Cybercriminals Abandon Domains but Keep the Hosting Networks Behind Malware Campaigns

www.itsecuritynews.info • September 24, 2026

Cybercriminals are rapidly rotating lure domains, cloud storage buckets and command-and-control channels, but one infrastructure component is proving far harder to replace: the bulletproof hosting network that delivers the initial fake verification page. Five months of monitoring linked four distinct malware delivery chains to AS202412, operated by OMEGATECH LTD, making the ASN not individual domains […]

Read the original article:

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cybercriminals Shift Domains, Maintain Malware Hosting Networks Cybercriminals are rapidly rotating lure domains and command-and-control channels while maintaining a stable bulletproof hosting network, AS202412, operated by OMEGATECH LTD. Over five months, researchers identified four distinct malware delivery chains linked to this network, highlighting the difficulty of blocking individual domains. The initial access method, ClickFix, uses social engineering to trick victims into executing malicious commands via the Windows Run dialog. This technique circumvents traditional defenses focused on file downloads and suspicious links. The observed lure domains often feature predictable naming patterns, allowing attackers to quickly switch to new domains without significant cost. The infrastructure's resilience poses a growing challenge for cybersecurity defenses, as static IP blocklists become less effective due to frequent changes in address space. 3 sources 52

Extracted Entities

Cybercriminals Abandon Domains but Keep the Hosting Networks Behind Malware Campaigns

The full story

Extracted Entities

Attack Types (1)

Companies (1)

MITRE ATT&CK (1)