hxxps://nodejs[.]org/dist/v18.20.5/node-v18.20.5-win-x64.zipURL
Reported by 1 independent source · first reported by The DFIR Report · last reported
Last reported 5 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware“curl -sLo "C:\Users\REDACTED\AppData\Local\Temp\9gY0LJMyXW.zip" "hxxps://nodejs[.]org/dist/v18.20.5/node-v18.20.5-win-x64.zip"”
Indicators reported together
named in the same reports- 1rpc[.]ioin 1 report
- goldsky.arweave[.]netin 1 report
- arweave[.]netin 1 report
- g8way[.]ioin 1 report
- hxxps://witch-skins-lip-coal.trycloudflare[.]comin 1 report
- witch-skins-lip-coal.trycloudflare[.]comin 1 report
- hxxps://fields-pct-easier-vancouver.trycloudflare[.]comin 1 report
- fields-pct-easier-vancouver.trycloudflare[.]comin 1 report
- hxxps://howto-tar-naturals-coordination.trycloudflare[.]comin 1 report
- howto-tar-naturals-coordination.trycloudflare[.]comin 1 report
- hxxps://workshop-lighting-protective-customs.trycloudflare[.]comin 1 report
- workshop-lighting-protective-customs.trycloudflare[.]comin 1 report
- hxxps://afford-effect-construct-tricks.trycloudflare[.]comin 1 report
- afford-effect-construct-tricks.trycloudflare[.]comin 1 report
- hxxps://rapids-lil-lending-charleston.trycloudflare[.]comin 1 report
- rapids-lil-lending-charleston.trycloudflare[.]comin 1 report
- hxxps://when-architectural-cdna-faster.trycloudflare[.]comin 1 report
- when-architectural-cdna-faster.trycloudflare[.]comin 1 report
- hxxps://mode-exit-legendary-trusted.trycloudflare[.]comin 1 report
Copy these 19 indicators · defanged
Also named with it: CVE-2025-55182
Thanks — we review every report.