{ "type": "Domain", "indicator": "ibizers.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/ibizers.com", "alexa": "http://www.alexa.com/siteinfo/ibizers.com", "indicator": "ibizers.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 2210367083, "indicator": "ibizers.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 3, "pulses": [ { "id": "698081e8c82411d000808025", "name": "Quick, You Need Assistance!", "description": "A Microsoft Teams voice-phishing campaign leveraging Quick Assist, a remote administration tool, was tracked in September 2025. The campaign uses help desk scams to gain initial access, followed by user group enumeration and the execution of a PowerShell script to download a command and control payload. The attack employs AMSI bypass, encrypted communications, and a web-socket remote access trojan. Multiple Microsoft 365 tenants with IT-related subdomains were used, along with various IPs and domains for C2 infrastructure. The campaign shows similarities to Storm-1811 and PhantomCaptcha activities, suggesting a complex cybercrime ecosystem. The attackers' ultimate goal may be ransomware deployment, although observed attempts were successfully blocked.", "modified": "2026-03-04T10:03:50.152000", "created": "2026-02-02T10:52:24.545000", "tags": [ "netsupport manager", "cybercrime", "powershell", "amsi bypass", "remote access trojan", "powershell web-socket remote access trojan", "voice-phishing", "quick assist", "microsoft teams" ], "references": [ "https://fieldeffect.com/blog/quick-you-need-assistance" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "PowerShell web-socket remote access trojan", "display_name": "PowerShell web-socket remote access trojan", "target": null }, { "id": "NetSupport Manager", "display_name": "NetSupport Manager", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 32, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "domain": 9, "URL": 2 }, "indicator_count": 11, "is_author": false, "is_subscribing": null, "subscriber_count": 386778, "modified_text": "89 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698c4f02712e4743d0aa2263", "name": "EbeeFeb2026 Pt1", "description": "Multiple APT/threat actors, Malware and Campaigns", "modified": "2026-03-13T09:35:12.591000", "created": "2026-02-11T09:42:26.929000", "tags": [ "filehashsha256", "filehashsha1", "filehashmd5", "redacted" ], "references": [ "IOCs.csv" ], "public": 1, "adversary": "ShadowHS, DynoWiper, Operation Neusploit, Fake CAPTCHA App-V LOLBIN delivering Amatera Stealer", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IMEBEEIMFINE", "id": "343873", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 159, "FileHash-SHA1": 186, "FileHash-SHA256": 256, "CVE": 4, "URL": 49, "domain": 98, "hostname": 46 }, "indicator_count": 798, "is_author": false, "is_subscribing": null, "subscriber_count": 39, "modified_text": "80 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69819ee87302ddd469eeb4dd", "name": "Quick, You Need Assistance!", "description": "", "modified": "2026-03-04T10:03:50.152000", "created": "2026-02-03T07:08:24.417000", "tags": [ "netsupport manager", "cybercrime", "powershell", "amsi bypass", "remote access trojan", "powershell web-socket remote access trojan", "voice-phishing", "quick assist", "microsoft teams" ], "references": [ "https://fieldeffect.com/blog/quick-you-need-assistance" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "PowerShell web-socket remote access trojan", "display_name": "PowerShell web-socket remote access trojan", "target": null }, { "id": "NetSupport Manager", "display_name": "NetSupport Manager", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "698081e8c82411d000808025", "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Tr1sa111", "id": "192483", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 9, "URL": 2 }, "indicator_count": 11, "is_author": false, "is_subscribing": null, "subscriber_count": 277, "modified_text": "89 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "IOCs.csv", "https://fieldeffect.com/blog/quick-you-need-assistance" ], "related": { "alienvault": { "adversary": [], "malware_families": [ "Netsupport manager", "Powershell web-socket remote access trojan" ], "industries": [] }, "other": { "adversary": [ "ShadowHS, DynoWiper, Operation Neusploit, Fake CAPTCHA App-V LOLBIN delivering Amatera Stealer" ], "malware_families": [ "Netsupport manager", "Powershell web-socket remote access trojan" ], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 3, "pulses": [ { "id": "698081e8c82411d000808025", "name": "Quick, You Need Assistance!", "description": "A Microsoft Teams voice-phishing campaign leveraging Quick Assist, a remote administration tool, was tracked in September 2025. The campaign uses help desk scams to gain initial access, followed by user group enumeration and the execution of a PowerShell script to download a command and control payload. The attack employs AMSI bypass, encrypted communications, and a web-socket remote access trojan. Multiple Microsoft 365 tenants with IT-related subdomains were used, along with various IPs and domains for C2 infrastructure. The campaign shows similarities to Storm-1811 and PhantomCaptcha activities, suggesting a complex cybercrime ecosystem. The attackers' ultimate goal may be ransomware deployment, although observed attempts were successfully blocked.", "modified": "2026-03-04T10:03:50.152000", "created": "2026-02-02T10:52:24.545000", "tags": [ "netsupport manager", "cybercrime", "powershell", "amsi bypass", "remote access trojan", "powershell web-socket remote access trojan", "voice-phishing", "quick assist", "microsoft teams" ], "references": [ "https://fieldeffect.com/blog/quick-you-need-assistance" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "PowerShell web-socket remote access trojan", "display_name": "PowerShell web-socket remote access trojan", "target": null }, { "id": "NetSupport Manager", "display_name": "NetSupport Manager", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 32, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "domain": 9, "URL": 2 }, "indicator_count": 11, "is_author": false, "is_subscribing": null, "subscriber_count": 386778, "modified_text": "89 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698c4f02712e4743d0aa2263", "name": "EbeeFeb2026 Pt1", "description": "Multiple APT/threat actors, Malware and Campaigns", "modified": "2026-03-13T09:35:12.591000", "created": "2026-02-11T09:42:26.929000", "tags": [ "filehashsha256", "filehashsha1", "filehashmd5", "redacted" ], "references": [ "IOCs.csv" ], "public": 1, "adversary": "ShadowHS, DynoWiper, Operation Neusploit, Fake CAPTCHA App-V LOLBIN delivering Amatera Stealer", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IMEBEEIMFINE", "id": "343873", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 159, "FileHash-SHA1": 186, "FileHash-SHA256": 256, "CVE": 4, "URL": 49, "domain": 98, "hostname": 46 }, "indicator_count": 798, "is_author": false, "is_subscribing": null, "subscriber_count": 39, "modified_text": "80 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69819ee87302ddd469eeb4dd", "name": "Quick, You Need Assistance!", "description": "", "modified": "2026-03-04T10:03:50.152000", "created": "2026-02-03T07:08:24.417000", "tags": [ "netsupport manager", "cybercrime", "powershell", "amsi bypass", "remote access trojan", "powershell web-socket remote access trojan", "voice-phishing", "quick assist", "microsoft teams" ], "references": [ "https://fieldeffect.com/blog/quick-you-need-assistance" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "PowerShell web-socket remote access trojan", "display_name": "PowerShell web-socket remote access trojan", "target": null }, { "id": "NetSupport Manager", "display_name": "NetSupport Manager", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "698081e8c82411d000808025", "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Tr1sa111", "id": "192483", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 9, "URL": 2 }, "indicator_count": 11, "is_author": false, "is_subscribing": null, "subscriber_count": 277, "modified_text": "89 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "ibizers.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "ibizers.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780359531.293484 }