RiskIQ went deep into the depths of Twitter to find what kind of OSINT we’ve been missing out on. RiskIQ found the URL hxxps://apkv2.qwertykeypad.host/download.php?filecode=sdk6jda2z6z0cdkg7yl7p6zv2 hosted the Android sample. The page content was a direct copy of the HTML above. This provided a high-confidence link that they were related to the group’s mobile distribution infrastructure.”]
Source: https://staging.community.riskiq.com/article/6f60db72