SecuriTricks - command and control

Inside China's Hosting Ecosystem: 18,000+ Malware C2 Servers Mapped Across Major ISPs

An analysis of Chinese hosting environments reveals over 18,000 active command-and-control (C2) servers distributed across 48 infrastructure providers. C2 infrastructure dominates malicious activity at 84%, followed by phishing at 13%. China Unicom hosts nearly half of all observed C2 servers, with…

malware

apt

Published: January 15, 2026

Linked vulnerabilities : CVE-2025-8110 (CVSS 8.7)

Downloadable IOCs: 12

RondoDoX Botnet Weaponizes React2Shell

A persistent nine-month RondoDoX botnet campaign has been targeting IoT devices and web applications. The threat actors have recently shifted to weaponizing a critical Next.js vulnerability, deploying malicious payloads like 'React2Shell' and cryptominers. The campaign, spanning from March to Decem…

vulnerability exploitation

Published: December 29, 2025

Downloadable IOCs: 7

Increase in Lumma Stealer Activity Coincides with Use of Adaptive Browser Fingerprinting Tactics

Trend Research observed a resurgence in Lumma Stealer activity since October 20, 2025, accompanied by new behaviors and C&C techniques. The malware now employs browser fingerprinting as part of its command-and-control tactics, collecting and exfiltrating system, network, hardware, and browser data …

browser fingerprinting

2025-11-14

cybercriminal activity

Published: November 14, 2025

Downloadable IOCs: 3

AI-Generated Code and Fake Apps Used for Far-Reaching Attacks

A new malware campaign called EvilAI is spreading globally by disguising itself as legitimate AI-enhanced productivity tools. The malware uses AI-generated code and professional interfaces to evade detection, targeting organizations across sectors like manufacturing, government, and healthcare. It …

Published: September 12, 2025

Downloadable IOCs: 14

Backdoor in "AppSuite PDF Editor": A Detailed Technical Analysis

A detailed analysis of a malicious PDF editor application called AppSuite PDF Editor reveals it to be a sophisticated backdoor. The software, masquerading as a legitimate productivity tool, is distributed through high-ranking websites. Once installed, it creates scheduled tasks and establishes pers…

Published: August 28, 2025

Downloadable IOCs: 9

Atomic macOS Stealer includes a backdoor for persistent access

The Atomic macOS Stealer (AMOS) has received a major update, now including an embedded backdoor for persistent access to compromised Mac devices. This upgrade allows attackers to maintain access, run remote tasks, and gain extended control over infected machines. The Russia-affiliated AMOS threat g…

Published: August 8, 2025

Downloadable IOCs: 6

DNS: A Small but Effective C2 system

This analysis explores the exploitation of DNS for command-and-control operations and data exfiltration. It details how cybercriminals leverage DNS tunneling to create covert communication channels, bypassing traditional security measures. The article examines various DNS tunneling families, includ…

Published: July 17, 2025

Downloadable IOCs: 0

Inside a VenomRAT Malware Campaign

A malicious campaign utilizing VenomRAT, a Remote Access Trojan, is analyzed. The attackers use a fake Bitdefender download website to spread malware, including VenomRAT, StormKitty, and SilentTrinity. These tools work together to provide initial access, steal credentials, and maintain long-term hi…

Published: May 29, 2025

Downloadable IOCs: 35

Reborn in Rust: Attempt to thwart malware analysis

AsyncRAT, a remote access trojan known since 2019, has been rewritten in Rust, marking a shift from its original C# implementation. This change aims to complicate reverse engineering efforts due to limited analysis tool support for Rust. The malware retains its core functionality, including plugin …

Published: May 26, 2025

Downloadable IOCs: 4

StilachiRAT analysis: From system reconnaissance to cryptocurrency theft

Microsoft Incident Response researchers discovered a novel remote access trojan named StilachiRAT, demonstrating sophisticated evasion, persistence, and data exfiltration techniques. The malware collects extensive system information, targets cryptocurrency wallet extensions, steals browser credenti…

system reconnaissance

anti-forensics

rdp monitoring

Published: March 17, 2025

Linked vulnerabilities : CVE-2023-36884

Downloadable IOCs: 2

LightSpy Malware Now Targets Facebook & Instagram Data

LightSpy, a modular surveillance framework, has expanded its capabilities to target Facebook and Instagram data. The malware, initially focused on mobile devices, now compromises Windows, macOS, Linux, and routers. Recent analysis reveals a significant expansion in its command list, with over 100 c…

