US Social Security Administration

ANY.RUN ties 601 RMM phishing cases to one kit rotating its hosts daily

The CRA tax forms were one regional skin on an operation that lands hardest in the US. With 94% of its kit URLs alive for a single day, the durable indicators are the kit's own files rather than the hosts serving them.