![curious_drac0's tweet photo. Some more #Kimsuky #DPRK clusters:
152.32.243[.]238
152.32.243[.]178
ASN 135377
UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED https://t.co/W8nHePqRRA](https://pbs.twimg.com/media/HRsMQG_asAACyWt.png)
![skocherhan's tweet photo. #Kimsuky #DPRK🇰🇵
udpate[.]nstlog[.]store
ntnmid[.]dynuddns[.]com
ntnmid[.]dynu[.]net
rhkrgun[.]dynu[.]net
auction[.]dynu[.]net
msdnsmt[.]dynu[.]org
premiatnc[.]dynu[.]org
sunbunbest[.]dynu[.]org
mwkim[.]dynu[.]org
smnoz[.]dynu[.]org
msoinsnt[.]dynu[.]org
bksei[.]dynu[.]org
asmt[.]vnstn[.]dynv6[.]net
cnms[.]dmdoc[.]dynv6[.]net
xn--cnms-kjr[.]dmdoc[.]dynv6[.]net
xn--acnms-gzu[.]dmdoc[.]dynv6[.]net
dmdoc[.]dynv6[.]net
acnms[.]dmdoc[.]dynv6[.]net
store[.]lloizou[.]dynv6[.]net
store[.]metapola[.]dns[.]army
store[.]jptower[.]dns[.]army
store[.]si1901[.]dynv6[.]net
login-accounts[.]dynv6[.]net
vaml[.]schet[.]dns[.]army
store[.]unikoreamc[.]dynv6[.]net
user-kakao[.]login-accounts[.]dynv6[.]net
login[.]account-kakao[.]dynv6[.]net
chromeupdate[.]mydns[.]vc
nldlg[.]dynv6[.]net
ntx-store[.]dynv6[.]net
n-cloud[.]ntx-store[.]dynv6[.]net
118[.]194[.]249[.]91
AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED 🇰🇷](https://pbs.twimg.com/media/HPiwSKgWMAA8g2K.jpg)
![skocherhan's tweet photo. #Kimsuky #DPRK🇰🇵
udpate[.]nstlog[.]store
ntnmid[.]dynuddns[.]com
ntnmid[.]dynu[.]net
rhkrgun[.]dynu[.]net
auction[.]dynu[.]net
msdnsmt[.]dynu[.]org
premiatnc[.]dynu[.]org
sunbunbest[.]dynu[.]org
mwkim[.]dynu[.]org
smnoz[.]dynu[.]org
msoinsnt[.]dynu[.]org
bksei[.]dynu[.]org
asmt[.]vnstn[.]dynv6[.]net
cnms[.]dmdoc[.]dynv6[.]net
xn--cnms-kjr[.]dmdoc[.]dynv6[.]net
xn--acnms-gzu[.]dmdoc[.]dynv6[.]net
dmdoc[.]dynv6[.]net
acnms[.]dmdoc[.]dynv6[.]net
store[.]lloizou[.]dynv6[.]net
store[.]metapola[.]dns[.]army
store[.]jptower[.]dns[.]army
store[.]si1901[.]dynv6[.]net
login-accounts[.]dynv6[.]net
vaml[.]schet[.]dns[.]army
store[.]unikoreamc[.]dynv6[.]net
user-kakao[.]login-accounts[.]dynv6[.]net
login[.]account-kakao[.]dynv6[.]net
chromeupdate[.]mydns[.]vc
nldlg[.]dynv6[.]net
ntx-store[.]dynv6[.]net
n-cloud[.]ntx-store[.]dynv6[.]net
118[.]194[.]249[.]91
AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED 🇰🇷](https://pbs.twimg.com/media/HPiwAQqXwAA5y1Z.jpg)
![skocherhan's tweet photo. #Kimsuky #DPRK🇰🇵
udpate[.]nstlog[.]store
ntnmid[.]dynuddns[.]com
ntnmid[.]dynu[.]net
rhkrgun[.]dynu[.]net
auction[.]dynu[.]net
msdnsmt[.]dynu[.]org
premiatnc[.]dynu[.]org
sunbunbest[.]dynu[.]org
mwkim[.]dynu[.]org
smnoz[.]dynu[.]org
msoinsnt[.]dynu[.]org
bksei[.]dynu[.]org
asmt[.]vnstn[.]dynv6[.]net
cnms[.]dmdoc[.]dynv6[.]net
xn--cnms-kjr[.]dmdoc[.]dynv6[.]net
xn--acnms-gzu[.]dmdoc[.]dynv6[.]net
dmdoc[.]dynv6[.]net
acnms[.]dmdoc[.]dynv6[.]net
store[.]lloizou[.]dynv6[.]net
store[.]metapola[.]dns[.]army
store[.]jptower[.]dns[.]army
store[.]si1901[.]dynv6[.]net
login-accounts[.]dynv6[.]net
vaml[.]schet[.]dns[.]army
store[.]unikoreamc[.]dynv6[.]net
user-kakao[.]login-accounts[.]dynv6[.]net
login[.]account-kakao[.]dynv6[.]net
chromeupdate[.]mydns[.]vc
nldlg[.]dynv6[.]net
ntx-store[.]dynv6[.]net
n-cloud[.]ntx-store[.]dynv6[.]net
118[.]194[.]249[.]91
AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED 🇰🇷](https://pbs.twimg.com/media/HPivrdnWEAE-UrI.jpg)
