Daily Summary
Formbook detections reached 100 samples on 2026-10-25, a 165% increase over the 7-day average of 38. This is the most significant single-day volume for the family in the tracking window and represents a clear, sustained surge rather than a brief blip. No new C2 infrastructure was registered, which itself is worth noting given the volume.
New Samples Detected
The file type distribution is the story today. Script-based formats dominate at 66 of 100 samples: .js (49), .ps1 (6), .wsf (4), .vbs (3), .bat (3), with .exe accounting for 27. A historical Formbook profile skews toward packed executables and Office macro droppers, so a near two-thirds script share points to a loader/distribution shift, likely lightweight script stagers fetching the payload rather than the packed PE itself. The scattering of .bin, .com, .zip, and .gz (10 samples combined) suggests multiple concurrent delivery chains, possibly including archive-based wrapping to bypass mail and web gateways.
7-Day Trend
At 100 against a 38 baseline, today sits well outside normal variance. With zero new C2 servers logged, the surge is concentrated in distribution and staging, not in new backend infrastructure. That pattern is consistent with threat actors reusing existing C2 panels and rotating only the delivery layer, which keeps backend costs low while scaling volume. Analysts should expect the C2 set to remain stable even as sample counts stay elevated.
IOC Highlights
All 100 IOCs are new today, yet none map to new C2 hosts. In practice this means the extracted indicators are predominantly loader URLs, script hashes, and staging artifacts rather than command-and-control endpoints. Treat the IOC set as distribution-layer intelligence and enrich against known Formbook panel patterns before blocking at the network edge.
Security Analysis
The script-heavy split (66% scripts, 27% executables) diverges from the packed-PE-heavy profile typical of mature Formbook waves and resembles the loader-rotation behavior seen in commodity phishing kits that push signed or script-driven stagers to evade static AV. With C2 unchanged, the actors appear to be testing whether volume through script delivery converts better. Actionable recommendation: enable script runtime logging (PowerShell ScriptBlock, WScript/CScript parent-child telemetry) and alert on script interpreters spawning network connections or writing to temp directories, since signature-based detection will lag this shift. Blocking only the 27 executables leaves two-thirds of today’s traffic untouched.
Conclusion
Today’s 165% surge is a distribution-layer event, not an infrastructure one. Prioritize script execution telemetry over new C2 blocklists.