Tommy M (TheAnalyst) on Twitter: "This #wproilbask #IcedID campaign went active again yesterday, 12 new compromised sites used as distro. I'm guessing that it's a reverse proxy because file rotation (not true hash busting) and that files were updated on the old distros too. Current downloader C2 /ovedfromasi.top https://t.co/8yzBYMLkvD" / Twitter
https://twitter.com/ffforward/status/1481574479063097353