On July 20, 2026, VMRay Labs published its executive analysis of Operation STANDOFF, a Russian-speaking criminal campaign managing at least 44 command-and-control servers hosted on TimeWeb Ltd. (AS9123). The distinctive mechanism: the servers return HTTP 301 redirects to github.com for unsolicited requests, exploiting the trusted domain's reputation to mask malicious traffic and bypass perimeter defenses based on reputation scoring. The discovery exemplifies a paradigm shift in infrastructure deception, where legitimate domains become convenient destinations for hiding industrial-scale, multi-malware infrastructures.
- VMRay Labs identified 44 active C2 servers on TimeWeb AS9123, down from an initial 48, all part of Operation STANDOFF
- Servers use HTTP 301 redirects to GitHub with spoofed TLS certificates to appear benign to scanners and analysts
- The initial NSIS loader drops 40-50 secondary PE files, including RedLine Stealer, Amadey, SmokeLoader, and XMRig
- The STANDOFF COORD console is a React SPA with enterprise-grade workflow: severity, P0-P3 priority, points scoreboard, and claim mechanism for multi-operator deconfliction
The Redirector Mechanism: When GitHub Becomes a Blind Spot
Node 212.193.30.45, documented by VMRay, embodies the core technique. In response to unsolicited requests, it returns an HTTP 301 redirect to github.com with an empty body. The TLS certificate presented is issued for github.com, creating a superficially convincing illusion of legitimacy. VMRay notes the decisive anomaly: GitHub operates no official servers in Russia, so a Russian IP address presenting such a certificate constitutes a significant geographic and infrastructural inconsistency.
At least one other node redirected to Microsoft-owned domains and loopaai.ru, indicating an attempt to diversify the masquerade. The technique does not compromise the destination domains: GitHub and Microsoft have not been breached. Threat actors simply exploit their presence on SOC whitelists to render traffic to underlying infrastructures invisible.
This approach renders categorical reputation-scoring controls ineffective. If traffic to github.com is globally permitted, detection must shift to behavioral inspection: anomalous redirect patterns, specific HTTP headers, TLS discontinuities, User-Agent and path combinations incompatible with the legitimate domain's profile.
The Multi-Payload Ecosystem: From NSIS Loader to Systematic Defense Disabling
The entry point analyzed by VMRay is setupx86x64install.exe, a 32-bit NSIS installer with SHA-1 hash 95c5ae3fec0d900e4634e11b3ad81971e78e2b31. Upon execution, it creates a randomized directory under %LOCALAPPDATA% and drops 40-50 PE files with random names. Launch occurs via hidden cmd.exe instances, using process hollowing and code injection techniques to evade static analysis.
The payload comprises a constellation of documented tools: RedLine Stealer, Raccoon Stealer, Amadey, SmokeLoader, Socelars, Glupteba, XMRig for mining, and WebBrowserPassView for credential extraction. The second dossier source, CyberPress, documents offensive countermeasures against Microsoft Defender: disabling real-time monitoring, MAPS, and automatic sample submission via PowerShell commands, along with adding directories to exclusions and interfering with Windows Update.
The malware detects and evades products from Avast, AVG, Bitdefender, ESET, Kaspersky, Norton, Panda, and Sophos. The combination of aggressive disabling and multi-vendor fingerprinting indicates operators with deep operational familiarity with the Windows defensive ecosystem, not mere commodity malware re-packagers.
STANDOFF COORD: A C2 Console With Enterprise SOC Logic
Node 212.193.30.29 hosts the campaign management console, dubbed STANDOFF COORD. VMRay extracted and analyzed it as a React single-page application with a JWT-backed API. The Russian-language interface tracks compromised hosts by network segment — internal, DMZ, external — with operational states including online, idle, and stopped.
The console implements a workflow with four severity levels (critical, high, medium, low, info), priority from P0 to P3, and a target lifecycle that includes a confirmed_exploit state. A points-based system with scoreboard and claim mechanism manages deconfliction among concurrent operators, assigning scores for target activity and preventing overlap. The upload limit for operational artifacts is 50 MB.
The integrated knowledge base includes diagrams in Mermaid syntax. Operational examples cited in the console include PrintNightmare (CVE-2021-34527, CVSS 8.8 HIGH) and AD password spraying techniques. The CVE is not used in the sample analyzed by VMRay; it appears as a training reference in internal documentation. VMRay assesses with high confidence that Operation STANDOFF represents an industrial-scale capability fusing scaled cybercrime, targeted intrusions, and coordinated inauthentic engagement on shared infrastructure.
"Because GitHub operates no official servers in Russia, a campaign-linked Russian IP address presenting a TLS certificate in the name of [github.com] and redirecting all requests toward it was itself a strong anomaly" — VMRay Labs
The Closed Loop: Botnet, Proxy, and AI-Driven Automation
A third component, documented by GBHackers based on the VMRay report, resides on 217.198.13.211. This node hosts "Mobile Arena," a gaming lure platform, alongside a Telegram account farm with proxies sourced from the botnet of compromised hosts. Victim proxies feed the automation infrastructure, creating a closed loop: infected endpoints → resource extraction → conversion to proxies → support for outreach operations.
The same platform integrates a node-based system with the Claude LLM for multi-channel outreach on Gmail, WhatsApp, and Telegram. The dossier does not specify the exact nature of the generated messages nor document active influence campaigns or verified electoral impacts. The presence of the AI component does, however, indicate an infrastructural convergence between traditional cybercrime and inauthentic engagement operations, sharing hosting, proxies, and likely operators on the same TimeWeb backbone.
Why It Matters
The dossier does not specify corrective measures or detailed operational mitigations. The source does not indicate recommended defensive actions or provide remediation timelines. No infrastructural overlaps emerge linking the actor to pre-existing known criminal groups. The total number of confirmed victims and their geographic distribution remain unknown.
The brief does not document whether redirects to Microsoft domains are still active or were observed on more than one node. It also does not specify whether the campaign exploits proprietary zero-day vulnerabilities or relies solely on known techniques and documented CVEs. The console cites CVE-2021-34527 only as a training example, not as a vulnerability employed in the analyzed sample.
The dossier does not clarify the financial or geopolitical entity behind the AI-driven influence operations, nor identify the Russian-speaking group by a specific moniker. Linguistic and hosting attribution does not translate into verified geopolitical attribution.
The Blurring Line: Organized Crime and Influence Operations
Operation STANDOFF is not simply a commodity malware campaign. The professionalization of the C2 console — with workflow, scoreboard, and deconfliction — indicates an organizational structure managing multiple operators as a distributed workforce. The gamification of intrusions is not an aesthetic flourish: it is an operational control mechanism that measures productivity and coordinates access to limited targets.
The fusion of this model with an AI-driven multi-channel outreach platform, hosted on the same Russian hosting backbone, sketches a hybrid ecosystem where manual Active Directory intrusion skills coexist with scaled production of inauthentic content. For defenders, the lesson is that the line between organized cybercrime and conditioned influence operations is thinning — and will often share the same infrastructure, the same operators, the same redirects to domains we trust.
Information is based on the cited source and current as of publication.
Sources
- https://www.vmray.com/execution-level-analysis-of-a-russian-speaking-multi-operator-intrusion-campaign-operation-standoff/
- https://gbhackers.com/operation-standoff-uses-github/
- https://cyberpress.org/operation-standoff-deploys-fake-csrss/