Remember What Matters
3 articles tagged “Telegram C2”
A 2.9 GB Telegram exfiltration archive places 845 credential-theft packages and the operators themselves in Ho Chi Minh City. The cluster operates a corporate front, eggcop.com, with eight identified staff mailboxes and one strongly attributed individual operator.
The Vietnamese-aligned cluster I track as EGGCOP has pivoted. The LinkedIn approach is now joined by a second vector working through industry conference registration channels. The defensive read has shifted.
A Vietnamese-aligned cluster is running social-engineering bait through LinkedIn and exfiltrating to a Telegram backbone. The targeting is heavily skewed toward Israeli users. The operators have made tradecraft mistakes worth understanding.