Hey cuties! After today's gay brunch we have some fresh tea to spill. Meet threat cluster GAY-0001. A cluster we've been tracking since ~2026-10 and are now ready to share. Happy Hunting 💋 Live Infra: IPs: 182[.]16[.]98[.]83 182[.]16[.]98[.]86 119[.]42[.]148[.]187 182[.]16[.]98[.]90 182[.]16[.]98[.]92 182[.]16[.]98[.]87 182[.]16[.]98[.]82 182[.]16[.]98[.]93 182[.]16[.]98[.]91 182[.]16[.]98[.]94 119[.]42[.]148[.]190 182[.]16[.]98[.]88 182[.]16[.]98[.]85 119[.]42[.]148[.]189 119[.]42[.]148[.]186 182[.]16[.]98[.]89 182[.]16[.]98[.]84 Domains / Certs: mstsc[.]microsoft365guide[.]com microsoft365guide[.]com gateway[.]bliln[.]com bliln[.]com micriosoft[.]net Hunt Fingerprints: TLS Fingerprint: c7a0e64bbcf3cdf10423ad4a7f640426bcdc6eb6fff5d902e62ed41c82fcd53d TLS Serial Number: 1790971977 Malware + C2s Used: VShell Reverse_SSH Former members: Address From To 119[.]42[.]148[.]187 10-04 10-11 182[.]16[.]98[.]82 10-04 10-11 182[.]16[.]98[.]92 10-04 10-11 119[.]42[.]148[.]186 10-04 10-11 119[.]42[.]148[.]189 10-04 10-11 119[.]42[.]148[.]190 10-04 10-11 182[.]16[.]98[.]83 10-04 10-11 182[.]16[.]98[.]84 10-04 10-11 182[.]16[.]98[.]85 10-04 10-11 182[.]16[.]98[.]86 10-04 10-11 182[.]16[.]98[.]87 10-04 10-11 182[.]16[.]98[.]88 10-04 10-11 182[.]16[.]98[.]89 10-04 10-11 182[.]16[.]98[.]90 10-04 10-11 182[.]16[.]98[.]91 10-04 10-11 182[.]16[.]98[.]93 10-04 10-11 182[.]16[.]98[.]94 10-04 10-11 #GAYINT #ThreatIntel