Daily Summary
Today’s Agent Tesla volume reached 82 new samples against a 7-day average of 35, a 132% surge. This is the largest single-day count in the current tracking window and marks a sharp departure from the steady baseline seen over the past week. No new C2 servers were registered, suggesting the infrastructure behind this push is already established and being reused.
New Samples Detected
The file type breakdown is heavily skewed toward script-based droppers: .js accounts for 57 of 82 samples (70%), with .vbs adding another 10. Combined, script files represent 82% of today’s volume. This is a notable shift from the more mixed distribution (executables, archives, documents) typically seen on average days. The presence of .pif, .hta, and .iso samples alongside the script-heavy bulk indicates a multi-vector delivery approach, likely relying on user execution via email attachments or web downloads. The single .xlsx sample is worth monitoring for macro-based or embedded object abuse.
Distribution Methods
The dominance of .js and .vbs files points to a phishing campaign using script attachments, a common Agent Tesla delivery pattern. These formats are often delivered as compressed archives or directly as email attachments designed to evade static email gateway filters. The .iso and .rar samples may serve as container files wrapping the script payloads to bypass Mark-of-the-Web controls on Windows. The .hta and .pif outliers suggest some experimentation with alternate execution chains.
7-Day Trend
Today’s count of 82 is 132% above the 7-day average of 35, well beyond the 25% threshold for flagging. This is not a marginal drift; it is a coordinated volume increase. The absence of new C2 registrations alongside this spike implies the operator is leaning on existing command infrastructure, possibly testing delivery at scale before rotating.
Security Analysis
The script-heavy profile (82% .js/.vbs) with reused C2 infrastructure resembles patterns seen in commodity Agent Tesla campaigns that push volume through email lures while keeping backend infrastructure stable. Operators often front-load delivery when infrastructure is already warm, maximizing return before takedowns or blocklisting force rotation. Defenders should prioritize blocking script execution from email-borne containers (.iso, .rar) and enforce AMSI logging on endpoints to catch obfuscated .js/.vbs execution chains. Given zero new C2s, existing blocklists may still be effective, so validating current IOC coverage against these 82 samples is a high-value action today.
IOC Highlights
All 82 new IOCs are fresh against the existing C2 set. Security teams should ingest these into endpoint and email detection rules, with particular attention to the .js and .vbs hashes given their volume.