![TIE__SUN's tweet photo. PHISHING INFRASTRUCTURE ALIVE 🚨
A # leads to multiple nodes hosting the same site
IOCS:
fbi-investingationunit[.]com
digitalassetsreclaim[.]com
www.fbi-sec.globalfundrecoveryunit[.]com
auracyber-investigation[.]com
198.251.84[.]200
172.67.162[.]245
66.85.46[.]67
51.195.95[.]80 https://t.co/Qz45ZspRuq](https://pbs.twimg.com/media/HRkrNgDWYAUNYzi.jpg)
![curious_drac0's tweet photo. Observed new domain: coliseumdlc[.]xyz distributing a Windows executable #ShinyLoader.exe with #trojan characteristics, including defense evasion and discovery behavior. It currently has 0 detections on #VirusTotal & #QiAnXin
Day 05 of posting #CTI findings everyday for 30 days https://t.co/pOe0sQzxOh](https://pbs.twimg.com/media/HRjT43Qa8AAdR4X.jpg)
![curious_drac0's tweet photo. Observed new domain: coliseumdlc[.]xyz distributing a Windows executable #ShinyLoader.exe with #trojan characteristics, including defense evasion and discovery behavior. It currently has 0 detections on #VirusTotal & #QiAnXin
Day 05 of posting #CTI findings everyday for 30 days https://t.co/pOe0sQzxOh](https://pbs.twimg.com/media/HRjToqHbEAAd8Nr.png)
![TIE__SUN's tweet photo. UNC6671 MFA theme phishing infrastructure 🚨
Ioc update:
chime.mfa-options[.]com https://t.co/DJgAQHg1F3](https://pbs.twimg.com/media/HRU276MXsAQJvCD.jpg)
![_AkatsukiLegion's tweet photo. A live #Quasar #C2 panel is exposed on 159.223.5[.]148 (DigitalOcean, Amsterdam). The #opendirectory contains the #admin login, #database credentials, #encryption keys, and full bot management interface.
Credits @Huntio https://t.co/R2PfjWLBq8](https://pbs.twimg.com/media/HROaTwGacAAI3c9.jpg)
Olivia
Online
Draco
@curious_drac0
Working in the shadows, where no one dares to step.
Intelligence Analyst @_AkatsukiLegion
Joined January 2026
332 Following
21 Followers
38 Posts
Some more #Kimsuky #DPRK clusters:
152.32.243[.]238
152.32.243[.]178
ASN 135377
UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED
![curious_drac0's tweet photo. Some more #Kimsuky #DPRK clusters:
152.32.243[.]238
152.32.243[.]178
ASN 135377
UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED https://t.co/W8nHePqRRA](https://pbs.twimg.com/media/HRsMcncaUAAHwvn.png)
#Kimsuky #DPRK🇰🇵
udpate[.]nstlog[.]store
ntnmid[.]dynuddns[.]com
ntnmid[.]dynu[.]net
rhkrgun[.]dynu[.]net
auction[.]dynu[.]net
msdnsmt[.]dynu[.]org
premiatnc[.]dynu[.]org
sunbunbest[.]dynu[.]org
mwkim[.]dynu[.]org
smnoz[.]dynu[.]org
msoinsnt[.]dynu[.]org
bksei[.]dynu[.]org
asmt[.]vnstn[.]dynv6[.]net
cnms[.]dmdoc[.]dynv6[.]net
xn--cnms-kjr[.]dmdoc[.]dynv6[.]net
xn--acnms-gzu[.]dmdoc[.]dynv6[.]net
dmdoc[.]dynv6[.]net
acnms[.]dmdoc[.]dynv6[.]net
store[.]lloizou[.]dynv6[.]net
store[.]metapola[.]dns[.]army
store[.]jptower[.]dns[.]army
store[.]si1901[.]dynv6[.]net
login-accounts[.]dynv6[.]net
vaml[.]schet[.]dns[.]army
store[.]unikoreamc[.]dynv6[.]net
user-kakao[.]login-accounts[.]dynv6[.]net
login[.]account-kakao[.]dynv6[.]net
chromeupdate[.]mydns[.]vc
nldlg[.]dynv6[.]net
ntx-store[.]dynv6[.]net
n-cloud[.]ntx-store[.]dynv6[.]net
118[.]194[.]249[.]91
AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED 🇰🇷
![skocherhan's tweet photo. #Kimsuky #DPRK🇰🇵
udpate[.]nstlog[.]store
ntnmid[.]dynuddns[.]com
