Operation-Phantom-Circuit-Report_012725_03.pdf
Excerpt
SecurityScorecard.com
info@securityscorecard.com
Background
During STRIKE’s investigation of Operation 99, our team identified multiple command-and-control (C2) servers active since September 2024. These servers, despite variations in payload structure and obfuscation techniques, shared a consistent implementation across the campaign. While their primary purpose appeared to be delivering payloads and maintaining communication with infected systems over port 1224, deeper analysis revealed an additional operational layer.
Critical questions—such as how exfiltrated data was handled and what infrastructure was used to manage these servers—remained…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by SecurityScorecard on securityscorecard.com.
More from SecurityScorecard8
- Resources - SecurityScorecardSecurityScorecard · Added 25 Oct
- Resources - SecurityScorecardSecurityScorecard · Added 18 Oct
- A Deep Dive into Medusa RansomwareSecurityScorecard · Added 29 Oct 2025
- How to Analyze Java Malware – A Case Study of STRRATSecurityScorecard · Added 18 Jul 2025
