Under the DNS Hood of an Ongoing Legacy MSHTA Tool Attack

Bitdefender recently detailed¹ how attackers continue to abuse Microsoft’s legacy MSHTA utility to deliver malware across several campaigns. In one of the most prominent clusters, threat actors used the HTA-based loader CountLoader to deploy the LummaStealer and Amatera infostealers, which are built to harvest credentials, browser-stored data, session tokens, and cryptocurrency-related information from infected systems.

Bitdefender’s research publicized 128 network IoCs across subdomains, domains, and IP addresses. Aided by the WhoisXML API MCP Server², we narrowed these to 120 IoCs for our investigation, after filtering out inactive or legitimately owned domains.

Using our homegrown tools to investigate the threat, we uncovered these findings:

• 17 unique client IP addresses that communicated with 28 of the domain IoCs
• Four domain IoCs that appeared in three typosquatting groups with 3–9 members each
• 20 domain IoCs that were likely registered with malicious intent
• 618 unique IP addresses potentially owned by victims that communicated with 25 of the IP IoCs
• 2,260 email-connected domains, 56 of which were confirmed malicious
• 42 additional IP addresses, all of which were confirmed malicious
• 96 IP-connected domains, 17 of which were confirmed malicious
• 1,571 string-connected domains, five of which were confirmed malicious

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://www.bitdefender.com/en-us/blog/labs/microsofts-mshta-legacy-malware-windows
• [2] https://main.whoisxmlapi.com/ai/mcp-server