Yet another RAT in town: RemoteX🖥️🖱️ 🪲 Dropped by Amadey 📃 Written in Golang 💻 Uses HKCU\...\CurrentVersion\Run\RemoteX for persitence (lame 🚽) 🌐 Uses WebSocket for C2 communication 🕵️‍♂️ Unauthenticated RAT admin panel 🤡 Botnet C2: 📡 109.107.168.147:80 (Partner Hosting LTD 🇬🇧)

Xillen Stealer 🎣, heavily dropped by Amadey 🔥 Botnet C2: https://goldenring[.]live/api/logs/check "Invisible. Undetectedable. Unstopable." 🤡 👉 github.com/BengaminButt... Samples ⤵️ bazaar.abuse.ch/browse/signa... Additional IOCs on ThreatFox 🦊 threatfox.abuse.ch/browse/tag/X...

Thank you @spamhaustech.bsky.social & @abuse-ch.bsky.social for being #PIVOTcon26 Silver Sponsor 🎉 Read more about alliance: abuse.ch & spamhaus.com This alliance empowers the largest independently crowdsourced intelligence of tracked malware and botnets pivotcon.org/sponsors #CTI #ThreatIntel

Brazillian banker 🇧🇷 caught by @johnk3r 🎣 GHOST panel 🧐 007consultoriafinanceira .net 83.229.17.124:80 Clouvider 🇺🇸 Payload delivery URL: 🌐https://urlhaus.abuse.ch/url/3759148/ Malware sample (MSI): ⚙️https://bazaar.abuse.ch/sample/2cbafc607c5d38a891ab89799f98b6b754b519706eb6597e4c4f2d4f6fc5db21/

Malspam sent from Microsoft Outlook that is spreading #LogMeIn GoToResolve RMM, enabling threat actors to access the victim's machine from remote 💻🔍🕵️ IOCs: 📡 adwestmailcenter .com ➡️ Landing page 📡 insightme .im ➡️ fake PDF download

CHICXULUB IMPACT 💥 Botnet C2 URLs: 📡 turbokent .name/api/initialize 📡 turbokent .name/api/status Sponsoring domain registrar: NICENIC 🇭🇰 Malware sample 📄: bazaar.abuse.ch/sample/c32e1...

New Stealer in town: SantaStealer 🎅🎄 Botnet C2s ➡️all hosted at AS399486 VIRTUO 🇨🇦: 📡31.57.38.119:6767 📡31.57.38.244:6767 📡80.76.49.114:6767 Stealer admin panel (via @darkwebinformer.com 💪): 🕵️ stealer. su Artifacts 💻: C:\tempLog\Clipboard.txt %LocalAppData%\Temp\passwordslog.txt

Love letter ❤️ from a threat actor 🕵️exploiting React2Shell vulnerability (CVE-2025-55182) to spread #Mirai malware ⤵️ fuckoffurlhaus 😂 Payload URLs: 🌐 urlhaus.abuse.ch/host/45.153.... Mirai botnet C2s: 📡 marvisxoxo .st (ISTanCo 🇷🇸) 📡 45.156.87 .231:23789 (AS51396 PFCLOUD 🇩🇪)

Unknown malware using WebSockets for botnet command&control, spreading through #ClickFix ⤵️ 🖱️ClickFix -> 📃VBS -> ⚙️MSI Payload delivery host: 🌐https://urlhaus.abuse.ch/host/103.27.157.60/ Malware sample 🤖: bazaar.abuse.ch/sample/4d8e5... Botnet C2 domains: 📡w2li .xyz 📡w2socks .xyz

Exploitation of recent React RCE vul (CVE-2025-55182 - #React2Shell) leading to #Mirai infection ⤵️ Botnet Mirai C2 domains 📡: fuckphillipthegerman .ru Botnet Mirai C2 servers , all hosted at FORTIS 🇷🇺: 138.124.72.251:52896 138.124.69.154:60328 5.144.176.19:60328

MaksRAT HKCU\Software\Microsoft\Windows\CurrentVersion\Run\javacom Botnet C2s 📡 104.198.24 .41:6656 avocado .gay www.foldacces .online www.makslove .xyz www.mavenrat .xyz www.blackprofit .online Sample shared by @smica83 💪 bazaar.abuse.ch/sample/88310... IOCs threatfox.abuse.ch/browse/tag/M...

