http://deepweb4wt3m4dhutpxpe7d7wxdftfdf4hhag4sizgon6th5lcefloid.onion/blog/newest/sekoia-reveals-lycantrox-spy-campaign-infrastructure
The researchers identified 121 distinct domain names that were highly confidently connected to the Lycantrox infrastructure. Many of these domains are somehow connected to cybercrime and have connections to servers that accept cryptocurrency payments. The servers connected to the identified domains are located in Madagascar, Indonesia, Kazakhstan, and Angola, according to a thorough analysis of the threat.