TI-2026-033I ยท 26 June 2026 ยท Threat Intelligence
The Russian Thread
EGRUL reconnaissance, adversary-in-the-middle BEC infrastructure, and the chain that closes back to 033C.
Executive Summary
The primary node of HiddenPhish โ 45.154.98.153 on 1337 Services GmbH (AS208091, Spamhaus DROP listed) โ performed three HTTP CONNECT probes to egrul.nalog.ru in May 2026. EGRUL is the Russian Federal Tax Service's public company registry. Scraping it is step one of a Business Email Compromise kill chain: identify target companies, extract director names and financial contacts, craft a believable lure.
The same /24 subnet hosts two adversary-in-the-middle credential-capture clusters โ cementtechllc.com (with an active Microsoft 365 mail tenant expiring 2026-07-06) and nanotechinter.co.th (a legitimate Thai company's domain hijacked for phishing subdomains) โ both deploying the Tycoon 2FA / EvilProxy hash-prefix AiTM template. Add a Russian company (nextera.ru), an expired Russian lure domain (moyuniversalnyy.store), a Brazilian domain on Njalla nameservers matching the 033C substrate, antibot evasion tools, and operator VNC self-management infrastructure, and what emerges is not a hosting provider but a full-stack criminal service bureau.
This is the final article in the TI-2026-033 series. The thread that started with a Tor exit relay ends here: EGRUL reconnaissance feeding AiTM BEC operations, on the same bulletproof infrastructure that carried everything else.
ยง1 โ The EGRUL Reconnaissance Kill Chain
Three HTTP CONNECT requests to egrul.nalog.ru were captured in passive intelligence from 45.154.98.153, timed to May 2026. The CONNECT method is a proxy tunnel request โ the node was using itself as an intermediary to reach the Russian tax authority's registry. This is not incidental traffic.
Method: HTTP CONNECT tunnel/proxy access, 3 sessions, May 2026
ned.moyuniversalnyy.store A โ 45.154.98.153 Nov 2024 (expired, NXDOMAIN now)
EGRUL (ะะดะธะฝัะน ะณะพััะดะฐัััะฒะตะฝะฝัะน ัะตะตััั ััะธะดะธัะตัะบะธั ะปะธั โ Unified State Registry of Legal Entities) is publicly searchable. It contains: company full name, legal address, INN/OGRN tax numbers, registered director names, authorized capital, and crucially โ the history of bank account changes and affiliated persons. For a BEC operator targeting Russian businesses, this is the target list.
cementtechllc.com) with AiTM-capable hosting. Provision Microsoft 365 tenant on same domain โ this gives a real MX record (cementtechllc-com.mail.protection.outlook.com) and the ability to send email from Microsoft's own servers.[8char-hex].cementtechllc.com/outlook. The real Microsoft login page is proxied in real-time โ victim sees a legitimate Microsoft session; the AiTM captures session cookies and bypasses MFA.3a938588.cementtechllc.com/outlook. The MX on cementtechllc.com means the phishing email can come FROM @cementtechllc.com via Microsoft's own mail infrastructure.Why CONNECT to EGRUL and not just scrape the web interface?
HTTP CONNECT requests indicate the node was acting as a proxy for another client โ a scraper elsewhere in the infrastructure was routing EGRUL queries through 45.154.98.153 to avoid direct attribution. The node that holds the phishing infrastructure does not make the reconnaissance queries directly. Infrastructure isolation is intentional.
ยง2 โ AiTM BEC Clusters: Two Active Factories
Two adversary-in-the-middle credential-capture clusters sit on the same 1337 Services /24, both using the same subdomain template: a random 8-character hex prefix followed by optional tier-2 subdomain, followed by the parent domain, followed by a service path (outlook, login, account, sso, okta). This is the fingerprint of Tycoon 2FA or EvilProxy โ a phishing-as-a-service kit that proxies real Microsoft/Okta sessions and harvests cookies mid-session, bypassing hardware MFA.
