Vultr

Reported Context (3)

managing 42 VPS nodes over the campaign lifecycle — primarily hosted by The Constant Company LLC (Vultr) — configured with the "offy" phishlet targeting Microsoft 365 exclusively. The operator, using the alias CloudSEK Details BigBear 2.0 Evilginx2 Campaign That Hijacked Microsoft 365 Sessions
Connections to 137[.]220[.]59[.]55 (ASN AS20473 AS-VULTR) indicated that the communications were likely routed via a virtual private server (VPS) hosted by Vultr. Behavioral Detection Traced a Three-Day Ransomware Intrusion from VPN Access to Encryption
Of the 19 IPs linked to the previously discussed TLS record, 18 were hosted by Vultr on The Constant Company ASN, while Psychz Networks hosted one. Geographically, most of the infrastructure was based in the United TLS Certificate Analysis Links Cyberhaven Extension Attack to Long-Running Infrastructure

People (3)

Threat Actors (7)

MITRE ATT&CK (31)

Vendors (7)

Products (12)

Tools (11)

Industries (5)

Countries (7)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.