We’ve just rolled out two new features on MalwareBazaar 🆕 👀 ➡️ OpenTIP integration: Results from @kasperskylab.bsky.social OpenTIP are now included for all samples on MalwareBazaar, available via both, UI and API 🖥️

Since end of August we observe infamous #LummaStealer communicating with DGA-like domain names. We have seen such domains across 3 distinct IP address, all sharing the same SSL certificate ⤵️ 129.226.128.168:443 (Tencent 🇨🇳) 31.220.109.219:443 (Hostinger 🇺🇸) 165.227.143.219:443 (DigitalOcean🇺🇸)

We encountered a a new loader advertised as "Morpheus" in underground forums 🕵️, recently dropped by #Amadey ⬇️🪲. Morpheus' C2 protocol is based on HTTP and working with tasks, where each task consists of an ID and a command 📣 Botnet C2: sophos-upd-srv .info 🇳🇱

Fresh Amadey botnet C2 domains 🪲🔍👀⤵️ microsoft-telemetry .cc telemety-sys .lol telemety-xbox .lol witasametry .live telamtykina .live telemetrywatson .live More Amadey IOCs are available on ThreatFox 🦊: 📡https://threatfox.abuse.ch/browse/malware/win.amadey/

You know you did something right if you get a false positive report for on URLhaus with the words "fuck u" 😎 vtuber DDoS bot spreading through ThinkPHP RCE (CVE-2019-9082) ⤵️ urlhaus.abuse.ch/host/172.233... Payload: bazaar.abuse.ch/sample/dafb6... IOCs: threatfox.abuse.ch/browse/tag/D...

SalatStealer (aka WEB_RAT) is on the rise 📈, heavily dropped by Amadey Malware sample: 📄https://bazaar.abuse.ch/sample/8b94f5fa94f35e5ba47ce260b009b34401c5c54042d7b7252c8c7d13bf8d9f05/ Admin Panel: 📡https://salat .cn/login/ (Cloudflare) Gihub: 🗜️https://github.com/webr-at/importantfiles/releases

Compromised travel agency in Sri Lanka 🇱🇰 spreading fake Royal Air Maroc ✈️🇲🇦emails with a weaponized PDF 📄 that leads to a rogue ConnectWise ScreenConnect download 🔥 ➡️ hunting.abuse.ch/hunt/6890d35... Payload delivery URL + botnet C2 are hosted at 51.89.204 .89 (StarkRDP 🇩🇪)

We've observed an interesting infection chain ⛓️ in the wild, starting with #LummaStealer spread through a fake gaming website and resulting in #Latrodectus and #SectopRat 🪲🔍👀 See below for more...

Community is at the heart of what we do at abuse.ch ❤️ To protect the future of the platforms and the community behind them, we've been making changes. Read more ⤵️ abuse.ch/blog/creatin...

Heads up if you operate a Fortinet or Citrix device ⚠️🚨 Various IP addresses from 178.22.24.0/24 (AS209290 GALEON-AS 🇷🇺) are currently heavily running exploitation attempts against vulnerable Fortinet and Citrix Netscaler devices 🔥 You may want to block this network at your network edge 🛑

After NoName057(16) got hit by Europol🇪🇺, they are whining around and talking about a new "digital war" that has just begun🤡 It's 🍿 time!

Another #DarkWatchMan campaign began on 15th June, with multiple waves over the following two days🔥 ⤵️

We are incredibly proud to have assisted Europol 🇪🇺 in a global operation against the notorious pro-Russian #hacktivist group #NoName057(16) 🥳 www.europol.europa.eu/media-press/...

Unknown Java #RAT using Halkbank as a lure 🪝, targeting Turkish citizens 🇹🇷 Halkbank Ekstre.jar \strlogs\keylogs_4558.html Botnet C2: 📡77.90.153.31:5590 (AS214943 RAILNET 🇺🇸) Malware sample: 📄https://bazaar.abuse.ch/sample/daf23a217b188f63657b051fda8bbd6eb341172b9519b9b5bff1a60eb4dda5a1/

We've just onboard another malware analysis service on MalwareBazaar: Malva.RE 🎉 MalwareBazaar now includes detection from Malva.RE as well as tags and malware configuration files🪲🔍 Here's a sample report: 👉 bazaar.abuse.ch/sample/aff5b...

📢 It’s only 7 days until you’ll need to authenticate to access data via API across ALL our platforms. We’re doing this update to help us manage heavy usage and keep things running smoothly for everyone. If you use our APIs, make sure you’re set up by June 30th: #AuthenticateNow

Active #CobaltStrike botnet C2 🔥 ⛔️https://api.micosoftr .icu/djiowejdf ⛔️https://www.googleapi .top/jquery-3.3.1.min.js Sample: 📄https://bazaar.abuse.ch/sample/91e851f8cd9a32f9077f9fbbf1a64278e6be460ed5908778e4b45e62e495167e/ IOCs on ThreatFox 🦊 threatfox.abuse.ch/browse/tag/c...

