🎉 Thanks to our AMAZING community, MalwareBazaar has reached a significant milestone - over 1 MILLION malware samples shared!! We simply couldn't achieve this without the efforts of our contributors and we want to say a massive THANK YOU 🙏🙏 #milestone #community #grateful #sharingiscaring 😻

Interesting bash script, fully undetected (FUD) 🔥. It conducts various modifications on Linux based systems ⚙️ and uses iptables to forward certain ports to a C2 🔀: 45.156.87.37 Malicious bash script: 📜https://bazaar.abuse.ch/sample/27e2a9abfeb5f72746931dff55cd21b6631bab3aa13d8a1cb67c9319d8692229/

Over the last 30 days URLhaus sent out 41,270 abuse reports to hosting providers and network owners - that's up +48.88% on the previous month! 📈 That’s all you. That’s the power of our #community🤘 #AmazingWork #SharingIsCaring

Looks like this #Mirai threat actor is a BIG fan of our URLhaus platform 😜 👉 hXXp://45.141.215.196/FuckYou0urlhaus0abuse0ch/ We thought we'd send a little love back to the threat actor... their server’s been taken down, and their #botnet C2 domain is now sinkholed. 😘 ⤵️

📣 Big thanks to MalwareBazaar Top Contributor "JAMESWT_WT" 🙇 First seen: 30 March 2020 and since then, they’ve shared 45,994 malware samples. In the last 30 days alone, they have dropped 1,472 new samples, that’s +30% ⬆️ from the previous month, with 631 samples shared on September 30th. 🔥🔥

Over the last 30 days, the community shared 26,575 #IOCs on ThreatFox 🦊. That's a 83% jump on the previous month. 🚀 And topping the charts: XtremeRAT, with 6,640 IOCs 💀 Find more ThreatFox statistics here: 👉 threatfox.abuse.ch/statistics #SharingIsCaring #XtremeRAT #Malware #ThreatIntel

🔥 "Kamasers" is a DDoS botnet, first seen in August, and dropped by Amadey. The malware name was adapted from the User-Agent used during network communication with the C2 server. The first time we encountered it, the sample was written in Golang language. ⤵️

We’ve just rolled out two new features on MalwareBazaar 🆕 👀 ➡️ OpenTIP integration: Results from @kasperskylab.bsky.social OpenTIP are now included for all samples on MalwareBazaar, available via both, UI and API 🖥️

Since end of August we observe infamous #LummaStealer communicating with DGA-like domain names. We have seen such domains across 3 distinct IP address, all sharing the same SSL certificate ⤵️ 129.226.128.168:443 (Tencent 🇨🇳) 31.220.109.219:443 (Hostinger 🇺🇸) 165.227.143.219:443 (DigitalOcean🇺🇸)

We encountered a a new loader advertised as "Morpheus" in underground forums 🕵️, recently dropped by #Amadey ⬇️🪲. Morpheus' C2 protocol is based on HTTP and working with tasks, where each task consists of an ID and a command 📣 Botnet C2: sophos-upd-srv .info 🇳🇱

Fresh Amadey botnet C2 domains 🪲🔍👀⤵️ microsoft-telemetry .cc telemety-sys .lol telemety-xbox .lol witasametry .live telamtykina .live telemetrywatson .live More Amadey IOCs are available on ThreatFox 🦊: 📡https://threatfox.abuse.ch/browse/malware/win.amadey/

You know you did something right if you get a false positive report for on URLhaus with the words "fuck u" 😎 vtuber DDoS bot spreading through ThinkPHP RCE (CVE-2019-9082) ⤵️ urlhaus.abuse.ch/host/172.233... Payload: bazaar.abuse.ch/sample/dafb6... IOCs: threatfox.abuse.ch/browse/tag/D...

SalatStealer (aka WEB_RAT) is on the rise 📈, heavily dropped by Amadey Malware sample: 📄https://bazaar.abuse.ch/sample/8b94f5fa94f35e5ba47ce260b009b34401c5c54042d7b7252c8c7d13bf8d9f05/ Admin Panel: 📡https://salat .cn/login/ (Cloudflare) Gihub: 🗜️https://github.com/webr-at/importantfiles/releases

Compromised travel agency in Sri Lanka 🇱🇰 spreading fake Royal Air Maroc ✈️🇲🇦emails with a weaponized PDF 📄 that leads to a rogue ConnectWise ScreenConnect download 🔥 ➡️ hunting.abuse.ch/hunt/6890d35... Payload delivery URL + botnet C2 are hosted at 51.89.204 .89 (StarkRDP 🇩🇪)

We've observed an interesting infection chain ⛓️ in the wild, starting with #LummaStealer spread through a fake gaming website and resulting in #Latrodectus and #SectopRat 🪲🔍👀 See below for more...