Mirai campaign spreading through 213.209.143.85 (Railnet 🇳🇱), messing around with the victim's system iptables 🤔 Mirai botnet C2 domain: womp.datasurge .vip (NameCheap 🇺🇸) Mirai botnet C2 server: 176.65.148.57:6969 (Pfcloud 🇩🇪) Payload URL: 🌐 urlhaus.abuse.ch/url/3725743/

Mirai botnet #zerobot spreading through 172.86.123.179 (cloudzy 🇦🇪) ⤵️ Mirai botnet C2 domain: 0bot.qzz .io (Gandi SAS 🇫🇷) Mirai botnet C2 server: 140.233.190.96:69 (Internet Magnate 🇿🇦) Payload URLs: 🌐 urlhaus.abuse.ch/host/172.86.... Mirai malware sample: 🤖 bazaar.abuse.ch/sample/9f64e...

🎉 Massive shout out to URLhaus Top Contributor “geenensp” First seen April 13th 2020 and since then, they’ve shared an unbelievable 844,345 malware URLs!! 😮 Over the last 30 days, they have shared 8,902 URLs, firmly securing their position at the top of the leaderboard 💪 ⤵️

We’ve identified an interesting malware family 🔍, which we’ve named #GrokPy due to its use of a Grok LLM model 🤖 to solve and subsequently bypass CAPTCHAs 🔥 The malware gets dropped by #Amadey and:

Yet another new stealer in town: #ArkanixStealer 🔥 %AppData%\Arkanix_lol\history.json %AppData%\Arkanix_lol\system_info.json %AppData%\Arkanix_lol\screenshot_monitor_1.png Akranix botnet C2: 📡 arkanix .pw/api/session/create 📡 arkanix .pw/delivery 📡 arkanix .pw/api/discord-injection/template

Potential new stealer dropped by #Amadey 🤖🔍Who can name it? ⤵️ 👉 hunting.abuse.ch/hunt/6919ec1... Botnet C2 domains: 📡defender-temeerty .sbs 📡telemetry-defender .lol Botnet C2 server: 🛑185.100.157.69:443 (Partner Hosting 🇬🇧) Malware sample: 📄 bazaar.abuse.ch/sample/903cd...

#OpEndgame 📣: We assisted in the takedown of infrastructure associated with #Rhadamanthys and share a full list of botnet C2s on ThreatFox 🦊 Full list of Rhadamanthys botnet C2s: 📡 threatfox.abuse.ch/browse/tag/O... Europol press release: 🚨 www.europol.europa.eu/media-press/...

Over the past 30 days, our community shared 27,165 new #IOCs on ThreatFox 🦊 — an 18% increase from the previous month. 👏 Huge shoutout to Juroots, our top contributor with 2,746 IOCs submitted. 💀 The most-shared malware family (or in this case framework)? Clearfake, with 2,817 IOCs reported. ⤵️

🎉 Thanks to our AMAZING community, MalwareBazaar has reached a significant milestone - over 1 MILLION malware samples shared!! We simply couldn't achieve this without the efforts of our contributors and we want to say a massive THANK YOU 🙏🙏 #milestone #community #grateful #sharingiscaring 😻

Interesting bash script, fully undetected (FUD) 🔥. It conducts various modifications on Linux based systems ⚙️ and uses iptables to forward certain ports to a C2 🔀: 45.156.87.37 Malicious bash script: 📜https://bazaar.abuse.ch/sample/27e2a9abfeb5f72746931dff55cd21b6631bab3aa13d8a1cb67c9319d8692229/

Over the last 30 days URLhaus sent out 41,270 abuse reports to hosting providers and network owners - that's up +48.88% on the previous month! 📈 That’s all you. That’s the power of our #community🤘 #AmazingWork #SharingIsCaring