Cluster A Subdomains โ cementtechllc.com
Cluster B Subdomains โ nanotechinter.co.th
Active M365 Tenant โ 10-Day Risk Window
The MX record cementtechllc-com.mail.protection.outlook.com confirms a provisioned Microsoft 365 tenant on cementtechllc.com. The actor can send email FROM @cementtechllc.com through Microsoft's own mail infrastructure โ DKIM, SPF, DMARC all pass. The domain expires 2026-07-06. All four GoDaddy registrar lock flags are set simultaneously (clientDeleteProhibited, clientRenewProhibited, clientTransferProhibited, clientUpdateProhibited) โ either GoDaddy's abuse team has frozen it, or the actor set all locks manually to delay takedown. Either way: report to Microsoft MSTIC (mstic@microsoft.com) and block @cementtechllc.com in mail gateway rules immediately.
cementtechllc.com MX โ cementtechllc-com.mail.protection.outlook.com Active M365 tenant
nanotechinter.co.th A โ 203.78.107.159 Legitimate ยท Thai hosting (NETWAY)
b0863053.hih.nanotechinter.co.th A โ 45.154.98.62 Hijacked subdomain zone โ bulletproof
AWS VPC Endpoint Mimicry in Cluster B
The subdomain apm.vpce.gdw55e.b0863053.hih.nanotechinter.co.th is crafted to look like an AWS VPC endpoint URL in email clients. apm = Application Performance Monitoring, vpce = VPC endpoint (standard AWS service abbreviation), gdw55e = fake resource ID. When embedded in a corporate email alongside legitimate AWS URLs, this is not flagged by standard URL scanners. It is designed to be read by a human security reviewer and dismissed as internal infrastructure.
ยง3 โ Russian Co-Tenants: nextera.ru and the Expired Lure
Two Russian-origin items on the same 1337 Services /24 establish a pattern of Russian operator presence independent of the EGRUL-BEC actor.
nextera.ru uses the bulletproof subnet only for specific subdomains (mep150, training) while routing the main domain normally. This pattern โ hide sensitive subdomains on bulletproof, keep public-facing on clean hosting โ is a deliberate OPSEC split. Takedowns of the bulletproof subdomains do not affect the main domain. The actor can re-point the subdomains within seconds.
ยง4 โ acesso-virtual.com: The Njalla Bridge to 033C
On 45.154.98.35, acesso-virtual.com ('virtual access' in Brazilian Portuguese) uses a set of nameservers that require attention: Njalla.
Njalla Nameservers on acesso-virtual.com
Njalla (njal.la) is a privacy-first domain registration service co-founded by Peter Sunde of The Pirate Bay. Njalla acts as the legal registrant of record โ the actual customer's identity is hidden from WHOIS, ICAN lookups, and legal registrar inquiries. Domains registered through Njalla cannot be seized without directly approaching Njalla, which operates under Nevis (Caribbean) jurisdiction. Nameserver format: [ordinal]-[phrase].[country-code] โ Njalla's signature style.
These same Njalla nameservers appear in the TI-2026-033C substrate infrastructure โ the core anonymous layer of the Psychedelic Connector series. The presence of Njalla nameservers on a domain sitting on 1337 Services bulletproof hosting creates a direct technical bridge between this Russian BEC thread and the original 033C substrate.
Two Hypotheses โ Neither Eliminates the Other
H1 (Same actor): The operator of the 033C substrate also runs BEC operations through 1337 Services, using Njalla for identity protection across both threads. The common provider choice is not coincidence โ it's a shared operational toolkit.
H2 (Common supplier): Both actors independently chose Njalla + 1337 Services as the anonymity+bulletproof stack. This is the most available combination for a certain threat tier โ Njalla for identity, 1337 for hosting, Tor for traffic. The overlap is structural, not individual.
Confidence: H2 is marginally more likely given the diversity of other 1337 Services tenants. But H1 cannot be excluded without additional attribution data.
