APT31, using the Rekoobe backdoor, has been observed targeting TradingView, a popular financial platform, as researchers discovered malicious domains mimicking TradingView, suggesting a potential interest in compromising the platform’s user community.  By analyzing shared SSH keys, investigators identified additional infrastructure linked to this campaign and another open directory, highlighting the evolving tactics employed by APT31 to evade detection and compromise sensitive information. An open directory at 27.124.45[.]146:9998 exposed two Rekoobe malware binaries, 10-13-x64.bin and 10-13-x86.bin.

Source: GBHackers