ntnmid[.]dynu[.]net
rhkrgun[.]dynu[.]net
auction[.]dynu[.]net
msdnsmt[.]dynu[.]org
premiatnc[.]dynu[.]org
sunbunbest[.]dynu[.]org
mwkim[.]dynu[.]org
smnoz[.]dynu[.]org
msoinsnt[.]dynu[.]org
bksei[.]dynu[.]org
asmt[.]vnstn[.]dynv6[.]net
cnms[.]dmdoc[.]dynv6[.]net
xn--cnms-kjr[.]dmdoc[.]dynv6[.]net
xn--acnms-gzu[.]dmdoc[.]dynv6[.]net
dmdoc[.]dynv6[.]net
acnms[.]dmdoc[.]dynv6[.]net
store[.]lloizou[.]dynv6[.]net
store[.]metapola[.]dns[.]army
store[.]jptower[.]dns[.]army
store[.]si1901[.]dynv6[.]net
login-accounts[.]dynv6[.]net
vaml[.]schet[.]dns[.]army
store[.]unikoreamc[.]dynv6[.]net
user-kakao[.]login-accounts[.]dynv6[.]net
login[.]account-kakao[.]dynv6[.]net
chromeupdate[.]mydns[.]vc
nldlg[.]dynv6[.]net
ntx-store[.]dynv6[.]net
n-cloud[.]ntx-store[.]dynv6[.]net
118[.]194[.]249[.]91
AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED 🇰🇷](https://pbs.twimg.com/media/HPixDKPXsAA8ED-.jpg)
The Flask app uses sandboxed Jinja2. The operator intentionally leaked JWT_SECRET through template rendering but blocked direct #RCE methods, protecting their own infrastructure from other attackers while still exposing sensitive config values.
An open directory on 124.223.221[.]83:9999 (Tencent Cloud, Shanghai) exposes a full #offensive toolkit. #CobaltStrike 4.7, Chrome XXE #exploit, internal network scan results, a web shell, and a custom #C2. Let's break it down. 🧵👇
Found via @Huntio
![_AkatsukiLegion's tweet photo. An open directory on 124.223.221[.]83:9999 (Tencent Cloud, Shanghai) exposes a full #offensive toolkit. #CobaltStrike 4.7, Chrome XXE #exploit, internal network scan results, a web shell, and a custom #C2. Let's break it down. 🧵👇
Found via @Huntio https://t.co/1OR5dAlUh4](https://pbs.twimg.com/media/HRnP7AYWgAEojtQ.jpg)
PHISHING INFRASTRUCTURE ALIVE 🚨
A # leads to multiple nodes hosting the same site
IOCS:
fbi-investingationunit[.]com
digitalassetsreclaim[.]com
www.fbi-sec.globalfundrecoveryunit[.]com
auracyber-investigation[.]com
198.251.84[.]200
172.67.162[.]245
66.85.46[.]67
51.195.95[.]80
![TIE__SUN's tweet photo. PHISHING INFRASTRUCTURE ALIVE 🚨
A # leads to multiple nodes hosting the same site
IOCS:
fbi-investingationunit[.]com
digitalassetsreclaim[.]com
www.fbi-sec.globalfundrecoveryunit[.]com
auracyber-investigation[.]com
198.251.84[.]200
172.67.162[.]245
66.85.46[.]67
51.195.95[.]80 https://t.co/Qz45ZspRuq](https://pbs.twimg.com/media/HRkxQ8CXoAIJu4R.png)
Observed new domain: coliseumdlc[.]xyz distributing a Windows executable #ShinyLoader.exe with #trojan characteristics, including defense evasion and discovery behavior. It currently has 0 detections on #VirusTotal & #QiAnXin
Day 05 of posting #CTI findings everyday for 30 days
![curious_drac0's tweet photo. Observed new domain: coliseumdlc[.]xyz distributing a Windows executable #ShinyLoader.exe with #trojan characteristics, including defense evasion and discovery behavior. It currently has 0 detections on #VirusTotal & #QiAnXin
Day 05 of posting #CTI findings everyday for 30 days https://t.co/pOe0sQzxOh](https://pbs.twimg.com/media/HRjUgWFbcAA3ZiX.jpg)
Updated IOCs:
•finance-gov-pk.fetchdrives[.]info
•pk.fetchdrives[.]info
#SideWinder targets #Pakistan's Finance Division via #phishing domain.
