{
  "aliases": [],
  "attack_id": null,
  "attack_name": null,
  "attack_url": null,
  "counts": {
    "domain": 121
  },
  "first_seen": {
    "domain": {
      "abcdns.bounceme.net": "2020-04-02",
      "abcpees.webhop.net": "2020-04-02",
      "ancelon.webhop.net": "2020-04-02",
      "anitacxb.servebbs.com": "2020-04-02",
      "bi-apple.net": "2020-04-02",
      "bitdefender.minidns.net": "2020-04-02",
      "ccc.th-fish.com": "2020-04-02",
      "ccuugo.8866.org": "2020-04-02",
      "checkerror.obama20009.com": "2020-04-02",
      "cheng.pc-officer.com": "2020-04-02",
      "cometocome.8866.org": "2020-04-02",
      "computerupdate.servegame.com": "2020-04-02",
      "cooperlzh.liondrive.com": "2020-04-02",
      "d1c2f3.3322.org": "2020-04-02",
      "data.lovequintet.com": "2020-04-02",
      "divineart.dyndns.org": "2020-04-02",
      "domain.uyghuri.com": "2020-04-02",
      "enterdia.zyns.com": "2020-04-02",
      "erbilin.blogdns.com": "2020-04-02",
      "feng.pc-officer.com": "2020-04-02",
      "fifaoopp.webhop.net": "2020-04-02",
      "fisu.rr.nu": "2020-08-16",
      "gmail.servebbs.com": "2020-04-02",
      "goodhope.no-ip.org": "2020-04-02",
      "googleads.serveftp.com": "2020-04-02",
      "handinhand.blogdns.org": "2020-04-02",
      "harris.3322.org": "2020-04-02",
      "hinetrouter.serveftp.org": "2020-04-02",
      "hongzong.xicp.net": "2020-04-02",
      "hzcj.8866.org": "2020-04-02",
      "hzong.welikejack.com": "2020-04-02",
      "ie-update.sytes.net": "2020-04-02",
      "ifsbsa.bounceme.net": "2020-04-02",
      "ihe1979.3322.org": "2020-04-02",
      "intershare.zapto.net": "2020-04-02",
      "intershare.zapto.org": "2020-04-02",
      "introy.toh.info": "2020-04-02",
      "ius.uyghuri.com": "2020-04-02",
      "japanisok.selfip.org": "2020-04-02",
      "jmjm.bounceme.net": "2020-04-02",
      "killabcd.9966.org": "2020-04-02",
      "kingcoast.3322.org": "2020-04-02",
      "kingcoast.6688.org": "2020-04-02",
      "kingcoast.homedns.org": "2020-04-02",
      "kmtzh.zyns.com": "2020-04-02",
      "ksforever.no-ip.org": "2020-04-02",
      "liumingzhen.myftp.org": "2017-04-12",
      "liumingzhen.zapto.org": "2017-04-12",
      "liveupdate.dyndns.biz": "2020-04-02",
      "lovemoney.2288.org": "2020-04-02",
      "lycosgame.com": "2020-08-16",
      "lyle.3322.org": "2020-04-02",
      "lyle.homedns.org": "2020-04-02",
      "mcrcancer.podzone.org": "2020-04-02",
      "mcrcount.bounceme.net": "2020-04-02",
      "mcrcount.podzone.org": "2020-04-02",
      "meet.servebbs.org": "2020-04-02",
      "menberservice.3322.org": "2020-04-02",
      "microsoft.dumb1.com": "2020-04-02",
      "mkmk.bounceme.net": "2020-04-02",
      "mmm.freesite.us": "2020-04-02",
      "msdndown1.3322.org": "2020-04-02",
      "myblog.bounceme.net": "2020-04-02",
      "mylife33.zapto.org": "2020-04-02",
      "mywebpage.3322.org": "2020-04-02",
      "newton1666.3322.org": "2020-04-02",
      "nothingtolose.3322.org": "2020-04-02",
      "nothingtolose.changeip.org": "2020-04-02",
      "olyone.com": "2020-04-02",
      "oohshit.dnsdojo.com": "2020-04-02",
      "own.webhop.net": "2020-04-02",
      "oyd.3322.org": "2020-04-02",
      "pklei45.3322.org": "2020-04-02",
      "pklei56.3322.org": "2020-04-02",
      "plscoverko.meibu.com": "2020-04-02",
      "pop.miyazakihousou.com": "2020-04-02",
      "popftp.bounceme.net": "2020-04-02",
      "popo.bi-apple.net": "2020-04-02",
      "popularcat.hopto.org": "2020-04-02",
      "pvp.scylla4421.com": "2020-04-02",
      "rainflow.dontexist.com": "2020-04-02",
      "readdook.selfip.com": "2020-04-02",
      "red.istme.com": "2020-04-02",
      "s27.dondon555.com": "2020-08-16",
