Operation STANDOFF Uses GitHub Redirects Across 44 Servers to Hide Multi-Malware C2 Traffic

Operation STANDOFF is a Russian‑speaking cybercriminal campaign that uses a cluster of at least 44 TimeWeb‑hosted servers that all masquerade as benign GitHub redirectors to conceal multi‑malware command‑and‑control (C2) and proxy traffic.

This infrastructure underpins a full ecosystem: a pay‑per‑install loader, a proxy‑botnet, a multi‑operator intrusion console, and an AI‑driven influence and outreach platform.

All core components are hosted on infrastructure operated by Russian provider TimeWeb Ltd. (AS9123), providing a single operational backbone for malware, C2, and influence tooling

At the access layer, a pay‑per‑install (PPI) loader delivers a bundle of commodity malware families including Raccoon Stealer, RedLine, Amadey, SmokeLoader, Socelars, Glupteba, and XMRig while simultaneously turning off security controls and establishing rootkit‑grade persistence.

Compromised hosts are then conscripted into a proxy‑botnet, turning victims into relay nodes that launder operator traffic.

The initial sample analyzed by VMRay, setupx86x64install.exe, is a 32‑bit NSIS installer that behaves as a multi‑payload loader rather than a single stealer.

During execution it drops 40–50 additional PE files with randomized names, orchestrating their launch via hidden cmd.exe invocations and heavily using code injection and process hollowing.

The payloads collectively implement three monetization streams: large‑scale credential and wallet theft via RedLine, Raccoon, Socelars, and WebBrowserPassView; illicit Monero mining via XMRig; and durable botnet control via Glupteba‑style rootkit components.

The bundle aggressively reconfigures Microsoft Defender using PowerShell disabling real‑time monitoring and MAPS, adding its own directories as exclusions, and interfering with Windows Update while detecting and evading a range of AV and sandbox products.

Two campaign‑specific C2 nodes, 212.193.30.29 and 212.193.30.45, act as the pivot into the wider infrastructure cluster.

A dropped child process reaches out via WinHTTP to 212.193.30.29/server.txt and 212.193.30.45/proxies.txt, using a distinctive malformed User‑Agent string that on the wire collapses to a single control byte, providing a strong detection artifact.

VMRay Labs said in a report shared with GBhackers, attributes Operation STANDOFF to a Russian‑speaking group operating a multi‑layered criminal stack that blends commodity malware distribution, hands‑on‑keyboard intrusions, and AI‑assisted influence operations.

While 212.193.30.29 performs a simple HTTP‑to‑HTTPS 301 upgrade and ultimately serves the operator console for russianhackers.online, 212.193.30.45 and related nodes exhibit the key concealment technique.

Operation STANDOFF Uses GitHub

In response to unsolicited HTTP requests such as those from scanners or analysts these servers return an HTTP 301 redirect with empty bodies, making them appear to be benign GitHub redirectors.

Pivoting on this behavior, along with shared TLS characteristics and hosting at TimeWeb, VMRay enumerated 48 campaign servers, later reduced to 44 active nodes, many of which also expose SSH and proxy services such as Traefik and TinyProxy.

On at least one node, redirects were also observed toward multiple Microsoft‑owned domains and a Russian site (loopaai.ru), indicating attempts to hide malicious infrastructure behind both GitHub and Microsoft traffic patterns.

Over HTTPS, 212.193.30.29 presents STANDOFF COORD, a React‑based single‑page application that functions as a multi‑operator C2 and intrusion management console for the campaign.

The console talks to a backend API at api.russianhackers.online, authenticates operators via bearer tokens, and structures operations into workspaces, each with its own targets, assets, operators, and scope.

The platform maintains a real‑time inventory of compromised hosts tracking hostname, IP, OS, user context, tags, first/last seen, and state (online/idle/stopped) and explicitly classifies assets by network segment (internal, DMZ, external), reflecting an enterprise AD‑oriented threat model.

A dedicated credentials vault stores secrets by type (passwords, NTLM hashes, Kerberos tickets, API tokens, cookies, private keys) tied to domain‑style principals such as “corp‑backup,” with on‑demand reveal actions to control access.

Workflows include severity and priority grading, a structured target lifecycle (new, confirmed, exploited, reported), a points‑based scoreboard for operators, and a claim mechanism to prevent conflicting activity features more reminiscent of a professional red‑team platform than a typical crimeware panel.

All UI text and knowledge base content is predominantly in Russian, and examples reference AD attacks such as obtaining SYSTEM on dc01 via PrintNightmare (CVE‑2021‑34527) and conducting AD password spraying.

A third major component resides on 217.198.13.211, which hosts multiple domains (including xn‑‑90aguaqgfu.xn‑‑p1ai, ggstandoff, influencesite.ru, and mobilearena.online) and exposes several operator applications built on the same Vite/React stack and apiv1 JWT‑secured backend pattern.

Port 3000 serves the “Mobile Arena” gaming portal, a Russian‑language Next.js site targeting Standoff 2 and PUBG Mobile players with SEO‑optimized content, free‑skin offers, promo codes, and gambling site referrals, acting as a top‑of‑funnel lure.

Behind this, a Telegram account‑farm platform automates the acquisition, warming, and orchestration of large numbers of Telegram accounts, routing each through proxies sourced from the same proxy‑botnet created by infected victims.

It automates login flows, monitors Telegram’s service account 777000 for codes, manages channel joins and participant scraping, and coordinates activity through a Moscow‑time scheduler.

Complementing this is an English‑language, node‑based automation platform that integrates Gmail/IMAP, Google Sheets, the Anthropic Claude LLM, Telegram, WhatsApp, and generic HTTP, enabling AI‑driven, multi‑channel outreach campaigns.

Operators can design workflows that harvest email addresses, read and send mail, generate content with LLMs, and push messages over chat apps, backed by a typed credential vault for API keys and OAuth tokens.

VMRay assesses with high confidence that Operation STANDOFF represents an actively maintained, industrial‑scale capability that fuses scaled cybercrime, targeted intrusions, and coordinated inauthentic engagement, all on shared infrastructure.

The same TimeWeb‑hosted backbone supports the PPI loader, proxy‑botnet, multi‑operator C2 console, Telegram farm, and AI automation engine, tightly coupling monetization, access, and influence workflows.

At the endpoint level, heavy Defender tampering via PowerShell, VirtualBox‑style services created on non‑virtualized hosts, and concurrent deployment of multiple commodity malware families should be treated as strong indicators of involvement in this campaign.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

What Features Should AI SOC Have in 2026? A Complete Checklist : Download the AI SOC Features Checklist