ThreatLabz Finds Conflict-Themed Scams and Malware Campaigns Amid Middle East Tensions
Summary
ThreatLabz identified more than 8,000 conflict-themed domains and campaigns using lures, phishing sites, scams, and redirects to deliver StealC and the LOTUSLITE backdoor.
Key points
- ThreatLabz found over 8,000 newly registered domains using keywords related to the Middle East conflict; many were inactive when analyzed.
- Active domains included conflict-themed blogs, games, storefronts, meme-coins, and scam or betting Progressive Web Apps.
- A conflict-themed lure posing as a report about missile strikes in Bahrain was among the cases examined.
- Another campaign used a conflict-themed lure and DLL sideloading to deliver the LOTUSLITE backdoor.
- Fake news blogs redirected users to StealC malware; the article provides associated file hashes and command-and-control indicators.
- ThreatLabz also identified fake government and payment phishing sites, donation and storefront scams, and meme-coin promotions consistent with pump-and-dump schemes.
Article Details
- Event Type
- Opportunistic cyber campaigns exploiting Middle East conflict themes, including malware delivery, phishing, scams, and suspicious payment schemes.
- Impact
- Campaigns use conflict-themed lures to deliver StealC and the LOTUSLITE backdoor, and fake government and payment sites to collect victim data. ThreatLabz identified over 8,000 newly registered conflict-related domains; most had no content at the time of analysis and may be weaponized later.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | arch[.]megadatahost1[.]lol | Domain listed as hosting StealC. |
| DOMAIN | arch2[.]maxdatahost1[.]cyou | Domain listed as hosting StealC. |
| DOMAIN | arch2[.]megadatahost1[.]lol | Domain listed as hosting StealC. |
| DOMAIN | flourishingscreencousin[.]com | Domain listed as redirecting users in the StealC campaign. |
| DOMAIN | holidayslettucecircumvent[.]com | Domain listed as redirecting users in the StealC campaign. |
| DOMAIN | media[.]hyperfilevault2[.]mom | Domain listed as hosting StealC. |
| DOMAIN | media[.]maxdatahost1[.]cyou | Domain listed as hosting StealC. |
| DOMAIN | media[.]megadatahost1[.]lol | Domain listed as hosting StealC. |
| DOMAIN | media[.]megafilehost2[.]sbs | Domain listed as hosting StealC. |
| IPV4 | 172[.]81[.]60[.]97 | C2 IP address listed for the LOTUSLITE campaign. |
| IPV4 | 80[.]97[.]160[.]190 | C2 address listed for StealC. |
| MD5 | 098bc0dd6a02a777fabb1b7d6f2da505 | MD5 hash listed as a StealC indicator. |
| MD5 | 10fb1122079b5ae8e4147253a937f40f | Hash of the stage 2 DLL identified as LOTUSLITE. |
| MD5 | 6accd57e48c34cadc998d00594229e42 | Hash of the malicious stage 1 DLL in the LOTUSLITE campaign. |
| MD5 | 8c5a4dafed1586cec48d8eda267d8e42 | Hash of decrypted shellcode in the LOTUSLITE campaign. |
| SHA1 | 7d4e31c8b11be7c970860c4fbc8fe85c70724cb1 | Hash of the stage 2 DLL identified as LOTUSLITE. |
| SHA1 | b9dfc411699e07343b9b95daa79fe7e4b6811579 | Hash of decrypted shellcode in the LOTUSLITE campaign. |
| SHA1 | be34901237c9fa9563e8dc9e71faf3a7e68f983f | Hash of the malicious stage 1 DLL in the LOTUSLITE campaign. |
| SHA256 | 24b11b4b999b385bede48ad9f0570e2e5da4a2054b96738b1e4d4946ece94bc1 | Hash of decrypted shellcode in the LOTUSLITE campaign. |
| SHA256 | 4fb9b5d115bceee45a89447fb2565faef07452cda6b8e244e53ad91499c3d9b5 | Hash of the malicious stage 1 DLL in the LOTUSLITE campaign. |
| SHA256 | 8564763407064117726211ff8f89555e5a3b2b70bc9667032abd69cbe53b5216 | Hash of the stage 2 DLL identified as LOTUSLITE. |
MITRE ATT&CK
Malware
LOTUSLITEa PDF about missile strikes in Bahrain, a malware chain that uses a conflict-themed lure to deliver the LOTUSLITE backdoor via DLL sideloading, and a fake news blog campaign that redirects users to StealC malware. WeStealCdeliver the LOTUSLITE backdoor via DLL sideloading, and a fake news blog campaign that redirects users to StealC malware. We also detail fake government and payment phishing sites designed to collect victim data,