The TTT2 APK search term remains a high-yield malware vector – block these domains in corporate environments.