Published: February 21, 2025

Downloadable IOCs: 27

Operation Phantom Circuit: North Korea's Global Data Exfiltration Campaign

In December 2024, the Lazarus Group, a North Korean threat actor, launched a sophisticated global campaign targeting cryptocurrency and technology developers. The operation, code-named 'Phantom Circuit,' involved embedding malware into trusted development tools, compromising hundreds of victims wor…

north korea

cryptocurrency

data exfiltration

software supply chain

command-and-control

2025-01-30

phantom circuit

Published: January 30, 2025

Downloadable IOCs: 13

Investigating A Web Shell Intrusion With Managed XDR

This analysis details a web shell intrusion incident where attackers exploited an IIS worker to exfiltrate data. The attacker uploaded a web shell, created a new account for persistence, modified an existing user's password, and used encoded PowerShell commands to establish a reverse TCP shell for …

Published: January 15, 2025

Downloadable IOCs: 0

Cyberhaven’s preliminary analysis of the recent malicious Chrome extension

A phishing attack on December 24th, 2024 compromised a Cyberhaven employee's access to the Google Chrome Web Store, leading to the publication of a malicious version of their Chrome extension. This was part of a larger campaign targeting Chrome Extension developers, primarily aiming at Facebook Ads…

Published: January 2, 2025

Downloadable IOCs: 5

Dissecting A Multi-Stage PowerShell Campaign Using Chisel

A sophisticated multi-stage PowerShell campaign has been identified, utilizing an LNK file to initiate a sequence of obfuscated scripts. The attack maintains persistence and stealth by connecting with a command-and-control server. It employs Chisel, a fast TCP/UDP tunneling tool, and a Netskope pro…

Published: November 12, 2024

Downloadable IOCs: 17

New Winos 4.0 Malware Infects Gamers Through Malicious Game Optimization Apps

A command-and-control framework called Winos 4.0 is being distributed through gaming-related applications, targeting Chinese-speaking users. The malware, rebuilt from Gh0st RAT, uses a multi-stage infection process involving fake BMP files, DLLs, and shellcode. It can harvest system information, ca…

gh0st rat

cryptocurrency wallets

multi-stage infection

Published: November 6, 2024

Downloadable IOCs: 2

DarkComet RAT: Technical Analysis of Attack Chain

This analysis examines the Remote Access Trojan (RAT) DarkComet, detailing its capabilities, distribution methods, and technical operations. The malware alters file attributes, establishes communication with malicious domains, modifies process privileges, and gathers system information. It employs …

Published: October 23, 2024

Downloadable IOCs: 1

The Dark Knight Returns: Joker malware analysis

The report details sophisticated command and control (C2) techniques employed by the APT41 threat group. APT41 uses custom malware and legitimate tools to maintain persistent access to compromised networks while evading detection. Key techniques include DNS tunneling, domain fronting, and steganogr…

Published: October 3, 2024

Downloadable IOCs: 8

Tag: command and control

Attack reports

Using KATA and KEDR to detect the AdaptixC2 agent

Joomla SEO Spam Injector: Obfuscated PHP Backdoor Hijacking Site Visitors

Technical Analysis of SnappyClient

MuddyWater Exposed: Inside an Iranian APT operation

Developer-targeting campaign using malicious Next.js repositories

Remcos Revisited: Inside the RAT's Evolving Command-and-Control Techniques

Investigation on the EmEditor Supply Chain Cyberattack

Restless Spirit: New Attacks on Russian Companies

Inside China's Hosting Ecosystem: 18,000+ Malware C2 Servers Mapped Across Major ISPs

RondoDoX Botnet Weaponizes React2Shell

Increase in Lumma Stealer Activity Coincides with Use of Adaptive Browser Fingerprinting Tactics

AI-Generated Code and Fake Apps Used for Far-Reaching Attacks

Backdoor in "AppSuite PDF Editor": A Detailed Technical Analysis

Atomic macOS Stealer includes a backdoor for persistent access

DNS: A Small but Effective C2 system

Inside a VenomRAT Malware Campaign

Reborn in Rust: Attempt to thwart malware analysis

StilachiRAT analysis: From system reconnaissance to cryptocurrency theft

LightSpy Malware Now Targets Facebook & Instagram Data

Operation Phantom Circuit: North Korea's Global Data Exfiltration Campaign

Investigating A Web Shell Intrusion With Managed XDR

Cyberhaven’s preliminary analysis of the recent malicious Chrome extension

Dissecting A Multi-Stage PowerShell Campaign Using Chisel

New Winos 4.0 Malware Infects Gamers Through Malicious Game Optimization Apps

DarkComet RAT: Technical Analysis of Attack Chain

The Dark Knight Returns: Joker malware analysis