We are happy to announce the integration of Kunai Linux Sandbox on MalwareBazaar 🥳 Sample ELF X86 report ⤵️ bazaar.abuse.ch/sample/0d221...

There's a #MassLogger malware campaign using an allegedly compromised email account🪝of an employee at the Ministry of Agriculture, Water Management and Forestry of Bosnia and Herzegovina 🇧🇦, used to exfiltrate data from compromised devices through SMTP 🔥 👉 bazaar.abuse.ch/sample/45535...

After the #Lumma Stealer takedown a few weeks ago, threat actors moved away from Cloudflare to AS47105 Vault Dweller OU 🇪🇪 with Finnish upstream Creanova 🇫🇮 ⛔ 195.82.146.193:443 ⛔ 195.82.146.221:443 ⛔ 195.82.146.223:443 Not only Lumma botnet C2s are hosted there ⤵️ threatfox.abuse.ch/asn/47105/

📢 Heads-up! In just 3 WEEKS authentication will be required to access data via API across ALL our platforms. This change will help us manage heavy usage and keep things running smoothly for everyone. Rely on our APIs? #AuthenticateNow, to avoid any problems and maintain uninterrupted availability!

URLHaus Blocklist comparison, now includes DNS4EU 🇪🇺, currently with coverage of 70% of all active malware distribution domains/hostnames tracked URLhaus 🕵️‍♂️ Example URL report: 🌐 urlhaus.abuse.ch/host/confirm... Blocklist comparison: 🔎 urlhaus.abuse.ch/statistics/#...

❗Attention | Platform integrators of abuse.ch's data. From June 30, 2025, users of our data will be required to use an authentication key to access our APIs. This means that any user accessing the abuse.ch's data from your platform will require functionality to input an authentication key. ⤵️

EU Council 🇪🇺 has issued sanctions against Stark Industries, a hosting company registered in the UK 🇬🇧, as "they have been acting as enablers of various Russian state-sponsored and affiliated actors to conduct destabilising [...] the Union and third countries" www.consilium.europa.eu/en/press/pre...

#ItsNewFeatureTuesday! (That’s a thing, right?) 😎 You can now share searches with 3rd parties without them needing to authenticate to view the results! It’s a neat feature that will save time and hassle. Here's how it works ⤵️

📢 Reminder: Rate limits have been introduced for excessive API queries from unauthenticated users to keep the platforms running smoothly for everyone. If you experience issues #Authenticate – it’s quick, easy, and helps ensure the platforms are stable for all. #SteadyPlatform #SteadySignals 🧘

This #Mirai botnet tries to exploit an 8 year old vulnerability in ZyXEL routers (CVE-2017-18368) to spread itself further 🪲🔍 User-Agent: r00ts3c-owned-you Payload URLs, malware samples and botnet C2 are accessible here: 👉 hunting.abuse.ch/hunt/66f38a6...

@pivotcon.bsky.social STARTS TODAY! 🎉 🎉 We can’t wait to see some familiar faces and catch up with this awesome community 💙💛 #SeeYouThere #Pivotcon25

🦊 ThreatFox Update | IOCs don’t last forever and internet infrastructure often gets re-used. To avoid false positives, we’re now expiring IOCs older than 6 months. Expired IOCs will no longer appear in ThreatFox exports or be published via the ThreatFox APIs. #ThreatFox #IOC #CyberThreatIntel

8️⃣ weeks, 2️⃣ months, or 6️⃣0️⃣ days. No matter how you count it, mandatory authentication will go live on June 30, 2025. From this date, authentication will be required to access data via API across all our platforms... ⤵️

Only 1️⃣ week to go!! #ExcitedMuch #CTI #ThreatIntel @pivotcon.bsky.social 💃 🤩

Who loves YARAify? We do! 💛 And now there’s even more to love with the latest cool features making threat hunting easier🕵️‍♂️. Now you can... ⤵️

📢 Reminder: We’ve introduced rate limits on excessive API queries from unauthenticated users to ensure the platforms are running smoothly for everyone. ✅👌 #AuthenticateNow – it’s quick, easy, and helps keep the platform stable for all 💪 #SteadyPlatform #SteadySignals

🦊 NEW on ThreatFox: ASN information and statistics! Now when you browse a network IOC (IP, domain, or URL), you’ll get details on the associated ASN, including: 👉 ASN number 👉 ASN name 👉 Country 👉 No. of observed IOC 👉 Malware families ...and even more insights and statistics! ⤵️

"RIDE OR DIE" Can anyone label this malware? Seems to be a NodeJS executable, tagged as #NodeLoader Botnet C2s 🛰️ 5.252.153.120:3000 🇵🇦 66.63.187.72:3000 🇺🇸 85.209.153.84:3000 🇺🇸 95.164.53.146:3000 🇩🇪 Malware samples ☣️ bazaar.abuse.ch/browse/signa... ThreatFox IOCs 🦊 threatfox.abuse.ch/browse/tag/N...

