Known malicious kitmediumother
DarkMe — single-source infrastructure leads (Breakglass 2026-03, attribution UNCONFIRMED)
family: darkme-griffith-2026-09
Short link:scanmalware.com/h/193
Two domains reported as historical DarkMe infrastructure by a single source (Breakglass, "The Sentinel Variant", published 9 March 2026): russia978.sytes.net and mastrrokiakivasai.com. The attribution has not been independently corroborated, neither domain is confirmed as Griffith infrastructure, and the publication date is not a date the infrastructure was observed. Matches scans of these domains and pages that contact them. Kept separate from the vendor-published indicators so that a match is not read as vendor-confirmed.
Anchors
SMQL queryrun
domain:russia978.sytes.net OR domain:mastrrokiakivasai.com OR contacted_host:russia978.sytes.net OR contacted_host:mastrrokiakivasai.comProvenance
Added: 2026-09-17 14:40
Conflicting classification: other public threat lists label mastrrokiakivasai.com as Remcos rather than DarkMe. sytes.net is a dynamic-DNS service shared by unrelated customers, so only the exact hostname is matched.
Sightings (0)
No sightings recorded yet.