      "sbd.7766.org": "2020-04-02",
      "sctw06.com": "2020-08-16",
      "services.dyndns.biz": "2020-04-02",
      "smtp.hitachis.net": "2020-04-02",
      "sportsnews.chilichi.com": "2020-04-02",
      "stemba.bounceme.net": "2020-04-02",
      "support-microsoft.net": "2020-08-16",
      "sweetbug.selfip.net": "2020-04-02",
      "sweetcard.3322.org": "2020-04-02",
      "sweetseed.3322.org": "2020-04-02",
      "tempfy.9966.org": "2020-04-02",
      "tempsys.8866.prg": "2020-04-02",
      "tencent.ikwb.com": "2020-08-16",
      "todayzh.sytes.net": "2020-04-02",
      "tv.kingdomcer.com": "2020-04-02",
      "update.ddns.ms": "2020-04-02",
      "update.ns01.biz": "2020-04-02",
      "update.support-microsoft.net": "2020-04-02",
      "update.toh.info": "2020-04-02",
      "vcvcvcvc.dyndns.org": "2020-08-16",
      "vnn.dinhk.net": "2020-04-02",
      "web.achteins.com": "2020-04-02",
      "webcache.zapto.org": "2020-04-02",
      "webhost.j2ee.us": "2020-04-02",
      "webmail.hinet2010.com": "2020-04-02",
      "webstation.webhop.net": "2020-04-02",
      "webupdate.selfip.com": "2020-04-02",
      "winautoupdate.acmetoy.com": "2020-04-02",
      "windowsupdate8.3322.org": "2020-04-02",
      "xinxin.6600.org": "2020-04-02",
      "yahoo.jungleheart.com": "2020-04-02",
      "yahoo.qpoe.com": "2020-04-02",
      "yaxiko.bounceme.net": "2020-04-02",
      "yitiao.dyndns-blog.com": "2020-04-02",
      "yunmin.3322.org": "2020-04-02",
      "zhngzng.mcchrystalvs.com": "2020-04-02",
      "zwy2007.pc-officer.com": "2020-04-02"
    }
  },
  "first_seen_precision": {
    "domain": {}
  },
  "first_seen_range": {
    "earliest": "2017-04-12",
    "latest": "2020-08-16"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "abcdns.bounceme.net",
      "abcpees.webhop.net",
      "ancelon.webhop.net",
      "anitacxb.servebbs.com",
      "bi-apple.net",
      "bitdefender.minidns.net",
      "ccc.th-fish.com",
      "ccuugo.8866.org",
      "checkerror.obama20009.com",
      "cheng.pc-officer.com",
      "cometocome.8866.org",
      "computerupdate.servegame.com",
      "cooperlzh.liondrive.com",
      "d1c2f3.3322.org",
      "data.lovequintet.com",
      "divineart.dyndns.org",
      "domain.uyghuri.com",
      "enterdia.zyns.com",
      "erbilin.blogdns.com",
      "feng.pc-officer.com",
      "fifaoopp.webhop.net",
      "fisu.rr.nu",
      "gmail.servebbs.com",
      "goodhope.no-ip.org",
      "googleads.serveftp.com",
      "handinhand.blogdns.org",
      "harris.3322.org",
      "hinetrouter.serveftp.org",
      "hongzong.xicp.net",
      "hzcj.8866.org",
      "hzong.welikejack.com",
      "ie-update.sytes.net",
      "ifsbsa.bounceme.net",
      "ihe1979.3322.org",
      "intershare.zapto.net",
      "intershare.zapto.org",
      "introy.toh.info",
      "ius.uyghuri.com",
      "japanisok.selfip.org",
      "jmjm.bounceme.net",
      "killabcd.9966.org",
      "kingcoast.3322.org",
      "kingcoast.6688.org",
      "kingcoast.homedns.org",
      "kmtzh.zyns.com",
      "ksforever.no-ip.org",
      "liumingzhen.myftp.org",
      "liumingzhen.zapto.org",
      "liveupdate.dyndns.biz",
      "lovemoney.2288.org",
      "lycosgame.com",
      "lyle.3322.org",
      "lyle.homedns.org",
      "mcrcancer.podzone.org",
      "mcrcount.bounceme.net",
      "mcrcount.podzone.org",
      "meet.servebbs.org",
      "menberservice.3322.org",
      "microsoft.dumb1.com",
      "mkmk.bounceme.net",
      "mmm.freesite.us",
      "msdndown1.3322.org",
      "myblog.bounceme.net",
      "mylife33.zapto.org",
      "mywebpage.3322.org",
      "newton1666.3322.org",
      "nothingtolose.3322.org",
      "nothingtolose.changeip.org",
      "olyone.com",
      "oohshit.dnsdojo.com",
