iiinova — where your digital self keeps evolving

StrikeReady Labs @strikereadylabs.com · 13/08/2026

#apt targeting the Indian gov a6f27d0a4844c725a9d3bf916b59df24c3f440a63c567329fda87c99f80529fb Indl Case List 2026.pdf.lnk 9ec2fcf125890ad69155a3343399f7e704ae0edb9873dcd38448415398ed81c5 Indl Case List 2026.rar a5a9b99066d1d27899506a2bf138da3289f9c33fc4dc5b8fd76be9c32c2bf90a powerpoint.bat

000

StrikeReady Labs @strikereadylabs.com · 31/07/2026

#apt 7d35283f975f9d7a2ff335706527771bf3d7e75f8b6c8762f6165adcfe8d2cf5 ASEAN Semiconductor Roadmap 2026_2030_Draft v0 (For Input)_for ATF-JCC.docx web-api.nrilsnalnrlne.workers[.]dev

020

StrikeReady Labs @strikereadylabs.com · 28/07/2026

these scams are pretty solid. they grab the list of applications from publicly hosted "construction permit" type city governments, and then send you a relatively small invoice to pay for "approval".

000

StrikeReady Labs @strikereadylabs.com · 28/07/2026

interesting #dailyphish using shopify's CDN for hosting payload cdn.shopify[.]com/s/files/1/0743/9509/1080/files/Document_for_your_review.pdf?v=1784829484

001

StrikeReady Labs @strikereadylabs.com · 22/07/2026

"send me money please" continues to be an effective scam with very little downside

000

StrikeReady Labs @strikereadylabs.com · 17/07/2026

#in #apt targeting Sri Lanka, by faking an email to the @un.org and bcc-ing the target easygoing-exploration-production-7b0f.up.railway[.]app/?uasnxcias_pdf2Server_id7378dQ=1 continuing to abuse the free Railway for hosting.

010

StrikeReady Labs @strikereadylabs.com · 25/06/2026

41f221c65129e820ab85b578ca44651e8bda5eaa6df5bb4858566480518dcbc6 Certificate.pdf

000

StrikeReady Labs @strikereadylabs.com · 25/06/2026

f726dc8a5fd8026b16a5c3aa62a82ab7614247a5315c3a6c2a5c37b976b73775 214227.pdf

100

StrikeReady Labs @strikereadylabs.com · 25/06/2026

susp #unc1151 4ba59e9262c8023a2e365c7177de9dbeb3216ea446d1a399c0b458cd2c05d625 64_01_2026.pdf

100

StrikeReady Labs @strikereadylabs.com · 03/06/2026

Always interesting to see what a live phish from #unc1151 looks like 845474a60e029ac8b361a89edfee507d59318c52c6e48f36e6bd30626f09b3f0 Certificate.pdf

000

StrikeReady Labs @strikereadylabs.com · 03/06/2026

3152cb01dddc95ce5d14d45b9b0e33f5b107a4d3dce64f47efba24cbad406cfb CERTYFIKAT_Nr_312-05-2025.wsf #apt

000

StrikeReady Labs @strikereadylabs.com · 03/06/2026

edb3b8ef7949fad5a5c0b88f744e4e4a2acd40fe287bec8604ebe8dee9ab3a51 ASEAN 2026 Attendance Meeting (2).zip typical apt lure, but with ransomware filenames, makes this researcher call shenanigans

000

StrikeReady Labs @strikereadylabs.com · 01/05/2026

#malware #dailyopendir meetingszoom[.]com b91ca87a2ce64f025c27a4a7d58f4b61f7b9b043251abab0a138345b5cae322f zoom_meeting.zip

120

StrikeReady Labs @strikereadylabs.com · 28/04/2026

#apt #cn f93923341c3e4b43015a2a1ca0b21ec115035447f2398eaea1aff1377f6d9d5d CNCLID.dll

000

StrikeReady Labs @strikereadylabs.com · 16/04/2026

#apt #pk drive.usercontent[.]google[.]com/download?id=1FCv4gbtcpWYQo5GFVFRoMaJe0_YZVBk-&export=download&authuser=0 igkashmir8@gmail.com

011

StrikeReady Labs @strikereadylabs.com · 08/04/2026

this actor has sent an email like this to dozens of governments, every single day, for the past 15 years. it takes them a few weeks to get banned from outlook/gmail/yahoo/etc and they move to a new one #daily_notaphish_just_weird

010

StrikeReady Labs @strikereadylabs.com · 03/04/2026

interesting #susp #apt payload uploaded to VT Work. zip uploaded from Saudi Arabia 85cd2aa498a943d4c07ce75d30f6e68d decoy. if you like .net obfuscation, this is a nice one

000

StrikeReady Labs @strikereadylabs.com · 03/04/2026

#cn #apt 1.zip via vt (uploaded from myanmar, mongolian lure) 03ca0221a1d7e49b72692ba12405216d -> neurosurgeryx[.]com decoy:

