mails.updater-worelos.com

Domain

Threat entity extracted from intelligence sources

Frequency

occurrences

First Seen

June 24, 2026

Last Seen

September 3, 2026

API

IOC Validation

ThreatCluster AI

False Positive — False Positive confidence

No context provided to determine role or ownership

This indicator was flagged as a false positive by AI analysis.

Pivot to external tools

Opens in new tab · no data sent to TC

Reputation · 2

Sandbox · 2

Infrastructure · 5

Malware trackers · 2

Web search · 2

Related Clusters (2)

Node.js Exploited in Ransomware Attacks Using EtherHiding Technique

Sep 3·8 sources

New Mistic Backdoor Linked to Ransomware Access Broker Activity

Jun 24·21 sources

Related Entities

Ransomware Malware Phishing ClickFix Infection Chain Education Devmine Ethereum Insurance Professional Services Government Technology Financial

mails.updater-worelos.com

IOC Validation

Pivot to external tools

Related Clusters (2)

Node.js Exploited in Ransomware Attacks Using EtherHiding Technique

New Mistic Backdoor Linked to Ransomware Access Broker Activity

Related Articles (5)

Node Js Returns Ransomware

Node.js: Old Technique Makes a Comeback

Symantec’s Threat Hunter Team observed ModeloRAT

Backdoor.Mistic: New Backdoor May be Linked to Ransomware Access Broker

Backdoor.Mistic: New Backdoor May be Linked to Ransomware Access Broker

Related Entities