Community is at the heart of what we do at abuse.ch ❤️ To protect the future of the platforms and the community behind them, we've been making changes. Read more ⤵️ abuse.ch/blog/creatin...

Heads up if you operate a Fortinet or Citrix device ⚠️🚨 Various IP addresses from 178.22.24.0/24 (AS209290 GALEON-AS 🇷🇺) are currently heavily running exploitation attempts against vulnerable Fortinet and Citrix Netscaler devices 🔥 You may want to block this network at your network edge 🛑

After NoName057(16) got hit by Europol🇪🇺, they are whining around and talking about a new "digital war" that has just begun🤡 It's 🍿 time!

Another #DarkWatchMan campaign began on 15th June, with multiple waves over the following two days🔥 ⤵️

We are incredibly proud to have assisted Europol 🇪🇺 in a global operation against the notorious pro-Russian #hacktivist group #NoName057(16) 🥳 www.europol.europa.eu/media-press/...

Unknown Java #RAT using Halkbank as a lure 🪝, targeting Turkish citizens 🇹🇷 Halkbank Ekstre.jar \strlogs\keylogs_4558.html Botnet C2: 📡77.90.153.31:5590 (AS214943 RAILNET 🇺🇸) Malware sample: 📄https://bazaar.abuse.ch/sample/daf23a217b188f63657b051fda8bbd6eb341172b9519b9b5bff1a60eb4dda5a1/

We've just onboard another malware analysis service on MalwareBazaar: Malva.RE 🎉 MalwareBazaar now includes detection from Malva.RE as well as tags and malware configuration files🪲🔍 Here's a sample report: 👉 bazaar.abuse.ch/sample/aff5b...

📢 It’s only 7 days until you’ll need to authenticate to access data via API across ALL our platforms. We’re doing this update to help us manage heavy usage and keep things running smoothly for everyone. If you use our APIs, make sure you’re set up by June 30th: #AuthenticateNow

Active #CobaltStrike botnet C2 🔥 ⛔️https://api.micosoftr .icu/djiowejdf ⛔️https://www.googleapi .top/jquery-3.3.1.min.js Sample: 📄https://bazaar.abuse.ch/sample/91e851f8cd9a32f9077f9fbbf1a64278e6be460ed5908778e4b45e62e495167e/ IOCs on ThreatFox 🦊 threatfox.abuse.ch/browse/tag/c...

We are happy to announce the integration of Kunai Linux Sandbox on MalwareBazaar 🥳 Sample ELF X86 report ⤵️ bazaar.abuse.ch/sample/0d221...

There's a #MassLogger malware campaign using an allegedly compromised email account🪝of an employee at the Ministry of Agriculture, Water Management and Forestry of Bosnia and Herzegovina 🇧🇦, used to exfiltrate data from compromised devices through SMTP 🔥 👉 bazaar.abuse.ch/sample/45535...

After the #Lumma Stealer takedown a few weeks ago, threat actors moved away from Cloudflare to AS47105 Vault Dweller OU 🇪🇪 with Finnish upstream Creanova 🇫🇮 ⛔ 195.82.146.193:443 ⛔ 195.82.146.221:443 ⛔ 195.82.146.223:443 Not only Lumma botnet C2s are hosted there ⤵️ threatfox.abuse.ch/asn/47105/

📢 Heads-up! In just 3 WEEKS authentication will be required to access data via API across ALL our platforms. This change will help us manage heavy usage and keep things running smoothly for everyone. Rely on our APIs? #AuthenticateNow, to avoid any problems and maintain uninterrupted availability!

URLHaus Blocklist comparison, now includes DNS4EU 🇪🇺, currently with coverage of 70% of all active malware distribution domains/hostnames tracked URLhaus 🕵️‍♂️ Example URL report: 🌐 urlhaus.abuse.ch/host/confirm... Blocklist comparison: 🔎 urlhaus.abuse.ch/statistics/#...

❗Attention | Platform integrators of abuse.ch's data. From June 30, 2025, users of our data will be required to use an authentication key to access our APIs. This means that any user accessing the abuse.ch's data from your platform will require functionality to input an authentication key. ⤵️

EU Council 🇪🇺 has issued sanctions against Stark Industries, a hosting company registered in the UK 🇬🇧, as "they have been acting as enablers of various Russian state-sponsored and affiliated actors to conduct destabilising [...] the Union and third countries" www.consilium.europa.eu/en/press/pre...

