22-09-2026
Exvicy: A copycat of the ErrTraffic malware distribution framework
https://www.sekoia.com/blog/exvicy-a-copycat-of-the-errtraffic-malware-distribution-framework
Report completeness: Medium
Actors/Campaigns:
Smartapesg
Threats:
Exvicy_tool
Errtraffic
Clickfix_technique
Putty_tool
Clearfake
Kongtuke
Iclickfix_tool
Dead_drop_technique
Etherhiding_technique
Geo:
Brazilian, Russian
TTPs:
Tactics: 1
Technics: 0
IOCs:
Url: 101
IP: 13
File: 5
Command: 2
Domain: 74
Coin: 2
Soft:
Cloudflare Turnstile, WordPress, Telegram, Cloudflare R2, LenAI, ChatGPT
Algorithms:
base64, fnv-1a, xor
Win API:
Polygon
Languages:
powershell, php, javascript
Links:
https://github.com/SEKOIA-IO/Community/blob/main/IOCs/exvicy/exvicy\_iocs\_20260921.csv