ยง5 โ 1337 Services /24: A Complete Criminal Stack
The 45.154.98.0/24 subnet, over the course of this nine-article series, has been mapped to an extraordinary density of criminal services. It is not a hosting provider that happens to have bad tenants. It is a criminal infrastructure bureau.
| IP | Domain / Service | Category | Article |
|---|---|---|---|
| 45.154.98.153 | HiddenPhish C2 |
PhaaS / EGRUL recon / Tor exit | 033H / 033I |
| 45.154.98.149 | cementtechllc.com |
AiTM BEC ยท M365 tenant | 033I |
| 45.154.98.62 | nanotechinter.co.th |
AiTM BEC ยท DNS hijack | 033I |
| 45.154.98.64 | nextera.ru ยท documentcheckโฆus |
Russian co-tenant ยท BEC delivery | 033I |
| 45.154.98.35 | acesso-virtual.com |
Njalla NS ยท 033C bridge | 033I |
| 45.154.98.210 | antibots7.shop |
Antibot evasion ยท OPSEC tool | 033I |
| 45.154.98.202 | vnc.rdp.sh |
Operator VNC management | 033I |
| 45.154.98.83 | shutdown.st ยท goliathstress.tr ยท deepstresser.su |
DDoS stressers ยท DiamWall / Internet Magnate | 033G |
| 45.154.98.9 | rdp.sh (1337 Services remote access) |
Operator infrastructure | 033H |
| Multiple | Turkish Carrefour phishing farm (30+ .cfd domains) |
Retail phishing ยท Turkish | 033H |
| Multiple | Spanish/Argentine embassy phishing |
Government phishing ยท Spanish/AR | 033H |
Antibot Co-Location Is Not Coincidental
antibots7.shop on 45.154.98.210 is an antibot service โ it sits between the phishing infrastructure and the internet, fingerprinting visitors. Legitimate-looking traffic (human victims) gets forwarded to the AiTM proxy. Automated scanners, crawlers, and threat intelligence bots get served blank pages or 404s. Having this service on the same /24 as the phishing clusters means the operator deployed their evasion layer within their own infrastructure. They control the stack end to end.
ยง6 โ Series Synthesis: The Psychedelic Connector, A to I
Nine articles. One infrastructure family. The thread that began with a Tor relay in 033A ends with a Business Email Compromise targeting Russian companies in 033I. Here is the complete chain, mapped.
acesso-virtual.com โ the substrate is the foundation everything else sits on.What the Series Establishes
The Psychedelic Connector is not a single threat actor. It is a criminal service ecosystem โ multiple operators using the same bulletproof hosting layer (1337 Services GmbH), the same anonymization infrastructure (Tor, Njalla), and the same tooling (Tycoon 2FA / EvilProxy AiTM, HiddenPhish PhaaS). The services cross-pollinate: DDoS stressers and BEC operators and phishing farms share the same /24, the same antibot layer, the same VNC management infrastructure. Targeting one thread unravels the shared stack.
ยง7 โ Analysis Questions
Is the EGRUL prober definitely the same actor as the AiTM BEC operator, or just a co-tenant?
Co-tenant on the same /24 is confirmed. Same actor is possible but not established. The EGRUL probing and the AiTM clusters are on different IPs within the subnet (.153 vs .149/.62). The shared ASN and subnet reflect the same bulletproof provider, not necessarily the same customer. However: using 1337 Services at this level requires some kind of actor relationship with the provider โ passive co-tenancy or active coordination. The operational consistency (Russian language, BEC methodology, EGRUL + AiTM sequence) argues for coordination.
What does it mean that cementtechllc.com has an active M365 tenant?
It means the actor registered this domain with Microsoft and provisioned an Exchange Online mailbox. They can send email FROM @cementtechllc.com through Microsoft's mail servers โ with valid DKIM signatures, passing SPF, appearing legitimate in DMARC checks. Standard email security will not flag this. The M365 tenant also means the actor has a Microsoft account, a billing relationship, and likely a credit card or payment method on file with Microsoft โ a potential attribution vector if Microsoft cooperates with law enforcement.
