Cybercriminals Shift Domains, Maintain Malware Hosting Networks

• •Cybercriminals are using a stable hosting network while frequently changing lure domains.
• •The ClickFix technique employs social engineering to execute commands on victims' machines.
• •Static IP blocklists are becoming ineffective against these evolving malware campaigns.

Cybercriminals are rapidly rotating lure domains and command-and-control channels while maintaining a stable bulletproof hosting network, AS202412, operated by OMEGATECH LTD. Over five months, researchers identified four distinct malware delivery chains linked to this network, highlighting the difficulty of blocking individual domains. The initial access method, ClickFix, uses social engineering to trick victims into executing malicious commands via the Windows Run dialog. This technique circumvents traditional defenses focused on file downloads and suspicious links. The observed lure domains often feature predictable naming patterns, allowing attackers to quickly switch to new domains without significant cost. The infrastructure's resilience poses a growing challenge for cybersecurity defenses, as static IP blocklists become less effective due to frequent changes in address space.