Pivoting on a malspam infrastructure delivering JS malware backed…

Hello, we have just published a report on our blog concerning a malspam network spreading a JavaScript backdoor.

• The targets of those campaigns were from all regions and sectors, notably energy and finance ministries, including in the CIS region. • We believe the campaigns to be financially motivated and operated for email account compromise (EAC) and/or business email compromise (BEC).

• Both the IP used to send the spam, and the C2 of the JavaScript backdoor, were hosted on two distinct bulletproof networks; US based GHOSTYNETWORKS, and Seychelles based OMEGATECH.

• GHOSTYNETWORKS can seemingly be considered with a high level of confidence to be a rebrand of OPTIBOUNCE and thus be linked to the unfamous hosting provider AnonRDP. It was notably plebiscite by more sophisticated threat actors like TeamPCP.

• Based on various open-source intelligence, OMEGATECH seems to be yet another network created by hosting provider Virtualine, advertised on underground forums.

• Pivots on the threat actor’s infrastructure unveiled previous malspam and malware activities from the end of 2025, also backed by other bulletproof solutions.

Link for the report: https://www.intrinsec.com/wp-content/uploads/2026/05/TLP-CLEAR-Pivoting-on-a-malspam-infrastructure-EN.pdf

Impact

The malware facilitates email account compromise and business email compromise, potentially leading to unauthorized access to sensitive communications and financial fraud. The use of bulletproof hosting networks complicates mitigation efforts by providing resilient infrastructure that resists takedown. The targeting of critical sectors such as energy and finance ministries increases the potential impact on national and organizational security.

Defensive guidance

No specific patch or remediation is applicable as this is a malware campaign leveraging bulletproof hosting infrastructure. Organizations should monitor for indicators of compromise related to JavaScript backdoors and implement email security controls to detect and block malspam. Collaboration with hosting providers and law enforcement may be necessary to disrupt the bulletproof networks. Patch status is not applicable; check the vendor advisory or threat intelligence updates for any emerging mitigation techniques.

Summary

This threat involves a malspam campaign delivering a JavaScript backdoor malware. The infrastructure behind the campaign leverages bulletproof hosting networks—GHOSTYNETWORKS and OMEGATECH—to evade takedown and maintain persistence. GHOSTYNETWORKS is linked to the known provider AnonRDP and is favored by sophisticated threat actors like TeamPCP. OMEGATECH is connected to Virtualine and advertised on underground forums. The campaign targets multiple regions and sectors, notably energy and finance ministries in the CIS region, with the intent of financial gain through email account and business email compromise. The threat actor's infrastructure has been active since late 2025, indicating ongoing and evolving malicious activity.

Pivoting on a malspam infrastructure delivering JS malware backed by bulletproof networks

Discussion

Links cited in the discussion

Impact

Defensive guidance

Summary

References

Community reviews

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 15 Jun 2026, 09:45 UTC

Technical details

References

Community reviews

Related threats