#ItsNewFeatureTuesday! (That’s a thing, right?) 😎 You can now share searches with 3rd parties without them needing to authenticate to view the results! It’s a neat feature that will save time and hassle. Here's how it works ⤵️

📢 Reminder: Rate limits have been introduced for excessive API queries from unauthenticated users to keep the platforms running smoothly for everyone. If you experience issues #Authenticate – it’s quick, easy, and helps ensure the platforms are stable for all. #SteadyPlatform #SteadySignals 🧘

This #Mirai botnet tries to exploit an 8 year old vulnerability in ZyXEL routers (CVE-2017-18368) to spread itself further 🪲🔍 User-Agent: r00ts3c-owned-you Payload URLs, malware samples and botnet C2 are accessible here: 👉 hunting.abuse.ch/hunt/66f38a6...

@pivotcon.bsky.social STARTS TODAY! 🎉 🎉 We can’t wait to see some familiar faces and catch up with this awesome community 💙💛 #SeeYouThere #Pivotcon25

🦊 ThreatFox Update | IOCs don’t last forever and internet infrastructure often gets re-used. To avoid false positives, we’re now expiring IOCs older than 6 months. Expired IOCs will no longer appear in ThreatFox exports or be published via the ThreatFox APIs. #ThreatFox #IOC #CyberThreatIntel

8️⃣ weeks, 2️⃣ months, or 6️⃣0️⃣ days. No matter how you count it, mandatory authentication will go live on June 30, 2025. From this date, authentication will be required to access data via API across all our platforms... ⤵️

Only 1️⃣ week to go!! #ExcitedMuch #CTI #ThreatIntel @pivotcon.bsky.social 💃 🤩

Who loves YARAify? We do! 💛 And now there’s even more to love with the latest cool features making threat hunting easier🕵️‍♂️. Now you can... ⤵️

📢 Reminder: We’ve introduced rate limits on excessive API queries from unauthenticated users to ensure the platforms are running smoothly for everyone. ✅👌 #AuthenticateNow – it’s quick, easy, and helps keep the platform stable for all 💪 #SteadyPlatform #SteadySignals

🦊 NEW on ThreatFox: ASN information and statistics! Now when you browse a network IOC (IP, domain, or URL), you’ll get details on the associated ASN, including: 👉 ASN number 👉 ASN name 👉 Country 👉 No. of observed IOC 👉 Malware families ...and even more insights and statistics! ⤵️

"RIDE OR DIE" Can anyone label this malware? Seems to be a NodeJS executable, tagged as #NodeLoader Botnet C2s 🛰️ 5.252.153.120:3000 🇵🇦 66.63.187.72:3000 🇺🇸 85.209.153.84:3000 🇺🇸 95.164.53.146:3000 🇩🇪 Malware samples ☣️ bazaar.abuse.ch/browse/signa... ThreatFox IOCs 🦊 threatfox.abuse.ch/browse/tag/N...

We’re pumped to be a Gold Sponsor 📢 at Pivotcon this year with our partner @spamhaustech.bsky.social ! 🔥 This event is the REAL DEAL. It’s organized by threat analysts, for threat analysts 🤝and offers tons of value! And there’s less than a month to wait! Let’s go! 🤩💪

We're proud to announce our support for CAPE Sandbox, a fully open-source malware sandbox developed and maintained by a dedicated group of volunteers. After almost a year of downtime, we are extremely happy that we were able to help CAPE get back online again! 🥳 👉 capesandbox.com ⤵️

REMINDER | ⏰ Starting June 30, 2025, you’ll need to authenticate to access data via API on all our platforms. It’s a quick setup but it will help keep the platforms running smoothly for everyone. Here’s how to get it done ⤵️

Unknown stealer botnet C2 targeting LATAM, having #opendir 👉https://urlhaus.abuse.ch/host/almeida.clientepj.com/

😜 Is it next week yet?! We're counting down the days to RISE USA with our friends at Team Cymru AND it’s the 15th anniversary of this brilliant event! See you there, safe travels! 🚘✈️🚆 #RISEUSA #TeamCymru #TechnologySponsors

Have you set up a hunting alert on URLhaus yet? With this new feature, you can get real-time notifications of key events, including: ✅ URL pattern (exact or wildcard match) ✅ Tag match (exact) ✅ Payload of a URL changes (URL ID) ✅ Signature for payload matches (exact) Cont...⤵️

📢 SERVICE UPDATE | Starting June 30, 2025, authentication will be required to access data via API on all our platforms. This change will allow us to better manage heavy usage and improve platform stability for everyone. Authenticate now if you or your organization rely on access to our APIs!

abuse.ch & Spamhaus are heading to Team Cymru's #RISEUSA2025 🇺🇸 and we’re pumped to be a Champion Technology Sponsor this year! Who's going? Send us a DM if you want to meet up!