security1 distinct publisher
ANY.RUN ties 601 RMM phishing cases to one kit rotating its hosts daily
The CRA tax forms were one regional skin on an operation that lands hardest in the US. With 94% of its kit URLs alive for a single day, the durable indicators are the kit's own files rather than the hosts serving them.
Publishers:thehackernews.com
Reality
- Evidence38
- Adoption50
- Hype gap+22
- Incentives82