CIPHER CORTEX PUBLIC RESEARCH DESK
Intercept Cell Research
Selected TLP:CLEAR investigations, infrastructure analysis, scam casework, and defanged indicators.
Intercept Cell Research is Cipher Cortex’s public research desk. Client work remains confidential.
Research Streams
Dispatches
Short-form intelligence reporting on adversary infrastructure, scam activity, threat actors, and external digital risk.
View →Hooked Scams
Controlled scam-funnel research with victim guidance, investigator-ready technical readouts, and machine-readable indicators.
View →Indicators
Structured indicators from published research, including domains, URLs, emails, usernames, wallets, infrastructure, and related artifacts.
View →Advisories
Practical guidance for organizations, executives, investigators, and security teams facing emerging external threats.
View →Latest Research
Payment_Summary_ST Was ScreenConnect: Authenticated Wufoo Mail to Live Guest Access
A DocuSign lure arrived through real Wufoo/SurveyMonkey infrastructure with SPF, DKIM, and DMARC passing. The CTA laundered through two shorteners into a fake document portal that told the victim to open Payment_Summary_ST while Dropbox served ScreenConnect.ClientSetup.msi. We reversed the MSI. It is pre-baked Guest Access into cloud instance hxm042, session label buumutdiv screen, relayed through OVH.
Read dispatch →5-XEN and the Central Zoo: North Korea's Public Edge
North Korea's entire public IPv4 edge is still one /22. We re-walked all 1,022 host addresses on 11 September 2026. Twenty-two of them have a Shodan record. A dozen functions actually answered. The interesting ones are two Xen guests whose public certificates still say 5-XEN and 192.168.245.6. HTTPS on the Naenara address serves the Central Zoo for every Host header we tried, including the Foreign Ministry.
Read dispatch →Zerodark: Zero Reputation, Dark Payload
zerodark advertised free USA “COMPANY” crypto-investor leads with zero reputation on the board. The ZIP was a passworded WinRAR SFX that silently launched Millenium RAT v4.3. We decrypted the Telegram C2 and delivered an operator notice into two live channels.
Read dispatch →Know Your Adversary: TeamPCP
TeamPCP has carried that handle since late 2025. Three days ago the FBI formally attributed the campaign in FLASH-20260702-01. They poisoned Trivy, KICS, and LiteLLM to steal cloud credentials — then wormed npm and GitHub. Here is the full adversary bio, what the flash adds, and the C2 IP still answering after the domains died.
Read dispatch →The Blight Still Blooms: 83 Live Miasma Dead Drops — and the Victims You Can Name Without Decrypting
JFrog documented the Red Hat npm hijack. We mapped what they left behind: 83 public GitHub dead drops still live four days later, encrypted exfil you cannot read — and compromised accounts you can identify from repo ownership alone. You do not need the attacker's private key to know who got hit.
Read dispatch →EarnAndWithdraw.com: Pig Butchering Destination Platform with Fake Activity Feed
We intercepted a pig butchering destination platform promising 10-20% monthly USDT returns. The operator hardcoded a fake activity feed in JavaScript that generates fabricated deposits and withdrawals every 3-7 seconds, creating false social proof for victims directed here after weeks of relationship building via dating apps and "wrong number" texts. Domain registered March 13, 2026. Backend misconfigured with 500 errors on every API endpoint. This is where the slaughter happens.
Read dispatch →Work With Cipher Cortex
Intercept Cell is the public research desk. Cipher Cortex’s client practice — protective intelligence, digital investigations, and mission support — remains confidential. If you have a requirement that cannot be handled in the open, request a private briefing.