Looks like this #Mirai threat actor is a BIG fan of our URLhaus platform 😜 👉 hXXp://45.141.215.196/FuckYou0urlhaus0abuse0ch/ We thought we'd send a little love back to the threat actor... their server’s been taken down, and their #botnet C2 domain is now sinkholed. 😘 ⤵️

📣 Big thanks to MalwareBazaar Top Contributor "JAMESWT_WT" 🙇 First seen: 30 March 2020 and since then, they’ve shared 45,994 malware samples. In the last 30 days alone, they have dropped 1,472 new samples, that’s +30% ⬆️ from the previous month, with 631 samples shared on September 30th. 🔥🔥

Over the last 30 days, the community shared 26,575 #IOCs on ThreatFox 🦊. That's a 83% jump on the previous month. 🚀 And topping the charts: XtremeRAT, with 6,640 IOCs 💀 Find more ThreatFox statistics here: 👉 threatfox.abuse.ch/statistics #SharingIsCaring #XtremeRAT #Malware #ThreatIntel

🔥 "Kamasers" is a DDoS botnet, first seen in August, and dropped by Amadey. The malware name was adapted from the User-Agent used during network communication with the C2 server. The first time we encountered it, the sample was written in Golang language. ⤵️

We’ve just rolled out two new features on MalwareBazaar 🆕 👀 ➡️ OpenTIP integration: Results from @kasperskylab.bsky.social OpenTIP are now included for all samples on MalwareBazaar, available via both, UI and API 🖥️

Since end of August we observe infamous #LummaStealer communicating with DGA-like domain names. We have seen such domains across 3 distinct IP address, all sharing the same SSL certificate ⤵️ 129.226.128.168:443 (Tencent 🇨🇳) 31.220.109.219:443 (Hostinger 🇺🇸) 165.227.143.219:443 (DigitalOcean🇺🇸)

We encountered a a new loader advertised as "Morpheus" in underground forums 🕵️, recently dropped by #Amadey ⬇️🪲. Morpheus' C2 protocol is based on HTTP and working with tasks, where each task consists of an ID and a command 📣 Botnet C2: sophos-upd-srv .info 🇳🇱

Fresh Amadey botnet C2 domains 🪲🔍👀⤵️ microsoft-telemetry .cc telemety-sys .lol telemety-xbox .lol witasametry .live telamtykina .live telemetrywatson .live More Amadey IOCs are available on ThreatFox 🦊: 📡https://threatfox.abuse.ch/browse/malware/win.amadey/

You know you did something right if you get a false positive report for on URLhaus with the words "fuck u" 😎 vtuber DDoS bot spreading through ThinkPHP RCE (CVE-2019-9082) ⤵️ urlhaus.abuse.ch/host/172.233... Payload: bazaar.abuse.ch/sample/dafb6... IOCs: threatfox.abuse.ch/browse/tag/D...

SalatStealer (aka WEB_RAT) is on the rise 📈, heavily dropped by Amadey Malware sample: 📄https://bazaar.abuse.ch/sample/8b94f5fa94f35e5ba47ce260b009b34401c5c54042d7b7252c8c7d13bf8d9f05/ Admin Panel: 📡https://salat .cn/login/ (Cloudflare) Gihub: 🗜️https://github.com/webr-at/importantfiles/releases

Compromised travel agency in Sri Lanka 🇱🇰 spreading fake Royal Air Maroc ✈️🇲🇦emails with a weaponized PDF 📄 that leads to a rogue ConnectWise ScreenConnect download 🔥 ➡️ hunting.abuse.ch/hunt/6890d35... Payload delivery URL + botnet C2 are hosted at 51.89.204 .89 (StarkRDP 🇩🇪)

We've observed an interesting infection chain ⛓️ in the wild, starting with #LummaStealer spread through a fake gaming website and resulting in #Latrodectus and #SectopRat 🪲🔍👀 See below for more...

Community is at the heart of what we do at abuse.ch ❤️ To protect the future of the platforms and the community behind them, we've been making changes. Read more ⤵️ abuse.ch/blog/creatin...

