Chris Duggan@PadelLifeUK

Pro Padel Coach ๐ŸŽพ | MDS Legendary Finisher | Ultra Endurance | Author โ€” The Intent Model | Cyber Intelligence for Fun

 Earth
amazon.com/dp/B0FT54T6VC?refโ€ฆ
Joined April 2018
459 Photos and videos
๐Ÿšจ UNC6671 INFRASTRUCTURE UPDATE assign-key[.]com: 2 โ†’ 10 observed hostnames since my 23 October update. Eight additions, including Carlton Fields, K&L Gates, AECOM and Hitachi Energy. Legal, engineering, energy and more. Tracking live. ๐Ÿ‘€
3
11
622
๐Ÿ‘€ Interesting observation from UNC6671 tracking: myssologin[.]com registered 13 Oct. Latham & Watkins and Kirkland & Ellis names in tracked hostnames appeared in Silent Ransom Group listings 6 and 9 calendar days later.
2
1
3
570
๐Ÿšจ UNC6671 INFRASTRUCTURE UPDATE configuremysso[.]com now shows 12 subdomainsโ€”up from four in my previous update. Eight additional law-firm-themed hostnames. Root-domain VT: 6/92. Whatโ€™s UNC6671โ€™s obsession with law firms? ๐Ÿ‘€ #UNC6671 #ThreatIntel
2
4
611
๐Ÿšจ UNC6671 INFRASTRUCTURE UPDATE Three hostnames under myaccountsetup[.]com: โš–๏ธ mccarthy โš–๏ธ blakes ๐Ÿ—๏ธ mastec Legal-firm impersonation continues, with infrastructure branding alongside it. VT: mccarthy 5/92; the other two 0/92. Tracking continues. ๐Ÿ‘€ #UNC6671 #ThreatIntel
6
12
939
๐Ÿšจ UNC6671 INFRASTRUCTURE UPDATE One new root observed: ๐ŸŒ addsecureapps[.]com One spoofed hostnames referencing ogletree
2
12
808
ffs ๐Ÿคฆโ€โ™‚๏ธ
El Programador Senior
@5eniorDeveloper
Oct 22
BBC: Hablaremos con nuestro experto en seguridad de BBC respecto a la vulnerabilidad de PHP. El experto en seguridad: No sabรญa que PHP existรญa hasta ayer en la maรฑana.
4
2
57
20,454
๐Ÿšจ UNC6671 PATTERN Halliburton label reused: ๐Ÿ“… Sep: halliburton.myaccountoptions[.]com ๐Ÿ“… Oct: halliburton.assign-key[.]com Captured VT scores: earlier hostname 3/92; new hostname 0/92. Same brand label. Different root. ๐Ÿ‘€ #UNC6671 #ThreatIntel
1
4
819
๐Ÿšจ UNC6671 INFRASTRUCTURE UPDATE Two new roots observed: ๐ŸŒ myaccountsetup[.]com ๐ŸŒ assign-key[.]com Three spoofed hostnames referencing Blakes, Halliburton and Cox Automotive Legal, Energy and Automotive. Tracking live. ๐Ÿ‘€ #UNC6671 @FBI
3
6
1,032
๐Ÿšจ UNC6671 INFRASTRUCTURE WATCH At least 25 law-firm brands spoofed during my 2026 tracking. From global giants to specialist firms - the legal-sector theme keeps growing. Tracking live. ๐Ÿ‘€ #UNC6671 #ThreatIntel
1
5
16
1,026
๐Ÿšจ UNC6671 INFRASTRUCTURE UPDATE Another legal-themed hostname: โš–๏ธ buchalter.configuremysso[.]com Four subdomains now observed. Root-domain VT detections: 0/92 โ†’ 6/92. Whatโ€™s UNC6671โ€™s obsession with law firms? ๐Ÿ‘€ #UNC6671 @FBI
1
4
10
796
๐Ÿšจ UNC6671 LEGAL-SECTOR UPDATE New SSO-themed domain: configuremysso[.]com Three observed hostnames: โš–๏ธ bennettjones โš–๏ธ finnegan ๐Ÿ”Ž rc VirusTotal shows 0/92 detections in this snapshot ๐Ÿ‘€ #ThreatIntel #Phishing #OSINT
