Implementing new Remcos detections for #IronRadar, an RDP Hostname (WIN-SVPD50JM3QK) was identified which correlated to over 170 IPs within ASN 'RootLayer Web Services'. The vast majority of these are rated malicious and are hosting various malware strains. 1/2

IronNet TR has discovered a RemcosRAT indicator 89.117.23[.]25 found to be hosting multiple open-dir domains containing the file sostener.vbs (identified as Remcos). Further investigation associates this file as part of a larger RAT campaign (12 IPs - Remcos, Async, DCRAT)

DICELOADER #C2 indicators from #IronRadar Threat Feed. 77.105.162[.]254:443 - 1/92 193.233.22[.]99:443 - 1/92 38.180.62[.]115:443 - 0/92 109.107.170[.]57:443 - 1/92 #ThreatIntel #malware #IOC #cybersecurity #ThreatHunting

BlackNET windows botnet detections have been added to #IronRadar. BlackNet functionalities include: infostealing, keylogging, cmd execution, etc New BlackNET control panel found at 216.73.156[.]90. #malware #ThreatIntel #IOC #cybersecurity

#IronRadar is tracking a series of IPs we believe to be #ShadowPad (Chinese #APT Remote Access Trojan). #IronRadar customers can get access to the full list as well as have protection against this threat. #malware #C2 #cybersecurity #ThreatHunting #IOC #RAT

#IronRadar has detected an active Meduza #C2 panel on hxxp://45.15.158.144.sslip[.]io urlscan.io/result/d55ba263-c… #threatintel #malware

#IronRadar has detected various #BitRAT #C2 servers. 46.226.163[.]38:8080 - 0 VT 77.91.101[.]145:443 - 0 VT 45.207.52[.]74:8080 - 0 VT 51.195.145[.]87:8092 - 11 VT 77.221.151[.]31:4444 - 17 VT 178.236.247[.]210:8080- 9 VT 159.100.13[.]218:8889 - 13 VT

IronNet has identified an active #RedLineStealer #C2 on 80.66.81[.]137 - AS 207957 Outbound HTTP sessions to /loader/screen/<string> via a PUT command containing a screenshot from the victim host. Activity was observed within our Collective Defense community. #CollectiveDefense