Tag: c2 infrastructure

8 Attack Reports | 0 Vulnerabilities

Attack reports

Abusing Paste.ee to Deploy XWorm and AsyncRAT Across Global C2 Infrastructure

A sophisticated malware campaign has been discovered utilizing paste.ee to distribute XWorm and AsyncRAT. The attackers employ obfuscated JavaScript with Unicode characters to download and execute malicious code from paste.ee URLs. The infrastructure includes multiple C2 servers across Europe and t…
obfuscation
xworm
remcosrat
asyncrat
remote access trojan
c2 infrastructure
2025-06-06
paste.ee
ssl certificates
Published: June 6, 2025
Downloadable IOCs: 12

Inside DanaBot's Infrastructure: In Support of Operation Endgame II

DanaBot, a versatile and persistent threat since 2018, has evolved from a banking trojan to a multi-purpose malware platform. It maintained an average of 150 active C2 servers daily, with 1,000 daily victims across 40+ countries. The malware's stealth and multi-tiered architecture contributed to it…
infostealer
danabot
malware-as-a-service
banking trojan
c2 infrastructure
2025-05-23
stealth tactics
Published: May 23, 2025
Downloadable IOCs: 65

GhostSocks - Partner In Proxy

GhostSocks is a Golang-based SOCKS5 backconnect proxy malware first identified in October 2023. It is primarily deployed alongside the LummaC2 information stealer and offered as Malware-as-a-Service. GhostSocks uses a relay-based C2 implementation with HTTP API, allowing attackers to route traffic …
lummac2
malware-as-a-service
golang
c2 infrastructure
socks5
ghostsocks
2025-02-25
credential abuse
anti-fraud bypass
backconnect proxy
vdsina
Published: February 25, 2025
Downloadable IOCs: 17

Lumma Stealer Malware Thrives as Unique Patterns Uncovered in the Infostealer's Domain Clusters

Recent research reveals Lumma Stealer command and control domain clusters share specific technical characteristics, enabling mapping of entire infrastructure clusters. The infostealer's logs are being shared for free on Leaky[.]pro, a new hacking forum, offering billions of stolen credential record…
malvertising
infostealer
lumma stealer
credential theft
youtube
malspam
sectoprat
c2 infrastructure
2025-02-22
domain clusters
Published: February 22, 2025
Downloadable IOCs: 0

Uncovering Cyber Threat Networks: SmartApeSG & NetSupport RAT

This investigation explores the connections between SmartApeSG, a FakeUpdate threat, and NetSupport RAT. Through analysis of Internet telemetry data, the research uncovered related C2 management hosts, active NetSupport RAT servers, and cross-connections to suspicious infrastructure. Key findings i…
cryptocurrency
socgholish
quasar rat
netsupport rat
clearfake
c2 infrastructure
2025-02-04
moldovan ips
pivoting analysis
fakeupdate
landupdate808
ispmanager
smartapesg
lycantrox
Published: February 4, 2025
Downloadable IOCs: 57

RansomHub Affiliate leverages Python-based backdoor

A threat actor utilized a Python-based backdoor to maintain access to compromised endpoints, later deploying RansomHub encryptors across the impacted network. The malware, an updated version of a previously documented backdoor, features obfuscation, deployment via RDP, and unique indicators of comp…
obfuscation
ransomware
socgholish
lateral movement
ransomhub
python backdoor
c2 infrastructure
socks5
2025-01-16
reverse proxy
Published: January 16, 2025
Downloadable IOCs: 6

ToxicPanda: a new banking trojan from Asia hit Europe and LATAM

A new Android banking Trojan called ToxicPanda has emerged, targeting Europe and Latin America. Originating from Chinese-speaking threat actors, it has infected over 1500 devices across Italy, Portugal, Spain, and other countries. ToxicPanda exploits accessibility services for account takeovers and…
android
banking trojan
aes encryption
c2 infrastructure
chinese threat actors
2024-11-06
tgtoxic
latin america
on-device fraud
toxicpanda
accessibility abuse
europe
Published: November 6, 2024
Downloadable IOCs: 19

Chinese Hackers Toolkit Uncovered And Activity History Uncovered

A Chinese hacking group called 'You Dun' was discovered through an exposed open directory, revealing their comprehensive attack infrastructure. The group utilized sophisticated reconnaissance tools and exploited Zhiyuan OA software via SQL injection attacks, targeting South Korean pharmaceutical or…
sql injection
ransomware
cobalt strike
privilege escalation
lockbit 3.0
2024-10-28
c2 infrastructure
CVE-2021-25003
chinese hackers
viper framework
reconnaissance tools
Published: October 28, 2024
Linked vulnerabilities : CVE-2021-25003
Downloadable IOCs: 7
Click here to see more Attack Reports