Known malicious kitcriticalother
BlueMoon / ShadowPad - C2 and staging domains
family: bluemoon-shadowpad-2026-09
Short link:scanmalware.com/h/178
A scan whose entry or final URL is on the actor's own C2 / payload-staging infrastructure, or that resolves to 79.133.56.90. Indicators from Proofpoint's "Once in a BlueMoon" report (2026-09).
Anchors
SMQL queryrun
domain:*secboxes.com OR domain:*checrity.com OR domain:*msbenefit.com OR domain:*brianwilli.com OR domain:*attcdn.com OR domain:*elixnovorem.com OR domain:*getaiexo.com OR domain:*openlumakora.com OR domain:*joinmacket.com OR domain:*velodynaity.com OR domain:*fracons.com OR ip:79.133.56.90Provenance
Added: 2026-09-12 10:36
Domain terms use a leading wildcard, so they match each domain, its subdomains, and any longer name ending in the same string. A look-alike on a different TLD (for example google.co) does not match the brand's real .com domain.