{ "Event": { "analysis": "1", "date": "2026-05-21", "extends_uuid": "", "info": "[Threat Intel] One Man, One AI, One Fake Persona: Inside the 5-Year Influence and Fraud 'Patriot Bait' Campaign", "protected": false, "publish_timestamp": "1780293078", "published": true, "threat_level_id": "3", "timestamp": "1780293078", "uuid": "955d2000-1779-4eef-85e8-245ce2a74d15", "Orgc": { "name": "Rectifyq", "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4" }, "Tag": [ { "colour": "#717bc3", "local": false, "name": "misp-galaxy:producer=\"Trend Micro\"", "relationship_type": "" }, { "colour": "#ffffff", "local": false, "name": "tlp:clear", "relationship_type": "" }, { "colour": "#004646", "local": false, "name": "type:OSINT", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"none-from-src\"", "relationship_type": "" }, { "colour": "#b94b1d", "local": false, "name": "rectifyq:mitre-att&ck=\"from-OTX\"", "relationship_type": "" }, { "colour": "#b8ab01", "local": false, "name": "misp-galaxy:target-information=\"United States\"", "relationship_type": "" }, { "colour": "#49a260", "local": false, "name": "rectifyq:category=\"threat\"", "relationship_type": "" }, { "colour": "#10003d", "local": false, "name": "rectifyq:sub-category=\"TA-profile\"", "relationship_type": "" }, { "colour": "#130049", "local": false, "name": "rectifyq:sub-category=\"campaign-analysis\"", "relationship_type": "" }, { "colour": "#1a0065", "local": false, "name": "rectifyq:topic=\"crypto-related\"", "relationship_type": "" }, { "colour": "#f1dfed", "local": false, "name": "rectifyq:TA-category=\"Cybercrime\"", "relationship_type": "" }, { "colour": "#ffd12e", "local": false, "name": "rectifyq:target=\"broad-based\"", "relationship_type": "" }, { "colour": "#31373d", "local": false, "name": "rectifyq:MY-relevancy=\"not-relevant\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#3800d9", "local": false, "name": "rectifyq:action-taken=\"VT-comment\"", "relationship_type": "" }, { "colour": "#3d00e9", "local": false, "name": "rectifyq:action-taken=\"telegram\"", "relationship_type": "" } ], "Attribute": [ { "category": "External analysis", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1779447614", "to_ids": false, "type": "link", "uuid": "17fb21d8-78a0-4b70-9bb9-fb76d27c4b26", "value": "https://www.trendmicro.com/en_us/research/26/e/inside-the-influence-and-fraud-patriot-bait-campaign.html" }, { "category": "Other", "comment": "Description", "deleted": false, "disable_correlation": false, "timestamp": "1779447614", "to_ids": false, "type": "text", "uuid": "672c1f50-a272-4bc2-9126-463cdcef32b5", "value": "A solo Russian-speaking threat actor tracked as 'bandcampro' operated a five-year MAGA-themed Telegram channel with approximately 17,000 subscribers, initially forwarding cryptocurrency scam content before pivoting to AI-automated operations in September 2025. The actor utilized jailbroken Google Gemini to generate QAnon-styled posts, deploy infrastructure, manage stolen API keys, and run credential theft operations targeting politically engaged American audiences. The campaign weaponized cultural alignment with QAnon and MAGA communities to facilitate cryptocurrency fraud rather than political influence. Through AI assistance, the actor cracked 29 WordPress admin credentials, infiltrated at least one company, deployed remote access trojans disguised as cryptocurrency wallets, and operated a gamified chatbot called 'QFS 2.0 Terminal'. The operation demonstrates how frontier AI systems enable scalable, low-cost cybercriminal activities by allowing a single actor to perform tasks traditionally requiring enti..." }, { "category": "Other", "comment": "Summary", "deleted": false, "disable_correlation": false, "timestamp": "1779447614", "to_ids": false, "type": "text", "uuid": "e39d9f3e-63d8-4fb7-8d6b-4e3cd5293ed2", "value": "Name: One Man, One AI, One Fake Persona: Inside the 5-Year Influence and Fraud 'Patriot Bait' Campaign\nAuthor: AlienVault\nAdversary: bandcampro\nTags: [\"cryptocurrency fraud\", \"maga community\", \"credential theft\", \"wordpress compromise\", \"gotoresolve\", \"telegram channel\", \"qanon targeting\", \"information operation\", \"jailbroken gemini\", \"ai-assisted\"]\nTgtd countries: [\"United States of America\"]\nMlwr families: [\"GoToResolve\"]\nAttack_ids: []\nIndustries: [\"Finance\", \"Healthcare\", \"Defense\", \"Technology\"]" }, { "category": "Attribution", "comment": "Adversary", "deleted": false, "disable_correlation": false, "timestamp": "1779447614", "to_ids": false, "type": "threat-actor", "uuid": "14c5e658-dd1f-426c-ab5d-7deecf1091b2", "value": "bandcampro" }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780287862", "to_ids": true, "type": "domain", "uuid": "818175c2-dbd3-47fd-86b2-c2f51e36c9d6", "value": "indus.exchange", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "INDUS.exchange fraud domain (now offline)", "deleted": false, "disable_correlation": false, "timestamp": "1780287883", "to_ids": true, "type": "domain", "uuid": "fe3cd82c-e97b-4983-8280-e886e475c0a7", "value": "induspayments.