      "own.webhop.net",
      "oyd.3322.org",
      "pklei45.3322.org",
      "pklei56.3322.org",
      "plscoverko.meibu.com",
      "pop.miyazakihousou.com",
      "popftp.bounceme.net",
      "popo.bi-apple.net",
      "popularcat.hopto.org",
      "pvp.scylla4421.com",
      "rainflow.dontexist.com",
      "readdook.selfip.com",
      "red.istme.com",
      "s27.dondon555.com",
      "sbd.7766.org",
      "sctw06.com",
      "services.dyndns.biz",
      "smtp.hitachis.net",
      "sportsnews.chilichi.com",
      "stemba.bounceme.net",
      "support-microsoft.net",
      "sweetbug.selfip.net",
      "sweetcard.3322.org",
      "sweetseed.3322.org",
      "tempfy.9966.org",
      "tempsys.8866.prg",
      "tencent.ikwb.com",
      "todayzh.sytes.net",
      "tv.kingdomcer.com",
      "update.ddns.ms",
      "update.ns01.biz",
      "update.support-microsoft.net",
      "update.toh.info",
      "vcvcvcvc.dyndns.org",
      "vnn.dinhk.net",
      "web.achteins.com",
      "webcache.zapto.org",
      "webhost.j2ee.us",
      "webmail.hinet2010.com",
      "webstation.webhop.net",
      "webupdate.selfip.com",
      "winautoupdate.acmetoy.com",
      "windowsupdate8.3322.org",
      "xinxin.6600.org",
      "yahoo.jungleheart.com",
      "yahoo.qpoe.com",
      "yaxiko.bounceme.net",
      "yitiao.dyndns-blog.com",
      "yunmin.3322.org",
      "zhngzng.mcchrystalvs.com",
      "zwy2007.pc-officer.com"
    ]
  },
  "last_modified": "2026-01-02T23:10:15+00:00",
  "maltrail_groups": [
    "BLACKGEAR"
  ],
  "references": [
    "https://documents.trendmicro.com/assets/appendix-blackgear-cyberespionage-campaign-resurfaces-abuses-social-media-for-c&c-communication.pdf",
    "https://malpedia.caad.fkie.fraunhofer.de/actor/blackgear",
    "https://www.virustotal.com/gui/file/42ee9dd43ea0f2766f1419733d238346603474106157ccabff8eff574c13941a/detection"
  ],
  "related": [
    {
      "evidence": [
        {
          "detail": "2 shared indicators",
          "kind": "infrastructure",
          "weight": 2.0
        }
      ],
      "slug": "G0029"
    }
  ],
  "slug": "BLACKGEAR",
  "timeline": [
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2020-08-16",
      "indicators": {
        "domain": [
          "fisu.rr.nu",
          "lycosgame.com",
          "s27.dondon555.com",
          "sctw06.com",
          "support-microsoft.net",
          "tencent.ikwb.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://malpedia.caad.fkie.fraunhofer.de/actor/blackgear",
        "https://documents.trendmicro.com/assets/appendix-blackgear-cyberespionage-campaign-resurfaces-abuses-social-media-for-c&c-communication.pdf"
      ],
      "total": 6
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-08-16",
      "indicators": {
        "domain": [
          "vcvcvcvc.dyndns.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/file/42ee9dd43ea0f2766f1419733d238346603474106157ccabff8eff574c13941a/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 112
      },
      "first_seen": "2020-04-02",
      "indicators": {
        "domain": [
          "abcdns.bounceme.net",
          "abcpees.webhop.net",
          "ancelon.webhop.net",
          "anitacxb.servebbs.com",
          "bi-apple.net",
          "bitdefender.minidns.net",
          "ccc.th-fish.com",
          "ccuugo.8866.org",
          "checkerror.obama20009.com",
          "cheng.pc-officer.com",
          "cometocome.8866.org",
          "computerupdate.servegame.com",
          "cooperlzh.liondrive.com",
          "d1c2f3.3322.org",
          "data.lovequintet.com",
          "divineart.dyndns.org",
          "domain.uyghuri.com",
          "enterdia.zyns.com",
          "erbilin.blogdns.com",
          "feng.pc-officer.com",
