Ctrl-Alt-Intel

Threat Research

[Ctrl-Alt-Intel @ctrlaltintel]

Over 7 a month period, a Qilin affiliate exposed 5 C2 servers -> OPSEC L

-> Sliver C2 / SOCKS running on WatchGuard devices
-> Initial access primarily via WG/Fortinet exploitation
-> 3 real victims found via Qilin blog
-> 🇺🇸 & 🇩🇪 targeting
-> 7+ CVEs used

Link to blog below👇

[Will @BushidoToken]

Please look into this @virginmedia you’re blocking legitimate security researchers:

[ice-wzl @ice_wzl_cyber]

@AWEGroupe Your network has been compromised by a threat actor. Please contact myself or @ctrlaltintel and we will help you get rid of their malware (completely free of charge, of course).

Compromised machine hostname: cineyglpi
Malware process name: [mm_percpu_wq]

[Ctrl-Alt-Intel @ctrlaltintel]

👀😬

[FBI Cyber Division @FBICyberDiv]

Today the FBI released a #PSA warning the public about Kali365—an emerging Phishing-as-a-Service (PhaaS) platform. Kali365, first seen in April 2026, enables cyber threat actors to obtain Microsoft 365 access tokens and bypass multi-factor authentication (MFA) protocols without intercepting the user’s credentials. The platform allows less-skilled attackers access to AI-generated phishing lures, automated campaign templates, real-time targeted individual/entity tracking dashboards, and OAuth token capture capabilities.

Learn more about how the scam works and review recommendations on how to protect yourself: https://t.co/Ym8g4zRGNL

[Ctrl-Alt-Intel @ctrlaltintel]

@bsforvt727 Ooo very interesting 👀

[Ctrl-Alt-Intel @ctrlaltintel]

A Ctrl-Alt-Intel researcher, based out of HK 🇭🇰, tried to download @signalapp via Chrome.... but noticed something odd

The top 2 sponsored results were advertising likely malicious "Chinese versions" of Signal....

[Ctrl-Alt-Intel @ctrlaltintel]

^ Above have been translated

We haven't analyzed the files any further as we are too busy, but wanted to share the suspicious findings with the community regardless!

If anyone has the time to dig into the payloads, we'd love to see what you find 👀

[Ctrl-Alt-Intel @ctrlaltintel]

Sponsored Google ADs
-> signal518.onepage[.me
-> www.cq2nnlqm[.top
-> s3.ap-east-1.amazonaws[.com/mazida3x/WPp3p/singalSutpes_5.18_owsrc.msi (47b403e220447f4205dd14bb69ecb9f9)

This .MSI contains signed Spotify/Google binaries + suspicious DLL, ant.dll (6f3ac069f5f95665259b09149fd1d240)

[Ctrl-Alt-Intel @ctrlaltintel]

@VIPRESecurity Please stop flagging us on Virus Total <3

[Ctrl-Alt-Intel @ctrlaltintel]

@socradar please stop bullying us 😢

[Ctrl-Alt-Intel @ctrlaltintel]

In total, over 3.7k messages were analysed from multiple channels in their Rocket[.Chat

We are not finished, some more interesting tradecraft to discuss. Blog maybe coming soon 😅

[Ctrl-Alt-Intel @ctrlaltintel]

A little thread exposing screenshots + comms from the Gentlemen Leaks. These provide super interesting insight into the inside operations of successful RaaS groups.

Everything from aspects of operators personal lives, their TTPs, and victims. All images shared are from the Rocket[.Chat leak

We even discovered in March they attempted to send flowers to a UK-based victim....

On 28th Feb, they recognise they're "top 2" on https://t.co/hpPlgsz0wo + Devman has gone ;)🚓

Translation of zeta88's first message:

"In short, Devman was either taken in, for health reasons, or because of a rebranding—it all disappeared.
And we're top 2 on RansomLive based on statistics, but not based on profit, I think."

We can see a @GangExposed tweet shared by The Gentlemen, alongside the https://t.co/hpPlgsz0wo stats

[Ctrl-Alt-Intel @ctrlaltintel]

On the 25th March, "zeta88" attempted to get fraudulent CC info in order to buy a bunch of flowers to send to a victim

This victim was apparently taking time to begin negotiations