Check Point Research Maps TDS-Driven Malware Operation Through DNS Analysis
Summary
Check Point Research traced fake project portals to CloudFront-hosted JavaScript staging and gated TDS redirects that led selected users toward RemusStealer, AnimateClipper, and SessionGate. DNS and WHOIS analysis expanded the investigation to 30 network IoCs.
Key points
- Fake portals impersonated open-source and freeware projects to attract search traffic; user clicks triggered redirects.
- A CloudFront-hosted JavaScript staging layer routed selected users through a gated traffic distribution system (TDS) toward infrastructure associated with RemusStealer, AnimateClipper, and the SessionGate framework.
- Researchers expanded an initial set of 27 network IoCs into 30 indicators: eight subdomains, 19 domains, and three IP addresses.
- Traffic analysis found 22 IP addresses potentially belonging to victims communicating with two IP IoCs; a separate client IP queried a domain IoC.
- WHOIS and reverse-WHOIS analysis linked 15 IoC domains to 22 unique email addresses and identified 2,892 email-connected domains; threat-intelligence queries marked 11 of those domains as malicious.
- Further analysis identified 26 additional IP addresses marked malicious, 23 IP-connected domains (10 marked malicious), and 157 string-connected domains.
- At the time of reporting, all 16 domain IoCs with historical resolutions continued to resolve; only one IP IoC still showed domain resolutions in 2026.
Article Details
- Attack Vectors
- Deceptive sites impersonating open-source and freeware project portals attracted search traffic.
- User clicks triggered redirects through a CloudFront-hosted JavaScript staging layer and a gated traffic distribution system.
- Selected users were redirected toward malware delivery infrastructure associated with RemusStealer, AnimateClipper, and the SessionGate framework.
- Defensive Notes
- The researchers advised treating subdomains under brightcanvas[.]digital and hugo-lapp[.]lat as worth avoiding.
- The article recommends supplementary investigation to corroborate entities identified as threats, since some may later prove harmless or change context.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | appfreshstart[.]com | Listed as a domain IoC in the researchers' historical domain-to-IP resolution analysis. |
| DOMAIN | appgetonline[.]com | Listed as a domain IoC in the researchers' historical domain-to-IP resolution analysis. |
| DOMAIN | brightcanvas[.]digital | Apex domain associated with the project-impersonation infrastructure; the researchers reported it remained live. |
| DOMAIN | carlessclapped[.]com | Domain IoC that the researchers said was likely registered with malicious intent. |
| DOMAIN | hugo-lapp[.]lat | Apex domain associated with a subdomain family the researchers described as suspended or abusive. |
| DOMAIN | ropea[.]top | Domain IoC identified in a typosquatting group alongside four look-alike domains. |
| DOMAIN | rosca[.]cn | Identified as a look-alike member of the typosquatting group associated with ropea[.]top. |
| DOMAIN | rosca[.]health | Identified as a look-alike member of the typosquatting group associated with ropea[.]top. |
| DOMAIN | rosea[.]lat | Identified as a look-alike member of the typosquatting group associated with ropea[.]top. |
| DOMAIN | rozea[.]co | Identified as a look-alike member of the typosquatting group associated with ropea[.]top. |
| DOMAIN | webcrcprove[.]com | Listed as an example domain IoC in the operation's historical DNS-resolution analysis. |
| DOMAIN | webinnosetup[.]com | Listed as a domain IoC in the researchers' historical domain-to-IP resolution analysis. |
| HOSTNAME | cdn-1415[.]brightcanvas[.]digital | Identified as a subdomain IoC in the project-impersonation ecosystem; it had live DNS records and pointed to Cloudflare CDN IP addresses. |
| HOSTNAME | cw[.]hugo-lapp[.]lat | Identified as a subdomain IoC in an infrastructure family the researchers described as suspended or abusive. |
| HOSTNAME | ed[.]hugo-lapp[.]lat | Identified as a subdomain IoC in an infrastructure family the researchers described as suspended or abusive. |
| IPV4 | 217[.]156[.]122[.]75 | One of the operation's IP IoCs; the researchers reported 265 historical IP-to-domain resolutions for it. |
MITRE ATT&CK
T1036 · MasqueradingThe operation used sites designed to resemble legitimate open-source and freeware project portals.T1090 · ProxyA gated traffic distribution system and redirect chains routed selected users toward downstream infrastructure.T1204 · User ExecutionUser clicks and other interactions triggered redirects through the operation's staging and traffic-distribution infrastructure.T1583.001 · DomainsThe operation used numerous project-impersonation domains and subdomains, including domains the researchers identified as likely malicious registrations.
Malware
AnimateClipperThe traffic was funneled through a CloudFront-hosted JavaScript staging layer and TDS chains that ultimately pointed selected users to RemusStealer, AnimateClipper, and the SessionGate framework.RemusStealerThe traffic was funneled through a CloudFront-hosted JavaScript staging layer and TDS chains that ultimately pointed selected users to RemusStealer, AnimateClipper, and the SessionGate framework.