CSIRT Central Asia

A non-profit project dedicated to enhancing digital resilience through OSINT aggregation and promoting open access to threat intelligence.

[CSIRT Central Asia @CSIRT_CAsia]

⚠️ Important Note:
home[.]kg 🇰🇬 is a public FreeDNS zone hosted on https://t.co/iV2yAXXxuQ, allowing anyone to freely create subdomains. The presence of the .kg TLD does NOT imply that #Kyrgyzstan is the intended target of this campaign.

[CSIRT Central Asia @CSIRT_CAsia]

🎯 Target of the Attack:

This campaign specifically targets developers. The subdomain vscode.auth.home[.]kg was crafted to mimic a legitimate Visual Studio Code OAuth redirect URI. Threat actors utilize these malicious domains to harvest authentication tokens.

[CSIRT Central Asia @CSIRT_CAsia]

🌐 Current Resolutions:

auth.home[.]kg 🇰🇬
• IP Address: 80.68.237.36
• Location / ISP: Poland 🇵🇱

vscode.auth.home[.]kg 🇰🇬
• IP Address: 153.75.247.209
• Location / ISP: USA 🇺🇸, Interserver (VPS)

[CSIRT Central Asia @CSIRT_CAsia]

🚨 Suspicious domains detected in the home[.]kg zone 🇰🇬

Domains:
🔹 auth.home[.]kg 🇰🇬
🔹 vscode.auth.home[.]kg 🇰🇬

Both domains are flagged in Maltrail (apt_kimsuky.txt) and are linked to infrastructure attributed by OSINT sources to #Kimsuky / #APT43 / Emerald Sleet.