Heads up if you operate a Fortinet or Citrix device ⚠️🚨 Various IP addresses from 178.22.24.0/24 (AS209290 GALEON-AS 🇷🇺) are currently heavily running exploitation attempts against vulnerable Fortinet and Citrix Netscaler devices 🔥 You may want to block this network at your network edge 🛑

After NoName057(16) got hit by Europol🇪🇺, they are whining around and talking about a new "digital war" that has just begun🤡 It's 🍿 time!

Another #DarkWatchMan campaign began on 15th June, with multiple waves over the following two days🔥 ⤵️

We are incredibly proud to have assisted Europol 🇪🇺 in a global operation against the notorious pro-Russian #hacktivist group #NoName057(16) 🥳 www.europol.europa.eu/media-press/...

Unknown Java #RAT using Halkbank as a lure 🪝, targeting Turkish citizens 🇹🇷 Halkbank Ekstre.jar \strlogs\keylogs_4558.html Botnet C2: 📡77.90.153.31:5590 (AS214943 RAILNET 🇺🇸) Malware sample: 📄https://bazaar.abuse.ch/sample/daf23a217b188f63657b051fda8bbd6eb341172b9519b9b5bff1a60eb4dda5a1/

We've just onboard another malware analysis service on MalwareBazaar: Malva.RE 🎉 MalwareBazaar now includes detection from Malva.RE as well as tags and malware configuration files🪲🔍 Here's a sample report: 👉 bazaar.abuse.ch/sample/aff5b...

📢 It’s only 7 days until you’ll need to authenticate to access data via API across ALL our platforms. We’re doing this update to help us manage heavy usage and keep things running smoothly for everyone. If you use our APIs, make sure you’re set up by June 30th: #AuthenticateNow

Active #CobaltStrike botnet C2 🔥 ⛔️https://api.micosoftr .icu/djiowejdf ⛔️https://www.googleapi .top/jquery-3.3.1.min.js Sample: 📄https://bazaar.abuse.ch/sample/91e851f8cd9a32f9077f9fbbf1a64278e6be460ed5908778e4b45e62e495167e/ IOCs on ThreatFox 🦊 threatfox.abuse.ch/browse/tag/c...

We are happy to announce the integration of Kunai Linux Sandbox on MalwareBazaar 🥳 Sample ELF X86 report ⤵️ bazaar.abuse.ch/sample/0d221...

There's a #MassLogger malware campaign using an allegedly compromised email account🪝of an employee at the Ministry of Agriculture, Water Management and Forestry of Bosnia and Herzegovina 🇧🇦, used to exfiltrate data from compromised devices through SMTP 🔥 👉 bazaar.abuse.ch/sample/45535...

After the #Lumma Stealer takedown a few weeks ago, threat actors moved away from Cloudflare to AS47105 Vault Dweller OU 🇪🇪 with Finnish upstream Creanova 🇫🇮 ⛔ 195.82.146.193:443 ⛔ 195.82.146.221:443 ⛔ 195.82.146.223:443 Not only Lumma botnet C2s are hosted there ⤵️ threatfox.abuse.ch/asn/47105/

📢 Heads-up! In just 3 WEEKS authentication will be required to access data via API across ALL our platforms. This change will help us manage heavy usage and keep things running smoothly for everyone. Rely on our APIs? #AuthenticateNow, to avoid any problems and maintain uninterrupted availability!

URLHaus Blocklist comparison, now includes DNS4EU 🇪🇺, currently with coverage of 70% of all active malware distribution domains/hostnames tracked URLhaus 🕵️‍♂️ Example URL report: 🌐 urlhaus.abuse.ch/host/confirm... Blocklist comparison: 🔎 urlhaus.abuse.ch/statistics/#...

❗Attention | Platform integrators of abuse.ch's data. From June 30, 2025, users of our data will be required to use an authentication key to access our APIs. This means that any user accessing the abuse.ch's data from your platform will require functionality to input an authentication key. ⤵️

EU Council 🇪🇺 has issued sanctions against Stark Industries, a hosting company registered in the UK 🇬🇧, as "they have been acting as enablers of various Russian state-sponsored and affiliated actors to conduct destabilising [...] the Union and third countries" www.consilium.europa.eu/en/press/pre...