OPSEC Failure Exposes Coquettte’s Malware Campaigns on Bulletproof Hosting Servers
An inexperienced cybercriminal has been seen using Proton66, a Russian bulletproof hosting (BPH) provider, to help them with their operations.
DomainTools, which identified the behavior after spotting a fraudulent website called cybersecureprotect[.]com that was hosted on Proton66 and impersonated an antivirus program, provided the findings.
The threat intelligence company claimed to have discovered an operational security (OPSEC) breach in the domain that disclosed its malicious infrastructure and made the malicious payloads that were staged on the server visible.
According to a report shared with The Hacker News, this discovery "led us down a rabbit hole into the operations of an emerging threat actor known as Coquettte," an amateur cybercriminal who uses Proton66's impregnable...