`camorreado.click`

camorreado.click is a domain that one published source reports in connection with EtherHiding and unclustered DPRK activity, which no published source ties to North Korea (DPRK). It is cited here from Decryption Digest. The report is dated 2026-07-08.

DPRK link unconfirmed Unit 42, as reported by Decryption Digest, attributes this campaign to an unidentified actor; no DPRK attribution is published for it. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.

domain EtherHidingDPRK (cluster unattributed) CURATED

First seen 2026-07-08 · last seen 2026-07-08

Registration

Registered	2026-05-25
Registrar	Sav.com, LLC
Expires	2027-05-25
Last changed	2026-05-30
Status	client transfer prohibited

From the registry’s RDAP record for camorreado.click, looked up 2026-10-11.

Source

As printed:

downloads v7.msi (or another version) from camorreado[.]click directly on the victim's machine

Notes:

Domain that served the EtherRAT installer (v7.msi) in the fake Microsoft Teams IT-support campaign.
EtherRAT Microsoft Teams Attack: Blockchain C2 Hits Finance — Decryption Digest · published 2026-07-08 · pulled 2026-10-11

Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.

Related indicators

Cited by the same report: EtherRAT Microsoft Teams Attack: Blockchain C2 Hits Finance

Decryption Digest lists 3 other indicators in this source.