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780287904", "to_ids": true, "type": "domain", "uuid": "3703e152-e600-4603-a985-f21d53b68b8e", "value": "vebrf.digital", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Bulletproof origin; Njalla NS (active 2022-Sep 2025)", "deleted": false, "disable_correlation": false, "timestamp": "1780287925", "to_ids": true, "type": "domain", "uuid": "e2c6ac81-8700-4b78-b4e3-1fff6f9b8157", "value": "indusx.tech", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Primary VPS (content machine, QBOT)", "deleted": false, "disable_correlation": false, "timestamp": "1780287946", "to_ids": true, "type": "ip-dst", "uuid": "50200538-08a7-448d-8675-4bacd4cb8142", "value": "213.165.51.115", "Tag": [ { "colour": "#c3e702", "local": false, "name": "asn:asn=\"210644\"", "relationship_type": "" }, { "colour": "#c047ce", "local": false, "name": "asn:as-owner=\"AEZA-AS\"", "relationship_type": "" }, { "colour": "#e1449b", "local": false, "name": "asn:as-country=\"GB\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united kingdom\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Impersonates Banking & Payments Federation Ireland (bpfi.ie); Njalla privacy NS", "deleted": false, "disable_correlation": false, "timestamp": "1780287968", "to_ids": true, "type": "domain", "uuid": "f8836390-edca-43f4-a7a7-da762fabcd7b", "value": "bpfi.digital", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Impersonates DZ Bank AG (dzbank.com); phishing infra (May-Jul 2022)", "deleted": false, "disable_correlation": false, "timestamp": "1780287989", "to_ids": true, "type": "domain", "uuid": "0e617cac-1a22-420e-a31b-92f2e2b5f06b", "value": "dzbank.capital", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Primary Cloudflare domain", "deleted": false, "disable_correlation": false, "timestamp": "1780288011", "to_ids": true, "type": "domain", "uuid": "97f8e294-3dd4-4927-8983-4f7f62754397", "value": "tralalarkefe.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "C&C server public endpoint", "deleted": false, "disable_correlation": false, "timestamp": "1780288032", "to_ids": true, "type": "hostname", "uuid": "65c3e65d-e57d-433a-8d61-0267c6c8400a", "value": "c2.tralalarkefe.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780288053", "to_ids": true, "type": "hostname", "uuid": "d7138b11-be76-4ecf-885d-a70dc3a2cccc", "value": "catchall1.tralalarkefe.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Credential-harvesting portal subdomain", "deleted": false, "disable_correlation": false, "timestamp": "1780288074", "to_ids": true, "type": "hostname", "uuid": "063f1e7b-f421-40a8-a8ca-9aeb2a0b0c9a", "value": "docs.bpfi.digital", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Payload distribution server", "deleted": false, "disable_correlation": false, "timestamp": "1780288095", "to_ids": true, "type": "hostname", "uuid": "2e607a03-a32e-4077-b167-60e2e1f93952", "value": "payloads.tralalarkefe.com", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Credential-harvesting portal subdomain", "deleted": false, "disable_correlation": false, "timestamp": "1780288116", "to_ids": true, "type": "hostname", "uuid": "a62ac260-919f-46a4-9a96-b9451ece75a9", "value": "security.bpfi.digital", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780288137", "to_ids": true, "type": "hostname", "uuid": "fcd457b0-b246-46bb-a959-a4b2b80fea08", "value": "www.bpfi.digital", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "", "deleted": false, "disable_correlation": false, "timestamp": "1780288159", "to_ids": true, "type": "hostname", "uuid": "c0988be6-08da-48b7-b2e5-5c6405684d79", "value": "www.dzbank.capital", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Bulletproof origin; Njalla NS (active 2022-Sep 2025)", "deleted": false, "disable_correlation": false, "timestamp": "1780288181", "to_ids": true, "type": "hostname", "uuid": "e9c541f5-509a-45c5-acec-52449e2ebb07", "value": "www.indusx.tech", "Tag": [ { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Ghost Proxy (GCP Netherlands, SOCKS5 port 