Echoes of Stargazer Goblin: Analyzing Shared TTPs from an Open Directory

This report describes the discovery and analysis of an open directory (52.156.24.251) that hosted malicious HTML/HTA files, obfuscated VBScript, PowerShell scripts, donut-generated shellcode, and Sliver C2 components used to deliver and execute malware and perform data exfiltration; the authors document network and host IoCs and note similarities to Stargazer Goblin techniques but do not conclusively attribute the activity.