Most domains created by Revolver Rabbit contained at least one dictionary word and a five-digit number separated from each other by a dash, a report from Infoblox showed.
APT41, also known as Wicked Panda, Barium, and Winnti, exploited Tomcat Apache Manager servers' web shells to facilitate dropper execution and backdoor distribution before leveraging the DUSTTRAP multi-stage plugin framework to conceal malicious activity.
Aside from the nine-year jail sentence and another three years of supervised release, Penchukov was also ordered by the U.S. government to provide over $54 million in restitution and nearly $20 million in forfeiture funds.
Attackers have leveraged a malicious ZIP archive file with a Windows shortcut, which when executed triggers a clean PDF file and eventually runs Jellyfish Loader.