3
5
879
๐Ÿšจ IS ROMULUS REBRANDING EXISTING SOFTWARE? ๐Ÿ‘€ On typosquatted havelbeenpwned[.]net, historical urlscan captures suggest the adversary rebranded Breeze RMM: -Breeze RMM -ROMULUS Remote Operations -Today: black-and-gold ROMULUS login #ROMULUS #ThreatIntel
The Hacker News
@TheHackersNews
Oct 20
โš ๏ธ Researchers uncovered ROMULUS, a ClickFix malware delivery platform with admin panels found on six servers. It delivers trojanized Stardock installers and LegionLoader, including an 842 MiB executable padded to evade some file-size scanning limits. Read - thehackernews.com/2026/10/roโ€ฆ
2
4
5
997
๐Ÿšจ ROMULUS INFRASTRUCTURE TRACKING Building on research by Sai Molige and Forescout Vedere Labs, Shodan identified 13 IPs across 5 countries. #ROMULUS #ThreatIntel
195
๐Ÿšจ UNC6671 INFRASTRUCTURE UPDATE Latham & Watkins and Kirkland & Ellis bring the myssologin[.]com cluster to 11 apparent law-firm references. An apparent Cloudflare setup failure exposed 46.19.136[.]147 also seen in Septemberโ€™s myaccountapps[.]com campaign. ๐Ÿ‘€ #UNC6671
2
4
11
1,166
๐Ÿšจ UNC6671 INFRASTRUCTURE UPDATE Nine law-firm references now observed under myssologin[.]com. Latest: bhfs.myssologin[.]com โ€” apparent reference to Brownstein Hyatt Farber Schreck. UNC6671 uses IT-helpdesk vishing and SSO phishing for data theft/extortion. @FBI #UNC6671
2
4
8
1,811
๐Ÿšจ UNC6671 INFRASTRUCTURE UPDATE Two more hostnames under myssologin[.]com: โš–๏ธ huschblackwell.myssologin[.]com โš–๏ธ dinsmore.myssologin[.]com Husch Blackwell and Dinsmore take the legal-sector cluster to eight firms. Tracking live. ๐Ÿ‘€ #UNC6671 #ThreatIntel
1
7
7
659
๐Ÿšจ UNC6671 INFRASTRUCTURE UPDATE Two more hostnames have appeared under myssologin[.]com: โš–๏ธ stinson.myssologin[.]com โš–๏ธ dechert.myssologin[.]com The apparent references are Stinson and Dechert, expanding the cluster to six law firms. Tracking live. ๐Ÿ‘€ #UNC6671 #ThreatIntel
3
11
713
๐Ÿšจ UNC6671 INFRASTRUCTURE UPDATE Two more hostnames have appeared under myssologin[.]com: โš–๏ธ kelleydrye.myssologin[.]com โš–๏ธ willkie.myssologin[.]com The apparent references are Kelley Drye and Willkie, expanding the cluster to four major law firms. Tracking live. ๐Ÿ‘€
6
10
807
๐Ÿšจ UNC6671 INFRASTRUCTURE UPDATE Fresh legal-sector hostnames observed: โš–๏ธ cooley.myssologin[.]com โš–๏ธ paulweiss.myssologin[.]com Both use the same Microsoft OAuth-style path: ๐Ÿ”— /common/oauth2/v2.0/authorize/ Tracking live. ๐Ÿ‘€ #UNC6671 #ThreatIntel
1
3
15
767
๐Ÿšจ CURRENT SHINYHUNTERS INFRASTRUCTURE ๐Ÿ‡บ๐Ÿ‡ธ DataWagon LLC โ€” 3 IPs ๐Ÿ‡ท๐Ÿ‡บ PROSPERO OOO โ€” 2 IPs Five IPs across two providers. Tracking continues. ๐Ÿ‘€ #ShinyHunters #ThreatIntel
1
7
39
2,960
Load more