🚨 UNC6671 PATTERN
Halliburton label reused:
📅 Sep: halliburton.myaccountoptions[.]com
📅 Oct: halliburton.assign-key[.]com
Captured VT scores: earlier hostname 3/92; new hostname 0/92.
Same brand label. Different root. 👀
#UNC6671 #ThreatIntel
Halliburton label reused:
📅 Sep: halliburton.myaccountoptions[.]com
📅 Oct: halliburton.assign-key[.]com
Captured VT scores: earlier hostname 3/92; new hostname 0/92.
Same brand label. Different root. 👀
#UNC6671 #ThreatIntel
0
1
4
733
🚨 UNC6671 INFRASTRUCTURE WATCH
At least 25 law-firm brands spoofed during my 2026 tracking.
From global giants to specialist firms - the legal-sector theme keeps growing.
Tracking live. 👀
#UNC6671 #ThreatIntel
At least 25 law-firm brands spoofed during my 2026 tracking.
From global giants to specialist firms - the legal-sector theme keeps growing.
Tracking live. 👀
#UNC6671 #ThreatIntel
0
5
16
968
🚨 UNC6671 LEGAL-SECTOR UPDATE
New SSO-themed domain: configuremysso[.]com
Three observed hostnames:
⚖️ bennettjones
⚖️ finnegan
🔎 rc
VirusTotal shows 0/92 detections in this snapshot 👀
#ThreatIntel #Phishing #OSINT
New SSO-themed domain: configuremysso[.]com
Three observed hostnames:
⚖️ bennettjones
⚖️ finnegan
🔎 rc
VirusTotal shows 0/92 detections in this snapshot 👀
#ThreatIntel #Phishing #OSINT
0
3
5
829
🚨 IS ROMULUS REBRANDING EXISTING SOFTWARE? 👀
On typosquatted havelbeenpwned[.]net, historical urlscan captures suggest the adversary rebranded Breeze RMM:
-Breeze RMM
-ROMULUS Remote Operations
-Today: black-and-gold ROMULUS login
#ROMULUS #ThreatIntel
On typosquatted havelbeenpwned[.]net, historical urlscan captures suggest the adversary rebranded Breeze RMM:
-Breeze RMM
-ROMULUS Remote Operations
-Today: black-and-gold ROMULUS login
#ROMULUS #ThreatIntel
⚠️ Researchers uncovered ROMULUS, a ClickFix malware delivery platform with admin panels found on six servers.
It delivers trojanized Stardock installers and LegionLoader, including an 842 MiB executable padded to evade some file-size scanning limits.
Read - thehackernews.com/2026/10/romulu…
2
4
5
946
🚨 ROMULUS INFRASTRUCTURE TRACKING
Building on research by Sai Molige and Forescout Vedere Labs, Shodan identified 13 IPs across 5 countries.
#ROMULUS #ThreatIntel
Building on research by Sai Molige and Forescout Vedere Labs, Shodan identified 13 IPs across 5 countries.
#ROMULUS #ThreatIntel
0
0
0
162
🚨 UNC6671 INFRASTRUCTURE UPDATE
Latham & Watkins and Kirkland & Ellis bring the myssologin[.]com cluster to 11 apparent law-firm references.
An apparent Cloudflare setup failure exposed 46.19.136[.]147 also seen in September’s myaccountapps[.]com campaign. 👀
#UNC6671
Latham & Watkins and Kirkland & Ellis bring the myssologin[.]com cluster to 11 apparent law-firm references.
An apparent Cloudflare setup failure exposed 46.19.136[.]147 also seen in September’s myaccountapps[.]com campaign. 👀
#UNC6671
1
4
11
1,124
🚨 UNC6671 INFRASTRUCTURE UPDATE
Two more hostnames under myssologin[.]com:
⚖️ huschblackwell.myssologin[.]com
⚖️ dinsmore.myssologin[.]com
Husch Blackwell and Dinsmore take the legal-sector cluster to eight firms.
Tracking live. 👀
#UNC6671 #ThreatIntel
Two more hostnames under myssologin[.]com:
⚖️ huschblackwell.myssologin[.]com
⚖️ dinsmore.myssologin[.]com
Husch Blackwell and Dinsmore take the legal-sector cluster to eight firms.
Tracking live. 👀
#UNC6671 #ThreatIntel
1
7
7
646
🚨 UNC6671 INFRASTRUCTURE UPDATE
Two more hostnames have appeared under myssologin[.]com:
⚖️ stinson.myssologin[.]com
⚖️ dechert.myssologin[.]com
The apparent references are Stinson and Dechert, expanding the cluster to six law firms.
Tracking live. 👀
#UNC6671 #ThreatIntel
Two more hostnames have appeared under myssologin[.]com:
⚖️ stinson.myssologin[.]com
⚖️ dechert.myssologin[.]com
The apparent references are Stinson and Dechert, expanding the cluster to six law firms.
