EN PT-BR
← Voltar ao feed
medium financial services small business

Infoblox traces UltraViewer/UltraMailer abuse: 350+ QuickBooks lookalike domains, chanret[.]com tracker and trojanized installers with njRAT

1 fonte(s) · 1 atualização(ões) · publicado 29/10/2026 09:59 · coletado há 3 dias

Infoblox Threat Intel published research tracing the abuse of two widely available Vietnamese-developed applications, UltraViewer (remote access) and UltraMailer (bulk mailing), by scammers and malware operators. A tech-support scam linked to Help TDS pushed victims to install UltraViewer; pivoting on shared registrant data led to ultramailer[.]org and chanret[.]com, the default UltraMailer tracking domain used in a long-running QuickBooks phishing campaign leveraging over 350 lookalike domains registered at Dynadot between 29 June and 5 July 2026. The emails embed 1×1 tracking pixels that leak base64-encoded recipient addresses to track.chanret[.]com, and instruct victims to call 805-area-code numbers where operators attempt to steal QuickBooks credentials. In August 2026 the actor briefly migrated to Mail250 infrastructure (smtracking[.]qbcares[.]com → swp23[.]com), which suspended the account after an abuse report, but returned to chanret[.]com on 8 September 2026. Infoblox also found trojanized installers of both products delivering njRAT and DarkKometa/Win32.Comet.A, and notes research by Hexastrike connecting the DUC FABULOUS CO.,LTD code-signing certificate to the Chinese actor Silver Fox.

Detalhes técnicos

  • Tracking pixel URL format: http://track.chanret.com/images/<campaign-id>/<base64-email>.jpg.
  • Trojanized UltraMailer_setup_v3.6_en.exe (SHA-256 9e1a679c…6676b) embeds njRAT; 45/75 VirusTotal detections; unsigned but bundles an authentic UltraMailer signed with a DUC FABULOUS CO.,LTD Sectigo certificate.
  • Trojanized UltraViewer_setup_6.6.133_vi.exe (SHA-256 28f046d9…e8727), 60/76 detections, family Win32.Comet.A / DarkKometa, installs to C:\ProgramData\Synaptics\Synaptics.exe masquerading as the Synaptics touchpad driver.
  • UltraMailer is openly advertised on sinister[.]li, patched[.]to, BreachForums and Russian-language forums as a spamming tool; its documentation explains swapping tracking domains once blocklisted. No abuse-reporting mechanism exists on its site.
  • UltraViewer is highly prevalent — Infoblox observed connections from up to 30% of its customers on some days.

Remediação

  • Block or restrict UltraViewer and UltraMailer where there is no business need; monitor connections to ultraviewer[.]net and ultramailer[.]org.
  • Alert on outbound requests to track.chanret[.]com and on QuickBooks-lookalike domains.
  • Hunt for C:\ProgramData\Synaptics\Synaptics.exe and the listed SHA-256 hashes.
  • Train finance staff against callback phishing using 805-area-code numbers posing as QuickBooks support.

Linha do tempo

  1. infoblox.com ↗ · pub. 29/10/2026 09:59 · coletado 29/10 11:01 primeiro registro

    Infoblox traces UltraViewer/UltraMailer abuse: 350+ QuickBooks lookalike domains, chanret[.]com tracker and trojanized installers with njRAT

    ler a análise desta fonte

    Infoblox Threat Intel published research tracing the abuse of two widely available Vietnamese-developed applications, UltraViewer (remote access) and UltraMailer (bulk mailing), by scammers and malware operators. A tech-support scam linked to Help TDS pushed victims to install UltraViewer; pivoting on shared registrant data led to ultramailer[.]org and chanret[.]com, the default UltraMailer tracking domain used in a long-running QuickBooks phishing campaign leveraging over 350 lookalike domains registered at Dynadot between 29 June and 5 July 2026. The emails embed 1×1 tracking pixels that leak base64-encoded recipient addresses to track.chanret[.]com, and instruct victims to call 805-area-code numbers where operators attempt to steal QuickBooks credentials. In August 2026 the actor briefly migrated to Mail250 infrastructure (smtracking[.]qbcares[.]com → swp23[.]com), which suspended the account after an abuse report, but returned to chanret[.]com on 8 September 2026. Infoblox also found trojanized installers of both products delivering njRAT and DarkKometa/Win32.Comet.A, and notes research by Hexastrike connecting the DUC FABULOUS CO.,LTD code-signing certificate to the Chinese actor Silver Fox.

    Technical Details

    • Tracking pixel URL format: http://track.chanret.com/images/<campaign-id>/<base64-email>.jpg.
    • Trojanized UltraMailer_setup_v3.6_en.exe (SHA-256 9e1a679c…6676b) embeds njRAT; 45/75 VirusTotal detections; unsigned but bundles an authentic UltraMailer signed with a DUC FABULOUS CO.,LTD Sectigo certificate.
    • Trojanized UltraViewer_setup_6.6.133_vi.exe (SHA-256 28f046d9…e8727), 60/76 detections, family Win32.Comet.A / DarkKometa, installs to C:\ProgramData\Synaptics\Synaptics.exe masquerading as the Synaptics touchpad driver.
    • UltraMailer is openly advertised on sinister[.]li, patched[.]to, BreachForums and Russian-language forums as a spamming tool; its documentation explains swapping tracking domains once blocklisted. No abuse-reporting mechanism exists on its site.
    • UltraViewer is highly prevalent — Infoblox observed connections from up to 30% of its customers on some days.

    Remediation

    • Block or restrict UltraViewer and UltraMailer where there is no business need; monitor connections to ultraviewer[.]net and ultramailer[.]org.
    • Alert on outbound requests to track.chanret[.]com and on QuickBooks-lookalike domains.
    • Hunt for C:\ProgramData\Synaptics\Synaptics.exe and the listed SHA-256 hashes.
    • Train finance staff against callback phishing using 805-area-code numbers posing as QuickBooks support.