Oyster’s Trail: Resurgence of Infrastructure Linked to Ransomware and Cybercrime Actors

This report documents the resurgence of the Oyster backdoor (also known as Broomstick/CleanUpLoader), detailing newly observed infrastructure—three primary IPs, multiple domains, a Let's Encrypt TLS certificate fingerprint, and shared SSH key associations—and linking activity to threat groups and malvertising campaigns; it provides IOCs and detection pivots for defenders.