Known malicious kitcriticalphishing

RCFH AiTM toolkit — .digital proxy cohort (Payroll Pirates / Storm-2755)

family: rcfh-aitm-storm2755

The older, pre-rotation naming generation of the same AiTM authentication proxy: seven .digital domains built from generic corporate-sounding compounds, several with a hyphen inserted mid-word to dodge string matching (wisemediapa-ttern, xsyst-emsquantum, tec-hnoplatform2025). Arctic Wolf tied these back to the toolkit because they exposed the same /st_58200519/class_identifier.php fingerprinting path as the current 'ms'-labelled generation, despite sharing none of its naming conventions. All were reported defunct as of 2026-07-30.

Anchors

YARA ruleDetect_RCFH_AiTM_Geofence_Redirect

SMQL queryrun

domain:*wisemediapa-ttern.digital OR domain:*sky2025forge.digital OR domain:*skyprimeworks.digital OR domain:*1systemsevolve.digital OR domain:*xsyst-emsquantum.digital OR domain:*tec-hnoplatform2025.digital OR domain:*evolveelevateunion.digital

Provenance

Added: 2026-08-10 20:57

Kept as a separate entry because the attribution differs in kind: six of the seven domains are also listed in public threat data as Interlock-associated rather than as BEC infrastructure, so a sighting here is best read as a possible overlap between this AiTM toolkit and Interlock infrastructure rather than as a clean Storm-2755 hit. Paired with the geofencing YARA rule rather than the fingerprint-path rule, so the two entries produce distinguishable sightings.

References:

Sightings (0)Atom feed

No sightings recorded yet.