Is nanotechinter.co.th's IT team aware their domain is being used for phishing?
Almost certainly not. The main domain resolves legitimately to 203.78.107.159 (Thai hosting via NETWAY). Only the subdomain zone has been compromised โ either through DNS zone access (compromised registrar credentials) or a wildcard CNAME that was misconfigured. The company's web presence and email are unaffected. Notification path: THNIC (the .co.th registry) and Nanotech Inter directly. The phishing subdomains should be reported to THNIC for DNS record removal.
Why does the actor leave expired domains like moyuniversalnyy.store as NXDOMAIN rather than re-registering?
Rotation is intentional. Short-lived domains are harder to block โ by the time blocklists are updated, the domain is already abandoned. The actor registers new domains for each campaign, uses them, and lets them expire. The infrastructure (the /24 subnet, the AiTM kit, the bulletproof provider) persists across campaigns. Only the domain lures rotate. This is standard PhaaS operational rhythm.
What is the single most important defensive action from this series?
Block the entire AS208091 (1337 Services GmbH) at the perimeter. The ASN is Spamhaus DROP listed โ it has no legitimate use cases. Every connection to and from AS208091 is either criminal traffic or a connection to criminal infrastructure. A single BGP blackhole or firewall rule covering the entire AS eliminates exposure to every threat documented across this nine-article series: the Tor relay, the HiddenPhish C2, the AiTM clusters, the DDoS stressers, all of it.
Verdict
Classification: Multi-tenant criminal infrastructure bureau โ Business Email Compromise (AiTM), phishing-as-a-service, DDoS-for-hire, EGRUL reconnaissance, and privacy-protected domain operations sharing a common bulletproof provider and anonymization stack.
Primary risk: CRITICAL โ cementtechllc.com carries an active Microsoft 365 tenant expiring 2026-07-06. The domain can send legitimate-appearing corporate email through Microsoft's mail infrastructure until that date or until Microsoft deactivates the tenant. Immediate action required: report to Microsoft MSTIC, block at mail gateway.
Infrastructure takedown priority: AS208091 (1337 Services GmbH) โ Spamhaus DROP listed, hosting the entirety of the Psychedelic Connector operation across nine documented sub-investigations. A single ASN block removes all exposure. NSP/upstream provider pressure on 1337 Services is the highest-leverage defensive action available at scale.
Attribution: MEDIUM โ Russian-speaking operator confirmed by language, EGRUL targeting, and co-tenant patterns. Individual actor identity not established. Shared infrastructure with 033C substrate suggests either same actor or coordinated criminal-services ecosystem rather than isolated individuals.
Series confidence: HIGH โ Nine articles built on passive DNS, WHOIS, reverse IP enumeration, OTX, Pulsedive, SSL fingerprinting, and live DNS queries. No hypothesis fabricated. Infrastructure links cross-validated across multiple sources. Uncertainty stated at each junction.
Cross-References
- TI-2026-033A โ The Tor Relay โ Entry node; AS208091 Tor exit service origin
- TI-2026-033B โ The Hidden Layer โ Encrypted C2 channel infrastructure
- TI-2026-033C โ The Substrate โ Njalla nameservers; bulletproof foundation layer; direct NS overlap with acesso-virtual.com in this article
- TI-2026-033D โ The Phishing Layer โ Multi-language phishing campaigns on same /24
- TI-2026-033E โ The Bulletproof Host โ 1337 Services GmbH (AS208091) full profile
- TI-2026-033F โ The Money Layer โ Financial fraud infrastructure above credential layer
- TI-2026-033G โ The Stresser Layer โ DiamWall + Internet Magnate DDoS; waffen.ss on 94.156.152.9
- TI-2026-033H โ HiddenPhish โ Full IP dossier on 45.154.98.153; Cloudflare fronting; Pulsedive risk chain; Bandit malware; French banking phishing