The infrastructure behind the malware attacks showed good compartmentalization of identities. We rarely found the same (fake) registration information used for more than one C2 domain. Stealth Falcon operators also appear to have deleted one of their attack domains, adhostingcache.com when they realized their attempt to target Donaghy had failed. We also noted that the (self-signed) SSL certificates on the C2 domains were changed several times as we monitored the infrastructure, perhaps in an attempt to thwart fingerprinting of their infrastructure via SSL certificates