#gayint

Hey cuties! After today's gay brunch we have some fresh tea to spill. Meet threat cluster GAY-0001. A cluster we've been tracking since ~2026-10 and are now ready to share. Happy Hunting 💋 Live Infra: IPs: 182[.]16[.]98[.]83 182[.]16[.]98[.]86 119[.]42[.]148[.]187 182[.]16[.]98[.]90 182[.]16[.]98[.]92 182[.]16[.]98[.]87 182[.]16[.]98[.]82 182[.]16[.]98[.]93 182[.]16[.]98[.]91 182[.]16[.]98[.]94 119[.]42[.]148[.]190 182[.]16[.]98[.]88 182[.]16[.]98[.]85 119[.]42[.]148[.]189 119[.]42[.]148[.]186 182[.]16[.]98[.]89 182[.]16[.]98[.]84 Domains / Certs: mstsc[.]microsoft365guide[.]com microsoft365guide[.]com gateway[.]bliln[.]com bliln[.]com micriosoft[.]net Hunt Fingerprints: TLS Fingerprint: c7a0e64bbcf3cdf10423ad4a7f640426bcdc6eb6fff5d902e62ed41c82fcd53d TLS Serial Number: 1790971977 Malware + C2s Used: VShell Reverse_SSH Former members: Address From To 119[.]42[.]148[.]187 10-04 10-11 182[.]16[.]98[.]82 10-04 10-11 182[.]16[.]98[.]92 10-04 10-11 119[.]42[.]148[.]186 10-04 10-11 119[.]42[.]148[.]189 10-04 10-11 119[.]42[.]148[.]190 10-04 10-11 182[.]16[.]98[.]83 10-04 10-11 182[.]16[.]98[.]84 10-04 10-11 182[.]16[.]98[.]85 10-04 10-11 182[.]16[.]98[.]86 10-04 10-11 182[.]16[.]98[.]87 10-04 10-11 182[.]16[.]98[.]88 10-04 10-11 182[.]16[.]98[.]89 10-04 10-11 182[.]16[.]98[.]90 10-04 10-11 182[.]16[.]98[.]91 10-04 10-11 182[.]16[.]98[.]93 10-04 10-11 182[.]16[.]98[.]94 10-04 10-11 #GAYINT #ThreatIntel

We know it can be a little confusing with all the recent news, but we assess with medium confidence that Jensen Huang is not actually affiliated with FLAMBOYANT LEATHERDADDY. #GAYINT

A lot of exciting things happened to Steve Martin’s character in The Jerk after something was dropped off… And now, rev up your duplicated onyx digitized felines because it is about to happen to me… I got this today. #GAYINT @gayint@infosec.exchange cc: @neurovagrant@masto.deoan.org @wendynather@infosec.exchange #NowDoBisexualColors #TheFutureIsLessSlashdotAndMoreDotDotSlash #NETMBX #QCIC_23

Great, Google misses another opportunity to adopt the @gayint@infosec.exchange threat actor naming scheme and instead invents yet another one: https://www.theregister.com/security/2026/07/27/google-goes-it-alone-with-a-new-cybercrime-crew-taxonomy/5278749 Do I have to tap the https://xkcd.com/927/ sign again? #infosec #threatintel #gayint

One of the #GAYINT servers may or may not have been splashed by sewer water. I apologize for any downtime but I can assure you this stinks for me more than it does you. You will receive a refund prorated to the outage window on your next monthly bill.

Unit 42 has observed a persistent cyberespionage campaign we track as CL-STA-1114. This activity cluster overlaps with activity from a Russian threat actor tracked by other vendors as Void Blizzard and LAUNDRY BEAR. (from: https://unit42.paloaltonetworks.com/russian-webmail-espionage/ ) You can't tell me thats not a #GAYINT threat actor name

@cR0w@infosec.exchange What's their #GAYINT name?

@wall_e@ioc.exchange well, they gotta learn about the #GAYINT threat actor naming scheme at some point!

#gayint Snapchat feed when? 🤔

Hacked #mnDot sign, east bound 494 about 1/2 mile before the Bush Lake Road exit. Couldn’t get a picture. Guessing this is NOT the construction message intended: UwU Furry Gay Pride #GAYINT #uwu

@da_667@infosec.exchange does #gayint have a pew pew map yet?

I consulted the official #GAYINT threat actor mapping chart and made this diagram for Notepad++ hack attribution

Notepad++ have today confirmed their auto process was compromised by Chinese nation state threat actors, in a supply chain hack: https://notepad-plus-plus.org/news/hijacked-incident-info-update/ This backs up my blog from late last year, with #GAYINT threat actor mapping to Funky Stamen. The infrastructure and update mechanisms have since been tightened. For what it’s worth - entry was to telcos and financial services with interests aligned to China. Notepad++ dev did a great job treating issue seriously.