$10 Domain Could Have Handed Hackers 25k Endpoints, Including in OT and Gov Networks

Malware signed by Dragon Boss Solutions infected 25,000+ endpoints across 124 countries, including 221 universities, 41 OT/critical infrastructure networks, 35 government entities, and multiple Fortune 500 companies. The malware disables AV, persists via scheduled tasks and WMI, and relies on an unregistered update domain (chromsterabrowser[.]com) that any actor could register for ~$10 to push arbitrary code. If that domain was registered by an attacker, all 25k endpoints became remote code execution targets.