Known malicious kitcriticalother
BlueMoon / ShadowPad - C2 host contacted by a scanned page
family: bluemoon-shadowpad-2026-09
A scanned page that CONTACTS the actor's infrastructure - the compromised-victim case, rather than someone scanning the C2 itself. Indicators from Proofpoint's "Once in a BlueMoon" report (2026-09) and MISP event 22904. SMQL hunts are DETECTORS, not verdict rules: match_tier 'smql' is excluded from both engines' verdict paths by design, so this collects sightings and shows a banner. Flooring for these indicators comes from the MISP feed via ioc-matcher.
Anchors
SMQL queryrun
contacted_host:secboxes.com OR contacted_host:checrity.com OR contacted_host:ms.checrity.com OR contacted_host:evidence.msbenefit.com OR contacted_host:homepage.brianwilli.com OR contacted_host:download.secboxes.com OR contacted_host:api-prod.secboxes.com OR contacted_host:project.secboxes.com OR contacted_host:recommendation-letter.secboxes.com OR contacted_host:data.attcdn.com OR contacted_host:dns.elixnovorem.com OR contacted_host:dns.getaiexo.com OR contacted_host:publish.openlumakora.com OR contacted_host:wcce.joinmacket.com OR contacted_host:vncdc.mailtbox.workers.devProvenance
Added: 2026-09-12 10:36
Exact hosts on purpose: the wildcard form (contacted_host:*secboxes.com) cannot use the GIN index on the jsonb host arrays and TIMED OUT at 15s when measured, which would have made this row fail on every re-evaluation while looking installed. Exact form measured at 7.1s. 15 nodes. 0 matches at creation.
Sightings (0)
No sightings recorded yet.