GRANT_OF_DISPARITY_REDUCTION_ALLOWANCE_2026.docx: malicious .docx contacts www-finance-gov-pk.fetchdrives[.]info
.cobaltstrike.beacon_keys: Java-serialized KeyPair, 2 custom #RSA keypairs in the open directory.
Pub key modulus SHA256:
a5e2e4f0264628b44138506c63a8267a1c2db7844e18e61b3e36ed145bf881c0
Priv key modulus SHA256:
5f7ab0ff589c5924a8046db96c4bcb17b96103d8016127fa54f29f652bc3197d
A #CobaltStrike teamserver operation is exposed on 101.42.136[.]73 (Tencent Cloud, Beijing). The #opendirectory contains #beacon keys, #teamserver config, subdomain wordlists, and post-exploitation tooling.
Credits @Huntio
![_AkatsukiLegion's tweet photo. A #CobaltStrike teamserver operation is exposed on 101.42.136[.]73 (Tencent Cloud, Beijing). The #opendirectory contains #beacon keys, #teamserver config, subdomain wordlists, and post-exploitation tooling.
Credits @Huntio https://t.co/kdMWsOeDoK](https://pbs.twimg.com/media/HRYeiX1XwAETkFC.jpg)
Day 3 of posting #CTI findings everyday for 30 days
Suspicious ScreenConnect instance at holtermediainc[.]screenconnect[.]com (15.204.108.63) serving /Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest.
Flagged as #HackTool/#RemoteAdmin/#Trojan
#ScreenConnect #ThreatIntel
![curious_drac0's tweet photo. Day 3 of posting #CTI findings everyday for 30 days
Suspicious ScreenConnect instance at holtermediainc[.]screenconnect[.]com (15.204.108.63) serving /Bin/ScreenConnect.ClientSetup.exe?e=Access&y=Guest.
Flagged as #HackTool/#RemoteAdmin/#Trojan
#ScreenConnect #ThreatIntel https://t.co/zmxGSYBg4t](https://pbs.twimg.com/media/HRZaVB2bwAAdVpp.jpg)
Multiple MFA-themed phishing infrastructures are currently active.🚨
Themes:
mfa-option
mfa-register
mfa-setup
mfa-auth
mfa-enroll
Root domain: mfa-options[.]com first reported by : @SansLimit3 🤝
#threathunting #UNC6671
UNC6671 MFA theme phishing infrastructure 🚨
Ioc update:
chime.mfa-options[.]com
![TIE__SUN's tweet photo. UNC6671 MFA theme phishing infrastructure 🚨
Ioc update:
chime.mfa-options[.]com https://t.co/DJgAQHg1F3](https://pbs.twimg.com/media/HRU3mLSboAA5VFN.jpg)
GOVT #PK PHISHING KIT
#SideWinder targets Pak's KPT, NRTC, and POF via phishing domains dropping malicious .doc files with VBA macro downloaders for C&C and RAT deployment
IOCs:
*mail-kpt-gov-pk.shazad-gids.workers[.]dev
*email-nrtc-com-pk-auth.shazad-gids.workers[.]dev
(1/n)
![curious_drac0's tweet photo. GOVT #PK PHISHING KIT
#SideWinder targets Pak's KPT, NRTC, and POF via phishing domains dropping malicious .doc files with VBA macro downloaders for C&C and RAT deployment
IOCs:
*mail-kpt-gov-pk.shazad-gids.workers[.]dev
*email-nrtc-com-pk-auth.shazad-gids.workers[.]dev
(1/n) https://t.co/0p3BG9F9hM](https://pbs.twimg.com/media/HRTh2K0XEAEor5l.jpg)
A live #Quasar #C2 panel is exposed on 159.223.5[.]148 (DigitalOcean, Amsterdam). The #opendirectory contains the #admin login, #database credentials, #encryption keys, and full bot management interface.
Credits @Huntio
![_AkatsukiLegion's tweet photo. A live #Quasar #C2 panel is exposed on 159.223.5[.]148 (DigitalOcean, Amsterdam). The #opendirectory contains the #admin login, #database credentials, #encryption keys, and full bot management interface.
Credits @Huntio https://t.co/R2PfjWLBq8](https://pbs.twimg.com/media/HROaVr2acAAAQx_.png)
Most Popular Users
Elon Musk 
@elonmusk
241.6M followers
Barack Obama
@barackobama
119M followers
Cristiano Ronaldo
@cristiano
114.1M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107.2M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.4M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
89.9M followers
Taylor Swift
@taylorswift13
83.8M followers
Lady Gaga
@ladygaga
75.3M followers
Virat Kohli
@imvkohli
73.1M followers
Kim Kardashian
@kimkardashian
70.8M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
66.1M followers
Bill Gates
@billgates
65M followers
Selena Gomez
@selenagomez
62.9M followers
The Ellen Show
@theellenshow
62.3M followers
CNN
@cnn
61.8M followers
X
@x
60.7M followers