Hudson Rock Adds Threat Feeds for Infostealer C2, ClickFix and PhaaS Infrastructure
Summary
Hudson Rock’s Cavalier platform has added feeds monitoring infostealer C2 hosts, malicious ClickFix sites and phishing-as-a-service infrastructure, with credential telemetry and REST API access for security teams.
Key points
- The C2 feed covers observed infostealer command-and-control hosts, including malware-family, infrastructure and activity details.
- The ClickFix feed surfaces malicious sites, clipboard-injected commands, CAPTCHA indicators and screenshots.
- The PhaaS feed tracks phishing hosts, kits, resolved IPs and server infrastructure.
- All three feeds correlate hosting infrastructure with infostealer credential telemetry, which the company says can help identify how hosts were compromised.
- REST APIs provide access to feed data for integration with security systems and perimeter controls.
- The article describes a past Artlist subdomain compromise in which stolen WordPress credentials were used to inject a ClickFix payload.
Article Details
- Event Type
- Hudson Rock introduced three threat-feed modules in Cavalier: C2 Data, ClickFix, and PhaaS.
- Impact
- The feeds are intended to help security teams monitor infostealer C2 hosts, malicious ClickFix sites, and phishing-as-a-service infrastructure, and to support proactive blocking. The article describes product capabilities and examples, not a newly reported breach or measured impact from the launch.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | garage-door-repair[.]cyou | Presented as PhaaS infrastructure running the Eviltokens kit. |
| DOMAIN | myrtler[.]biz | Presented as an infostealer C2 host associated with the Vidar malware family. |
| DOMAIN | solaric[.]com[.]ph | Described as a compromised business domain weaponized to deliver ClickFix malware. |
| DOMAIN | webcindario[.]com | Presented as a PhaaS host domain with compromised employee credentials associated with it. |
| IPV4 | 43[.]172[.]6[.]35 | Identified as an IP node tied to Kali365 phishing-kit operations. |
Malware
RedLineSpecific infostealer C2 examples (Redline, Vidar, Stealc, etc.) enriched with correlated infection data from Hudson Rock’s cybercrime intelligence database, revealing compromises associated with the server.StealCSpecific infostealer C2 examples (Redline, Vidar, Stealc, etc.) enriched with correlated infection data from Hudson Rock’s cybercrime intelligence database, revealing compromises associated with the server.VidarSpecific infostealer C2 examples (Redline, Vidar, Stealc, etc.) enriched with correlated infection data from Hudson Rock’s cybercrime intelligence database, revealing compromises associated with the server.
Vendors
AdobeA freelance developer unwittingly downloaded a pirated copy of Adobe Acrobat PRO DC, infecting their machine.Hudson RockSpecific infostealer C2 examples (Redline, Vidar, Stealc, etc.) enriched with correlated infection data from Hudson Rock’s cybercrime intelligence database, revealing compromises associated with the server.
Products
Adobe Acrobat PRO DCA freelance developer unwittingly downloaded a pirated copy of Adobe Acrobat PRO DC, infecting their machine.CavalierIntroducing Cavalier’s New Threat Feeds: Comprehensive Visibility into Attacker InfrastructureWordPressHudson Rock cybercrime intelligence revealing infostealer credentials associated with solaric.com.ph’s WordPress admin panel.