Known malicious kitcriticalother

BlueMoon / ShadowPad - C2 host contacted by a scanned page

family: bluemoon-shadowpad-2026-09

A scanned page that CONTACTS the actor's infrastructure - the compromised-victim case, rather than someone scanning the C2 itself. Indicators from Proofpoint's "Once in a BlueMoon" report (2026-09).

Anchors

SMQL queryrun

contacted_host:secboxes.com OR contacted_host:checrity.com OR contacted_host:ms.checrity.com OR contacted_host:evidence.msbenefit.com OR contacted_host:homepage.brianwilli.com OR contacted_host:download.secboxes.com OR contacted_host:api-prod.secboxes.com OR contacted_host:project.secboxes.com OR contacted_host:recommendation-letter.secboxes.com OR contacted_host:data.attcdn.com OR contacted_host:dns.elixnovorem.com OR contacted_host:dns.getaiexo.com OR contacted_host:publish.openlumakora.com OR contacted_host:wcce.joinmacket.com OR contacted_host:vncdc.mailtbox.workers.dev

Provenance

Added: 2026-09-12 10:36

Exact hostnames only; other subdomains are not matched.

References:

https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit

Sightings (1)

Host	Scan	Script	Match	When
secboxes.com	56c9c5c0…	—	query	2026-09-15 01:51