100

StrikeReady Labs @strikereadylabs.com · 30/03/2026

#apt #unc1151 mickeymousegamesdealer.alexavegas[.]icu

000

StrikeReady Labs @strikereadylabs.com · 24/03/2026

#susp #dailyphish -> financeoperations1.github[.]io/ambulacecare/

000

StrikeReady Labs @strikereadylabs.com · 24/03/2026

#dailyphish targeting an insurance company ... a dinner invite leading to screenconnect. subscribezoominfo.screenconnect[.]com/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest

000

StrikeReady Labs @strikereadylabs.com · 19/03/2026

susp #redteam OSCE_Election_Security_Checklist_v2.pdf.exe 600710c6ad0e4260a3879d36c5455e71 66.234.147.10

020

StrikeReady Labs @strikereadylabs.com · 10/03/2026

"big game" invoice scammers switching from training invoices to infosec #dailyphish

010

StrikeReady Labs @strikereadylabs.com · 09/03/2026

#dprk #apt (대외보안)0223_주미한국대사관_비공개_정책간담회_계획안.pdf.lnk 1f378c0efc13669dada1fe340c6837bd

000

StrikeReady Labs @strikereadylabs.com · 06/03/2026

#apt db1b11b63d631e2d0cebdefb322c2e7a Letter to Indian Coast Guards by Def Secy.xlam "pointless calculations"

000

StrikeReady Labs @strikereadylabs.com · 05/03/2026

info.updates-pbi.workers[.]dev

000

StrikeReady Labs @strikereadylabs.com · 05/03/2026

#susp #apt #opendir microsoft-pakistan.ptcl-gov-pk.workers[.]dev/

100

StrikeReady Labs @strikereadylabs.com · 03/03/2026

#susp #apt Algerian Ukrainian proposals for cooperation. zip c73c308a137ff7805577042cc9e923e1 lnk: desktop-jm38b85 overlaps with phish against Mongolia Хятад улстай хамтын ажиллагаагаа өргөжүүлэх төсөл.lnk 497c1ad79c4ef5425eb8a7e4f49efc8b drops stealer that uses Mega for exfil

110

StrikeReady Labs @strikereadylabs.com · 03/03/2026

#apt NATO Sanctions Package Against Russia - Belgium (February 2026)(.PDF).html 94b0039707efcd1821d4b34c13f65a75

010

StrikeReady Labs @strikereadylabs.com · 02/03/2026

large #trawling phishing campaign targeting ukraine domains ukremail[.]com, ua-gov[.]info b6480aa6c364715a21ba28c4d26a5b6e

010

StrikeReady Labs @strikereadylabs.com · 24/02/2026

nice #apt #phish targeting #pk readersspops@gmail.com -> drive.usercontent[.]google[.]com/download?id=1YkAJ-sUfcQ7Us9Ac7sTo1maweD2CDi0e "Tip informatrion Regarding Potential Security Threat.rar" 2c3cc8cc3fb26130db7973f2e0c26306

000

StrikeReady Labs @strikereadylabs.com · 24/02/2026

#apt #in dnlogsecn@gmail.com -> mail-defence-lk-webmail-imp-view-php-actfgioner8kj-dffd[.]pages[.]dev

000

StrikeReady Labs @strikereadylabs.com · 20/02/2026

#dailyphish hosted on AWS original-office-doc203.s3.us-east-1.amazonaws[.]com/sharedocumentlive.html

000

StrikeReady Labs @strikereadylabs.com · 11/02/2026

#susp #apt google_backup_codes.pdf.lnk 775869f5131da652099df6fd8b9968ae -> 29398f2-0239-281839-11129[.]ct[.]ws

000

StrikeReady Labs @strikereadylabs.com · 11/02/2026

ticket.doc 88e9acbc222b83d524dd4174367dec8b

000

StrikeReady Labs @strikereadylabs.com · 11/02/2026

same actor USG-NMDC Consumption Report (Jan 21 2025 – Feb 20 2026).xls 057e58ff00be3032fd6e3f5d2cc80905 codefusiontech[.]org

100

StrikeReady Labs @strikereadylabs.com · 11/02/2026

#apt intercom.doc 85a2dba599390143c665e349f9f04161 c2 codefusiontech[.]org

100

StrikeReady Labs @strikereadylabs.com · 10/02/2026

#apt targeting serbia gov povecanje_plata_2026.html bff79c8c0780ac7bfb64a11fc0b30251

010

StrikeReady Labs @strikereadylabs.com · 04/02/2026

#susp #apt endpoint1-b0ecetbuabcdg9cp[.]z01[.]azurefd[.]net/download/PdfReaderUpdate.7z National_Security_Advisory_India.pdf b47803dc97f9d0184c690639d26fb02a

000

StrikeReady Labs @strikereadylabs.com · 03/02/2026

#muddywater #apt חשוב.doc ffd9c0245e68939549ce0e3a1e15fdb4 miniquest[.]org

000