Malware

HiddenTear

Also known as: Cryptear · FuckUnicorn

HiddenTear is an open source ransomware developed by a Turkish programmer and later released as proof of concept on GitHub. The malware generates a local symmetric key in order to encrypt a configurable folder (/test was the default one) and it sends it to a centralized C&C server. Due to its small payload it was used as real attack vector over email phishing campaigns. Variants are still used in attacks.

Indicators of Compromise 7

Domain 6789x[.]site Domain cel-robox[.]com Domain healthymagination[.]com Domain krogeralbertsons[.]com Domain maxfactor-international[.]com Domain rezilion[.]com Domain snsystems[.]com

MITRE ATT&CK TTPs 8

Command And Control

Command And Control

Ingress Tool Transfer

Command And Control

Exploit Public-Facing Application

Lateral Tool Transfer

Lateral Movement

Acquire Infrastructure

Resource Development

Compromise Infrastructure

Resource Development

Source Articles

Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware

Threat actor Sable Squirrel has spent nearly $7 million acquiring expired domains to exploit their inherited reputation, traffic, and backlinks for illegal sports streaming, online gambling promotion, and malware distribution. The group operates a dual-purpose infrastructure where re-registered domains serve both as streaming platforms and command-and-control (C2) servers for malware such as Quasar RAT and HiddenTear ransomware. The operation targets users in Asia and Australia through social media and ad networks, using a traffic distribution system to redirect victims while evading detection. Additional scavenger actors like Stuffy Squirrel, Shady Squirrel, and Swiping Squirrel are also abusing expired domains for ad fraud, tech support scams, and traffic resale.

hacker-news ·2d ago