We’re pumped to be a Gold Sponsor 📢 at Pivotcon this year with our partner @spamhaustech.bsky.social ! 🔥 This event is the REAL DEAL. It’s organized by threat analysts, for threat analysts 🤝and offers tons of value! And there’s less than a month to wait! Let’s go! 🤩💪

We're proud to announce our support for CAPE Sandbox, a fully open-source malware sandbox developed and maintained by a dedicated group of volunteers. After almost a year of downtime, we are extremely happy that we were able to help CAPE get back online again! 🥳 👉 capesandbox.com ⤵️

REMINDER | ⏰ Starting June 30, 2025, you’ll need to authenticate to access data via API on all our platforms. It’s a quick setup but it will help keep the platforms running smoothly for everyone. Here’s how to get it done ⤵️

Unknown stealer botnet C2 targeting LATAM, having #opendir 👉https://urlhaus.abuse.ch/host/almeida.clientepj.com/

😜 Is it next week yet?! We're counting down the days to RISE USA with our friends at Team Cymru AND it’s the 15th anniversary of this brilliant event! See you there, safe travels! 🚘✈️🚆 #RISEUSA #TeamCymru #TechnologySponsors

Have you set up a hunting alert on URLhaus yet? With this new feature, you can get real-time notifications of key events, including: ✅ URL pattern (exact or wildcard match) ✅ Tag match (exact) ✅ Payload of a URL changes (URL ID) ✅ Signature for payload matches (exact) Cont...⤵️

📢 SERVICE UPDATE | Starting June 30, 2025, authentication will be required to access data via API on all our platforms. This change will allow us to better manage heavy usage and improve platform stability for everyone. Authenticate now if you or your organization rely on access to our APIs!

abuse.ch & Spamhaus are heading to Team Cymru's #RISEUSA2025 🇺🇸 and we’re pumped to be a Champion Technology Sponsor this year! Who's going? Send us a DM if you want to meet up!

To keep things running smoothly, rate limiting is now in effect for excessive API queries from unauthenticated users. A little balance goes a long way in making sure the platforms are stable for the whole #community. 🧘 Let’s keep things working for everyone! 🙏 #SharingIsCaring #AuthenticateNow

False positives happen - it’s just part of managing community-driven data! 🤷 But transparency is key. 🔍 Now you can identify false positives across our platforms via API, with CSV or JSON export options. Go to the hunting platform and authenticate to access: 👉 hunting.abuse.ch/false-positi...

Have you checked out the new hunting tool yet? We may have mentioned it once or twice already! 😂 And, here it is again!  🔎 Enter an IPv4, domain, URL, or file hash, and instantly see if it’s been identified on all our platforms - with just one query. But here’s something you might not know...⤵️

Missed the YouTube Live? No worries! Our latest blog post breaks down all the NEW platform features - including the brand-new hunting platform 🔎 Read it here 👇 abuse.ch/blog/introdu... Prefer to watch a video? See comments for the YouTube Live! 🫶 #SharingIsCaring #NewFeatures #HuntingPlatform

Another day, another #Amadey 📅👀 This time dropping #SystemBC ⤵️ Amadey botnet C2: 📡cobolrationumelawrtewarms .com 📡107.189.27.66 (AS14956 ROUTERHOSTING 🇳🇱) SystemBC payload: 📄https://bazaar.abuse.ch/sample/c13d59dc2e8ee1cbdb8016de0fb3b374f827406fa5d2d1aa4a2820170816d131/

We have observed #Amadey (ID: 092155) dropping #BumbleBee on an infected device, leveraging a new DGA seed 🔥 DGA domains: 🌐https://threatfox.abuse.ch/browse/tag/e5774fe6340da26c/ Malware sample: 📄https://bazaar.abuse.ch/sample/f39ac7d6c65d67bca47b59de81d84920da7ec5d0098712c1c9501e2c7dfe9bf2/

📢 1️⃣ hour to go - get a live demo of the NEW hunting platform and latest features! Join us on YouTube Live here👇 www.youtube.com/live/xobmSNf... #HuntingInAction #NewFeatures #SharingIsCaring 🫶