Hackers Host JS Malware on GHOSTYNETWORKS and OMEGATECH

Hackers are abusing two bulletproof hosting providers, GHOSTYNETWORKS and OMEGATECH, to run a global JavaScript (JS) malware infrastructure that powers large‑scale malspam and business email compromise activity.

In March 2026, multiple malspam waves delivered a JavaScript backdoor via ZIP or RAR attachments to organizations across regions and sectors, including energy companies and finance ministries.

The operators appear financially motivated, aiming to compromise email accounts (EAC) and engage in business email compromise (BEC) rather than espionage.

Spam messages were sent from domains such as mail.talruit.com and mpwirerope.com, which impersonated suppliers and industrial manufacturers to lure victims into opening attached “purchase orders” or “quotes.”

These domains resolved to IP addresses 83.142.209.64 and 91.92.243.79, both sitting on abusive hosting ASNs. Targets included companies in Ukraine, Russia, Poland, Germany, and even the Ministry of Finance of Transnistria, mirroring recent real‑world BEC thefts against public‑sector finance entities.

The attached JS payloads were heavily obfuscated and executed through the system’s native scripting engine, helping them evade controls that primarily focus on executables.

Intrinsec’s said in a report shared with GBhackers, these networks provide resilient command‑and‑control (C2) and spam delivery for heavily obfuscated JS backdoors targeting organizations worldwide.

Once launched, the script collected system information and issued HTTP POST requests to its C2 over non‑standard ports such as 2002, 2004, 7273, 3232, 6565, 34567, and 2244.

In April 2026, the mails were sent by IP 46.151.182[.]109, also announced by AS205759. Amongst the targeted domains was the Ministry of Finance of the Pridnestrovian Moldavian Republic (PMR).

Each infected host was tagged with a unique identifier embedded into the URL path, for example:

• scan.aryamint.com:2244/gATIjh?ia9BFQT8YZBK2MNDLSdf0

The malware used an outdated Internet Explorer–style User‑Agent string to blend in with legacy traffic:

• Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; ...)

In some variants, the JS connected directly to C2 IPs like 158.94.211.76 over port 3232, skipping the domain layer to add resilience against simple DNS blocking.

GHOSTYNETWORKS and OMEGATECH

One pillar of this infrastructure is GHOSTYNETWORKS (AS205759), a US‑registered network allocated in January 2026 and routed by SMARTNET LIMITED. Spamhaus flags most of its announced prefixes as abusive, and the ASN is categorized as bulletproof hosting.

Historic BGP data and corporate records link GHOSTYNETWORKS to a now‑defunct ASN named OPTIBOUNCE, previously associated with the notorious bulletproof provider AnonRDP and front companies registered under organizer Daniel Mishayev.

Intrinsec assesses with medium confidence that GHOSTYNETWORKS is essentially AnonRDP’s latest rebrand, continuing the same role of hosting cybercrime‑related infrastructure.

Intrinsec honeypots recorded 30,244 attacks from GHOSTYNETWORKS IPs in March 2026, dominated by brute‑force attempts and opportunistic scanning across exposed services.

At least one IP (46.151.182.30) was also observed in Ivanti EPMM exploitation activity earlier in the year, underlining the network’s broader role in exploitation campaigns.

More advanced actors have taken notice: the financially motivated group TeamPCP has used GHOSTYNETWORKS to host PUREHVNC RAT infrastructure and C2 infrastructure for a malicious LiteLLM PyPI package that exfiltrated cloud credentials and secrets to domains like models. litellm.cloud hosted within the ASN.

The JS malware’s primary C2 endpoint, scan.aryamint.com, and one of the spam‑sending domains, mpwirerope.com, resolve to IPs in OMEGATECH (AS202412). Spamhaus and prior OSINT reporting indicate that OMEGATECH is effectively a front network for Virtualine, a Russian‑linked bulletproof hosting provider advertised on underground forums.

OMEGATECH is registered in the Seychelles, with upstreams aurologic GmbH and PfCloud UG both previously criticized for tolerating abusive downstream customers.

A Breakglass report cited by Intrinsec notes that a single OMEGATECH subnet recently hosted 67 C2 servers spanning at least 16 malware families.

In March 2026 alone, Intrinsec honeypots logged 642,001 hits from OMEGATECH IPs, far outpacing GHOSTYNETWORKS and indicating industrial‑scale scanning and attack activity.

Other research has separately tied OMEGATECH‑announced IPs to large reconnaissance campaigns against SonicWall firewalls, highlighting its growing role as generic offensive infrastructure.

The threat actor behind this JS malspam has been active since at least mid‑2025, reusing domains and shifting them across different bulletproof networks. The C2 domain aryamint.com previously resolved to 45.74.16.85 announced by TELCHACK‑AS (AS207184), another BPH network later blocked by Spamhaus.

During the TELCHACK phase, the same IP simultaneously sent spam and hosted a Remcos RAT C2, mirroring the current pattern of dual‑use infrastructure observed on GHOSTYNETWORKS and OMEGATECH. This reuse suggests a stable criminal operation that continuously migrates among friendly ASNs as old networks are burned and blocked.

IOCs

Value	Type	Description
205759	ASN	GHOSTYNETWORKS
202412	ASN	OMEGATECH-AS
83.142.209[.]64	IPv4	Emits spam
91.92.243[.]79	IPv4	Emits spam and JS backdoor C2
158.94.211[.]76	IPv4	JS backdoor C2
mail.talruit[.]com	Domain	Emits spam
talruit[.]com	Domain	Emits spam
scan.aryamint[.]com	Domain	JS backdoor C2
aryamint[.]com	Domain	JS backdoor C2
mpwirerope[.]com	Domain	Emits spam
ethara[.]org	Domain	Linked to TA infrastructure
794fab796e48f97e976d99157913ab5beee5ae8ef2731bf2af2222ae5b6a1c65	SHA-256	JS backdoor – “QUOTE_B0426.js”
ac842e4adb445a76aad135828d56116858a1b7d37b4a103f493e175816df9bb2	SHA-256	JS backdoor – “PO 03603.zip”
33713a3650a3c1d64045c3832835dcacef92ad4f09c030fbe674454266880fea	SHA-256	JS backdoor – “PO 26683.js”
7277f4dfb26a53f8ee47cac051a82f6709e07b6603f26ff3987cc64a137e07dc	SHA-256	JS backdoor – “PO8767.rar”
232a179daf4db527c062b609ebb5f19310eea8f5c80afce6f763f5841110aed8	SHA-256	JS backdoor – “PO8767.js”

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.