Tracking live. 👀
#UNC6671 #ThreatIntel
0
3
11
698
🚨 UNC6671 INFRASTRUCTURE UPDATE
Two more hostnames have appeared under myssologin[.]com:
⚖️ kelleydrye.myssologin[.]com
⚖️ willkie.myssologin[.]com
The apparent references are Kelley Drye and Willkie, expanding the cluster to four major law firms.
Tracking live. 👀
Two more hostnames have appeared under myssologin[.]com:
⚖️ kelleydrye.myssologin[.]com
⚖️ willkie.myssologin[.]com
The apparent references are Kelley Drye and Willkie, expanding the cluster to four major law firms.
Tracking live. 👀
0
6
10
795
🚨 UNC6671 INFRASTRUCTURE UPDATE
Fresh legal-sector hostnames observed:
⚖️ cooley.myssologin[.]com
⚖️ paulweiss.myssologin[.]com
Both use the same Microsoft OAuth-style path:
🔗 /common/oauth2/v2.0/authorize/
Tracking live. 👀
#UNC6671 #ThreatIntel
Fresh legal-sector hostnames observed:
⚖️ cooley.myssologin[.]com
⚖️ paulweiss.myssologin[.]com
Both use the same Microsoft OAuth-style path:
🔗 /common/oauth2/v2.0/authorize/
Tracking live. 👀
#UNC6671 #ThreatIntel
1
3
15
756
🚨 CURRENT SHINYHUNTERS INFRASTRUCTURE
🇺🇸 DataWagon LLC — 3 IPs
🇷🇺 PROSPERO OOO — 2 IPs
Five IPs across two providers. Tracking continues. 👀
#ShinyHunters #ThreatIntel
🇺🇸 DataWagon LLC — 3 IPs
🇷🇺 PROSPERO OOO — 2 IPs
Five IPs across two providers. Tracking continues. 👀
#ShinyHunters #ThreatIntel
1
7
39
2,946
🚨 UNC6671 INFRASTRUCTURE UPDATE
Newly observed under login-options[.]com:
💼 carlyle.login-options[.]com
⚡ aep.login-options[.]com
The apparent brand-impersonation theme now spans investment management and US energy infrastructure.
Tracking: ongoing 👀
Newly observed under login-options[.]com:
💼 carlyle.login-options[.]com
⚡ aep.login-options[.]com
The apparent brand-impersonation theme now spans investment management and US energy infrastructure.
Tracking: ongoing 👀
1
6
14
1,275
🚨 UNC6671 INFRASTRUCTURE UPDATE
A third hostname has appeared under login-options[.]com:
⚖️ bclplaw.login-options[.]com
The apparent reference is BCLP, adding legal services to the existing Carlyle and AEP finance/energy theme.
Tracking live. 👀
#UNC6671 #ThreatIntel
A third hostname has appeared under login-options[.]com:
⚖️ bclplaw.login-options[.]com
The apparent reference is BCLP, adding legal services to the existing Carlyle and AEP finance/energy theme.
Tracking live. 👀
#UNC6671 #ThreatIntel
0
1
0
254
🚨 UNC6671 INFRASTRUCTURE UPDATE ⚖️
Fresh legal-sector impersonation observed:
🔎 hollandhart.myssoauth[.]com
The hostname appears to spoof US law firm Holland & Hart and continues the cluster’s SSO/authentication theme.
Detection at observation: 0/92 👀
#UNC6671
Fresh legal-sector impersonation observed:
🔎 hollandhart.myssoauth[.]com
The hostname appears to spoof US law firm Holland & Hart and continues the cluster’s SSO/authentication theme.
Detection at observation: 0/92 👀
#UNC6671
0
4
5
1,560
🎣 JP PANEL PHISHKIT 🔎
The kit renders genuine Microsoft tenant branding while operator controls target credentials, MFA and passkey flows.
Theme: insurance, capital markets & professional services.
Tracked separately from UNC6671. #ThreatIntel
The kit renders genuine Microsoft tenant branding while operator controls target credentials, MFA and passkey flows.
Theme: insurance, capital markets & professional services.
Tracked separately from UNC6671. #ThreatIntel
Another root domain: mfasettings[.]com , #UNC6671
Follows the same identity/MFA-themed naming pattern, no subdomain yet.
Registered on Sep 21 via NICENIC, uses Cloudflare NS, and currently resolves to 102.220.163[.]94 (VPS Dedicated LLC).
2
2
10
1,625
🚨 UNC6671 INFRASTRUCTURE WATCH 🔎
Fresh Domain observed today:
myssoauth[.]com 0 hits in VT
#UNC6671 #ThreatIntel
Fresh Domain observed today:
myssoauth[.]com 0 hits in VT
#UNC6671 #ThreatIntel
2
6
24
2,649
