th3_protoCOL, 4 months ago

@briankrebs Here's some recent evidence involving the IP address 93.190.143.252 you mentioned earlier

briankrebs, 4 months ago

@th3_protoCOL Thanks. How recent? I.e., where did those screenshots of the search results come from?

th3_protoCOL, 4 months ago

@briankrebs I did that search and took those screenshots myself just prior to posting on mastodon last night (edited the post with the VT file submission)

This threat actor has been using google ads around "parsec" and "freecad" to distribute heavily obfuscated digitally signed malware since at least January 16th.

Here's a screenshot from a search done on 1/16 that redirected to freecadusa[.]net and used dropbox to download the executable.

Since then they've changed from hosting the malware download from dropbox to their own domains

briankrebs, 4 months ago

@th3_protoCOL Outstanding! Thank you. Mind if I reference these in a story?

th3_protoCOL, 4 months ago

@briankrebs of course! Looking forward to reading about it :)