The stable part of this operation is the delivery chain. A lure document points at a page that hands over a password-protected archive, and ANY.RUN says the same structure recurs across otherwise unrelated hosts: secure.html leading to project/*.zip, the same font1.woff2, the same icons8-microsoft-word-94.png [7][8]. That reuse is what stitched 601 separate cases into one campaign [2]. The archive password serves an operational purpose rather than a courtesy to the victim: it keeps mail-layer scanners from reading the contents, which is why the vendor's own guidance puts archive handling at the gateway rather than on the endpoint [9].
The rotation numbers make the blocklist problem plain. Of 425 kit URLs, 94% were seen on a single day, so roughly 400 were spent and gone, leaving about 25 with any life beyond their first [5][14]. Those 425 URLs sat on 240 hosts, about 1.8 URLs per host, meaning hosts are close to single-use too [16]. Apply the 45% US share to the 601 cases and you get on the order of 270 US cases in the set [3][15]. An indicator feed keyed to domains is describing infrastructure that was already retired before the feed shipped.
What lands on the host is licensed remote monitoring and management software [2]. No malicious binary exists to convict, which is ANY.RUN's stated reason that malware verdicts, reputation scoring and single IOCs all under-detect this chain [12]. The detection point is the install: an RMM agent appearing on a machine where no ticket authorized it. That requires knowing which agents are sanctioned, on which hosts, under which support contract, and treating everything else as an intrusion regardless of vendor [10]. Lure themes shift to fit the target, with UPS shipping notices, Adobe PDF prompts, tax notices, US Social Security Administration themes and invoices all in the observed set [4]. The Canada Revenue Agency documents that first framed this as Canadian targeting were localization, applied to 46 countries' worth of letterhead [1].
The sourcing here deserves a closer look. Both URLs supplied here are the same article from the same publisher, drawing on one vendor's telemetry, and the piece doubles as promotion for that vendor's sandbox and lookup products [18][13]. No threat actor is named and no dates are given for the activity window [17]. The 45% figure is described as observed activity, which in a sandbox dataset counts submissions rather than confirmed victims, so the US share partly measures who uploads samples. The parts that survive that caveat are the structural ones: 425 URLs, 240 hosts, single-day lifetimes, and a kit fingerprint that has not moved [5][7]. Education, technology and government sit at the top of the targeted sectors, with banking, finance and manufacturing also present [11].