          "fifaoopp.webhop.net",
          "gmail.servebbs.com",
          "goodhope.no-ip.org",
          "googleads.serveftp.com",
          "handinhand.blogdns.org",
          "harris.3322.org",
          "hinetrouter.serveftp.org",
          "hongzong.xicp.net",
          "hzcj.8866.org",
          "hzong.welikejack.com",
          "ie-update.sytes.net",
          "ifsbsa.bounceme.net",
          "ihe1979.3322.org",
          "intershare.zapto.net",
          "intershare.zapto.org",
          "introy.toh.info",
          "ius.uyghuri.com",
          "japanisok.selfip.org",
          "jmjm.bounceme.net",
          "killabcd.9966.org",
          "kingcoast.3322.org",
          "kingcoast.6688.org",
          "kingcoast.homedns.org",
          "kmtzh.zyns.com",
          "ksforever.no-ip.org",
          "liveupdate.dyndns.biz",
          "lovemoney.2288.org",
          "lyle.3322.org",
          "lyle.homedns.org",
          "mcrcancer.podzone.org",
          "mcrcount.bounceme.net",
          "mcrcount.podzone.org",
          "meet.servebbs.org",
          "menberservice.3322.org",
          "microsoft.dumb1.com",
          "mkmk.bounceme.net",
          "mmm.freesite.us",
          "msdndown1.3322.org",
          "myblog.bounceme.net",
          "mylife33.zapto.org",
          "mywebpage.3322.org",
          "newton1666.3322.org",
          "nothingtolose.3322.org",
          "nothingtolose.changeip.org",
          "olyone.com",
          "oohshit.dnsdojo.com",
          "own.webhop.net",
          "oyd.3322.org",
          "pklei45.3322.org",
          "pklei56.3322.org",
          "plscoverko.meibu.com",
          "pop.miyazakihousou.com",
          "popftp.bounceme.net",
          "popo.bi-apple.net",
          "popularcat.hopto.org",
          "pvp.scylla4421.com",
          "rainflow.dontexist.com",
          "readdook.selfip.com",
          "red.istme.com",
          "sbd.7766.org",
          "services.dyndns.biz",
          "smtp.hitachis.net",
          "sportsnews.chilichi.com",
          "stemba.bounceme.net",
          "sweetbug.selfip.net",
          "sweetcard.3322.org",
          "sweetseed.3322.org",
          "tempfy.9966.org",
          "tempsys.8866.prg",
          "todayzh.sytes.net",
          "tv.kingdomcer.com",
          "update.ddns.ms",
          "update.ns01.biz",
          "update.support-microsoft.net",
          "update.toh.info",
          "vnn.dinhk.net",
          "web.achteins.com",
          "webcache.zapto.org",
          "webhost.j2ee.us",
          "webmail.hinet2010.com",
          "webstation.webhop.net",
          "webupdate.selfip.com",
          "winautoupdate.acmetoy.com",
          "windowsupdate8.3322.org",
          "xinxin.6600.org",
          "yahoo.jungleheart.com",
          "yahoo.qpoe.com",
          "yaxiko.bounceme.net",
          "yitiao.dyndns-blog.com",
          "yunmin.3322.org",
          "zhngzng.mcchrystalvs.com",
          "zwy2007.pc-officer.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://malpedia.caad.fkie.fraunhofer.de/actor/blackgear",
        "https://documents.trendmicro.com/assets/appendix-blackgear-cyberespionage-campaign-resurfaces-abuses-social-media-for-c&c-communication.pdf"
      ],
      "total": 112
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2017-04-12",
      "indicators": {
        "domain": [
          "liumingzhen.myftp.org",
          "liumingzhen.zapto.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://malpedia.caad.fkie.fraunhofer.de/actor/blackgear",
        "https://documents.trendmicro.com/assets/appendix-blackgear-cyberespionage-campaign-resurfaces-abuses-social-media-for-c&c-communication.pdf"
      ],
      "total": 2
    }
  ]
}