Risk Alert: "Black Cat" Cybercriminal Group Targeted Attack Campaign

Published by: China National Computer Network Emergency Response Technical Team/Coordination Center (CNCERT) and DBAPPSecurity Co., Ltd. (https://www.dbappsecurity.com.cn/content/details4756_46730.html)

(Translated / Summarized by WXA Deep Research) 

Executive Report

China's CNCERT and DBAPPSecurity uncovered a sophisticated SEO poisoning campaign by the “Black Cat” cybercrime group. Attackers pushed malicious sites to the top of search results, falsely labeled them as “official,” and tricked users into downloading trojanized installers. Once executed, these installers connected to attacker-controlled C2 servers, enabling remote and persistent control of infected devices.

• SEO Poisoning Technique: Malicious sites mimicked official software pages to rank high in searches.
• Typosquatting Domains: Attackers used “mlcrosoft” typo domains, like fyat.mlcrosoft[.]cyou and fymaimai.mlcrosoft[.]asia to deceive users.
• Shared Malicious Infrastructure: These domains resolved to 114.114.114.114 (Zenlayer IP), part of a large IP range hosting many suspicious domains.
• Infection Scale:  From June 1 to July 28, 2025, about 28,800 Chinese hosts were infected, peaking at 2,328 daily. Trojans used RC4 and “IDAT” markers to unpack malware and maintain C2 connections.

Malicious Domain Infrastructure Analysis

The attackers registered multiple domains that closely resemble legitimate Microsoft sites. As noted, fyat.mlcrosoft[.]cyou and fymaimai.mlcrosoft[.]asia are the primary examples.

CNCERT’s analysis also noted that all these look-alike domains redirected to the same IP address. The malware’s loader checked the fake domains as an initial step. In each case, the DNS lookup returned 114.114.114.114, confirming the domains are hosted together.

Building on this, WhoisXML API identified 10 Microsoft typosquatting domains hosted on the same IP address (208.91.197.91) through reverse DNS and IP geolocation. These domains are focused on impersonating the Microsoft ecosystem and employ a variety of abuse techniques.

DNS and Related Infrastructure

In addition to the two main domains, the campaign involved hundreds of spoofed domains using the “mlcrosoft” typo and other Microsoft-like names. CNCERT’s IOC list includes phishing sites like www.imqqd[.]com and i4.com[.]vn, which mimicked real software pages to spread trojans. The malicious domains and C2 servers were registered around the same time. The shared IP, 114.114.114.114 (Zenlayer), hosts over 270 domains—many likely suspicious. Attackers may have used Cloudflare or similar CDNs with different nameservers to obscure their infrastructure and enhance stealth.

WHOIS history analysis provided further attribution signals tied to these malicious domains.

• imqqd.com — Historical records from 2017 list the registrant, admin, and technical contact as [email protected], associated with Maxime Sahroui of the RANQED organization, Belgium.
  
• tk9885.com — Historical records from 2018–2019 show the proxy email [email protected], which provides no useful attribution value.
  
• Expanding on this, subsequent WHOIS queries on [email protected] identified the following domain footprint:
• Currently active domains (2):
  • mademore.xyz
  • epqstd.xyz
    
• Historically linked domains (14 total):
  • nodicorns.com
  • wearenodicorns.com
  • nodicorn.com
  • imqqd.com (from IoC list)
  • zweihq.xyz
  • stateless.xyz
  • stateless.today
  • scaleout.xyz
  • adonix.xyz
  • rocketfee.com
  • mademore.xyz
  • epqstd.xyz
  • epoqstudio.com
  • histart.co
    

This clustering around a single exposed email address suggests a broader historical domain portfolio, with most registrations either expired or updated to privacy-protected WHOIS records in recent years.

Campaign Scale and Indicators

From June 1 to July 28, 2025, about 28,800 hosts in China were compromised. The infection peaked with 2,328 new hosts daily and up to 18,913 daily C2 connections. CNCERT notes the trojan uses embedded “IDAT” markers; the next 16 bytes serve as an RC4 key to decrypt the malware at run-time, making static detection difficult. Two main cases show the attack chain in detail:

• Case 1 – Fake QQ Installer: The phishing domain www.imqqd[.]com delivered a bundled installer that ran fgUSymqzvm.exe, which loaded Y6vv.dll. It checked the environment via fyat.mlcrosoft[.]cyou, decrypted a file using “IDAT” markers and RC4, then connected to xat.tk9885[.]com on port 45 for remote control.

After unzipping:

File Directory:

• Case 2 – Fake Software Downloader: The phishing domain i4.com[.]vn hosted a bundled installer running stQkSAAC.exe, which loaded KpKUt8.dll. It checked the environment via fymaimai.mlcrosoft[.]asia, decrypted a file using RC4-IDAT, then connected to mm.opi6qi5k[.]com (143.92.60.214) for C2.

After unzipping:

File directory:

These cases confirm the multi-stage infection process (phishing site → trojan installer → loader DLL → decryption → final RAT) and identify the key infrastructure (fake domains and C2 servers).

Key Indicators of Compromise (IOCs)

Phishing Domains:

www.imqqd[.]com
i4.com[.]vn

Callback Domains:

fyat.mlcrosoft[.]cyou
fymaimai.mlcrosoft[.]asia

C2 Servers:

xat.tk9885[.]com (202.79.175.117)
mm.opi6qi5k[.]com (143.92.60.214)

Sample Hashes:

<ul>
<li>f86ecc767faa13fd8dc55d51878d3cc6</li>
<li>9d32902ad0d9f44e7f594d97d0fb88ab</li>
</ul>

Defense and Mitigation Recommendations

CNCERT’s advisory emphasizes standard cybersecurity hygiene along with targeted defenses for this threat:

• Use Official Software Sources: Always download software from official sites or trusted stores, verify file hashes, and scan with antivirus to avoid SEO-poisoned links
• Beware Untrusted Links: Don’t click unknown search results or install from untrusted sites; attackers fake “official” labels.
• Deploy Endpoint Protection: Keep endpoints updated with antivirus/EDR and run regular scans to detect suspicious activity.
• Monitor DNS and Domains: Monitor for “mlcrosoft” domains and block 114.114.112.0/21 or typosquats to disrupt attackers.
• Incident Response: If malware is found, isolate the host, check for C2 communications, remove artifacts, and investigate the infection source.

Key Takeaways

The “Black Cat” SEO poisoning campaign demonstrates a highly evolved threat actor exploiting search engine trust to spread malware. Key lessons include:

• Search Engine Manipulation: Attackers boost fake sites to top search results, falsely labeled official. Don’t trust rankings blindly.
• Typosquatting at Scale: Thousands of look-alike domains around “Microsoft” were registered. Ongoing domain monitoring is vital.
• Persistent Multi-Stage Malware: Trojans used layered obfuscation (installers, loaders, RC4 encryption) to evade detection. Behavior-based detection is needed.
• Large Infection Footprint: Nearly 30,000 machines infected in 2 months shows SEO poisoning’s reach, and vigilance is crucial even for strong enterprises.