Tracking Crimson Kingsnake

This report analyzes the Crimson Kingsnake invoice-fraud campaign: operators used compromised Office365 accounts and typosquatted domains to send targeted 'overdue invoice' spearphishes, followed by fake-thread replies and PDF invoices. The author pivots via VirusTotal to enumerate victim organizations, PDF metadata (author 'hpins'), multiple domains and file hashes, and supplies a YARA LiveHunt rule and IoCs to track the campaign.