8471083b6b34e1511b9dein 1 report
- qgtxtebl.workers[.]devin 1 report
- 154.26.156[.]181in 1 report
- 51.161.152[.]26in 1 report
- rel-1.16.3-0-ga6ed6b70-prebuilt.dady[.]orgin 1 report
- secure[.]chasein 1 report
- 172.86.105[.]237in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.