Bad Actors On GMHOST Alexander Mulgin Serginovic

This report details Sundown and Neutrino exploit-kit campaigns hosted in an AMS network neighborhood that delivered multiple exploits (several CVEs) and malware payloads — including CryptoWall 4.0 and Necurs-related activity — listing domains, IPs, and MD5s as IOCs and noting geographic impact (primarily Spain and the US).