Known malicious kithighother
Arra Ghouls: Arra RAT loader servers posing as Yandex, Mail.ru and office-software telemetry
family: arra-ghouls-c2-2026-11
Short link:scanmalware.com/h/361
Loader and command-and-control servers of Arra RAT, a modular Go remote-access tool used by Arra Ghouls, a group that sends archive and installer lures to organisations in Russia and Belarus. The servers take names that look like update or telemetry hosts for Yandex, Mail.ru, the Max messenger and Russian office software. They answer every ordinary web request with an empty HTTP 405 from nginx and hand a payload only to the group's own loader, so a visitor's browser never sees anything malicious on them.
Anchors
SMQL queryrun
(http_status:405 AND NOT http_status:200 AND (primary_asn:48282 OR primary_asn:33993 OR primary_asn:50053)) OR contacted_host:max-telemetry.online OR contacted_host:update-yandexbrowser.ru OR contacted_host:checker.yandex-update.ru OR contacted_host:yandex-tel.tech OR contacted_host:yadex.tech OR contacted_host:cdn.yadex.tech OR contacted_host:yandex-dzen.tech OR contacted_host:browser.ydx-stat.ru OR contacted_host:crash.reporting.u.ya-user-experience.ru OR contacted_host:gamma.ya-user-experience.ru OR contacted_host:iwannalove1.ya-user-experience.ru OR contacted_host:myworld-tel.online OR contacted_host:videomost.onlineProvenance
Added: 2026-11-10 23:45
Matches the known hosts, and servers on the group's usual hosting networks that answer with nothing but HTTP 405. The group moves its servers every few weeks and registers new names in batches, so the host list ages quickly. A web scan cannot retrieve the payload from these servers: treat a sighting as infrastructure tracking, and confirm any new host before relying on it.
Sightings (22)Atom feed
| Host | Scan | Script | Match | Scanned |
|---|---|---|---|---|
| checker.yandex-update.ru | 9cbd12d5… | — | query | 2026-11-11 00:33 |
| videomost.online | 3efbf838… | — | query | 2026-11-11 00:33 |
| myworld-tel.online | fe6a4c3c… | — | query | 2026-11-11 00:33 |
| browser.ydx-stat.ru | 704ebc71… | — | query | 2026-11-11 00:33 |
| yandex-dzen.tech | a228c8cc… | — | query | 2026-11-11 00:33 |
| yadex.tech | eea02380… | — | query | 2026-11-11 00:33 |
| max-telemetry.online | 757d0ebd… | — | query | 2026-11-11 00:33 |
| videomost.online | 95927746… | — | query | 2026-11-10 23:31 |
| myworld-tel.online | afc58232… | — | query | 2026-11-10 23:27 |
| checker.yandex-update.ru | 7e8c7af7… | — | query | 2026-11-10 23:27 |
| gamma.ya-user-experience.ru | cfcce7fb… | — | query | 2026-11-10 23:27 |
| iwannalove1.ya-user-experience.ru | 326dabc3… | — | query | 2026-11-10 23:27 |
| crash.reporting.u.ya-user-experience.ru | 4b3b5e79… | — | query | 2026-11-10 23:27 |
| browser.ydx-stat.ru | f33c3de8… | — | query | 2026-11-10 23:27 |
| yandex-dzen.tech | bf345d68… | — | query | 2026-11-10 23:27 |
| cdn.yadex.tech | 6d50d922… | — | query | 2026-11-10 23:27 |
| yadex.tech | 01218ad6… | — | query | 2026-11-10 23:27 |
| yandex-tel.tech | bcea369a… | — | query | 2026-11-10 23:27 |
| update-yandexbrowser.ru | 4c06709c… | — | query | 2026-11-10 23:27 |
| max-telemetry.online | 832be9a4… | — | query | 2026-11-10 23:27 |
| max-telemetry.online | a98881cb… | — | query | 2026-11-10 23:27 |
| update-yandexbrowser.ru | cf31d2ae… | — | query | 2026-10-16 23:13 |