1080)", "deleted": false, "disable_correlation": false, "timestamp": "1780288203", "to_ids": true, "type": "ip-dst", "uuid": "fce86a60-c4a2-453e-b70a-6c552418e69e", "value": "34.34.57.141", "Tag": [ { "colour": "#661a1f", "local": false, "name": "asn:asn=\"396982\"", "relationship_type": "" }, { "colour": "#b21243", "local": false, "name": "asn:as-owner=\"GOOGLE-CLOUD-PLATFORM\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Windows C&C Server (GCP europe-west4-a, RDP 3389)", "deleted": false, "disable_correlation": false, "timestamp": "1780288224", "to_ids": true, "type": "ip-dst", "uuid": "8f916869-a20e-46b7-8983-5128f57735f2", "value": "34.34.81.129", "Tag": [ { "colour": "#661a1f", "local": false, "name": "asn:asn=\"396982\"", "relationship_type": "" }, { "colour": "#b21243", "local": false, "name": "asn:as-owner=\"GOOGLE-CLOUD-PLATFORM\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Network activity", "comment": "Temp mail server (Mailpit)", "deleted": false, "disable_correlation": false, "timestamp": "1780288245", "to_ids": true, "type": "ip-dst", "uuid": "3cd41bd2-24c2-4c56-a959-15759ef10da7", "value": "35.192.41.201", "Tag": [ { "colour": "#661a1f", "local": false, "name": "asn:asn=\"396982\"", "relationship_type": "" }, { "colour": "#b21243", "local": false, "name": "asn:as-owner=\"GOOGLE-CLOUD-PLATFORM\"", "relationship_type": "" }, { "colour": "#d16c37", "local": false, "name": "asn:as-country=\"US\"", "relationship_type": "" }, { "colour": "#0088cc", "local": false, "name": "misp-galaxy:country=\"united states of america\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] } ], "Object": [ { "comment": "", "deleted": false, "description": "File object describing a file with meta-information", "meta-category": "file", "name": "file", "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "25", "timestamp": "1780288266", "uuid": "2d8cc4e8-662e-45bf-b8c4-58699db7f599", "Attribute": [ { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "md5", "timestamp": "1780288266", "to_ids": true, "type": "md5", "uuid": "cbf45d90-32ca-4ffd-a859-9eddc04c7bcd", "value": "ea1c409fdcb6dca6751c443aeed13441", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" }, { "colour": "#342294", "local": false, "name": "CommentAdded", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha1", "timestamp": "1780287670", "to_ids": true, "type": "sha1", "uuid": "7a2d93f1-68bb-4fdf-9ff1-2db2c8ba1a61", "value": "9bf39391f9c0ce989ee53c02170d7885c6c23798", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "sha256", "timestamp": "1780287670", "to_ids": true, "type": "sha256", "uuid": "08a2b04b-6cf3-4d70-a892-ed7fc6753bd4", "value": "981036cec38c6fd9796fc64a102100b97983f56b3482cc3e1f1610e14a1fae58", "Tag": [ { "colour": "#260091", "local": false, "name": "rectifyq:ioc=\"enriched\"", "relationship_type": "" }, { "colour": "#220085", "local": false, "name": "rectifyq:samples-found-in=\"VirusTotal\"", "relationship_type": "" }, { "colour": "#626567", "local": false, "name": "rectifyq:no-samples-in=\"MalwareBazaar\"", "relationship_type": "" }, { "colour": "#230087", "local": false, "name": "rectifyq:samples-found-in=\"Tria.ge\"", "relationship_type": "" } ] }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "ssdeep", "timestamp": "1780284664", "to_ids": true, "type": "ssdeep", "uuid": "70244588-fc12-4786-8830-5e7482979664", "value": "393216:q2mcrgZIm4fQoPl9CDyoC0CiLHOBp3IigWt3TWh5kCeSGhR5yZ8+4k:zgKsGCDy6rOvYigsjQ5khhho8" }, { "category": "Other", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "size-in-bytes", "timestamp": "1780284664", "to_ids": false, "type": "size-in-bytes", "uuid": "b66aafc1-75ad-4c48-8619-1963c0fe0f36", "value": "24443880" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": false, "object_relation": "vhash", "timestamp": "1780284664", "to_ids": true, "type": "vhash", "uuid": "772d5906-27f9-46c6-af80-cb0e0a526480", "value": "027066655d5d1575620011z72zb4z41z1015z3021z75z47z" }, { "category": "Payload delivery", "comment": "", "deleted": false, "disable_correlation": true, "object_relation": "filename", "timestamp": "1780284664", "to_ids": true, "type": "filename", "uuid": "edd8d457-95c1-4a9c-be78-5ac252987b39", "value": "GoToResolveUnattendedUpdater.exe" }, { "category": "Other", "comment": "Checked: 01/06/2026\nLast-scan\t: 01/06/2026", "deleted": false, "disable_correlation": true, "object_relation": "text", "timestamp": "1780284664", "to_ids": false, "type": "text", "uuid": "088e85a1-7a42-4d5b-818a-57e776bf7860", "value": "Type Description: Win32 EXE\nMicrosoft: None\nVT Total Detection:28/71\nFirst Submission:2025-10-17T11:57:09.000000+00:00\nLast Submission:2025-12-28T22:14:06.000000+00:00" } ] } ] } }