Implementing new Remcos detections for #IronRadar, an RDP Hostname (WIN-SVPD50JM3QK) was identified which correlated to over 170 IPs within ASN 'RootLayer Web Services'. The vast majority of these are rated malicious and are hosting various malware strains. 1/2

IronNet TR has discovered a RemcosRAT indicator 89.117.23[.]25 found to be hosting multiple open-dir domains containing the file sostener.vbs (identified as Remcos). Further investigation associates this file as part of a larger RAT campaign (12 IPs - Remcos, Async, DCRAT)

DICELOADER #C2 indicators from #IronRadar Threat Feed. 77.105.162[.]254:443 - 1/92 193.233.22[.]99:443 - 1/92 38.180.62[.]115:443 - 0/92 109.107.170[.]57:443 - 1/92 #ThreatIntel #malware #IOC #cybersecurity #ThreatHunting

BlackNET windows botnet detections have been added to #IronRadar. BlackNet functionalities include: infostealing, keylogging, cmd execution, etc New BlackNET control panel found at 216.73.156[.]90. #malware #ThreatIntel #IOC #cybersecurity

#IronRadar is tracking a series of IPs we believe to be #ShadowPad (Chinese #APT Remote Access Trojan). #IronRadar customers can get access to the full list as well as have protection against this threat. #malware #C2 #cybersecurity #ThreatHunting #IOC #RAT

#IronRadar has detected an active Meduza #C2 panel on hxxp://45.15.158.144.sslip[.]io urlscan.io/result/d55ba263-c… #threatintel #malware

#IronRadar has detected various #BitRAT #C2 servers. 46.226.163[.]38:8080 - 0 VT 77.91.101[.]145:443 - 0 VT 45.207.52[.]74:8080 - 0 VT 51.195.145[.]87:8092 - 11 VT 77.221.151[.]31:4444 - 17 VT 178.236.247[.]210:8080- 9 VT 159.100.13[.]218:8889 - 13 VT

IronNet has identified an active #RedLineStealer #C2 on 80.66.81[.]137 - AS 207957 Outbound HTTP sessions to /loader/screen/<string> via a PUT command containing a screenshot from the victim host. Activity was observed within our Collective Defense community. #CollectiveDefense

Our #C2 Threat Feed #IronRadar is tracking 4 CobaltStrike C2 servers hosting 50 unique URI paths (beacons) that are currently unreported. hxxp://1.mos.vviill[.]com:443/ hxxp://2.mos.vviill[.]com:443/ hxxp://3.mos.vviill[.]com:443/ hxxp://4.mos.vviill[.]com:443/

Identified two administrator emails associated with #MuddyWater domains as reported by @MichalKoczwara recently: alex2024.skiff[.]com -> domainsoftcloud[.]com peter-ellison.proton[.]me -> google-word[.]com | googlelinks[.]net | googlevalues[.]com

Still researching #MuddyWater, this time #IronNet Threat Researchers pivoted and identified a node of IPs associated with GuptiMiner. GuptiMiner is sophisticated back door campaign loosely attributed to North Korean group Kimsuky.

In our current research of #MuddyWater, #IronNet Threat Researchers noticed #DarkBeatC2 IoCs from @k3yp0d. Pivoting from these, we correlated the TLS Cert Serial Number with 5 additional IPs. One was identified as DarkBeat, while 3 have no ratings and are currently unknown.

#IronRadar detected Cobalt Strike #C2 on visualstudio[.]microsoft[.]com[.]volcgslb-mlt[.]com, which has been a known CS server since April 29, 2024. IronNet TR used the unique TLS certificate for this detection to uncover 18 additional C2 servers, 7 of which have no detections.

While reading through a recent article from @proofpoint @threatinsight @teamcymru_S2 regarding Latrodectus #C2 (ow.ly/6FOU50R845u), one of our threat analysts noticed a unique image on the OpenDir for one of the listed IoCs. See 🧵 for details

Why does your organization need an #IronRadar #proactive #ThreatIntelligence subscription? Well, here are three reasons why! #reNgine 0/90 on VT vmi1342433.contaboserver[.]net:8000 #reNgine 0/90 on VT 15.207.148[.]236:443 #Metasploit 0/90 on VT sniper.cambounisoll[.]com:3790

In the month of March, #IronRadar detected just over 26,000 #C2 indicators. The most detected framework was #cobaltstrike and one new framework was added (#risepro) China was the top country with 32% #proactive #ThreatIntelligence

They tried to change, but we are on the case... #Ironradar is now detecting new #Risepro #C2 servers 👀 #amadey... you're next #proactive #threatintel

Wondering how easy it is to try IronRadar? You can request a trial key in AWS! aws.amazon.com/marketplace/p… Wondering if we integrate with your security tools? Check here: github.com/IronNetCybersecur… Specific use or question? Email us at [email protected]

#IronRadar has detected the following #C2 servers #DcRat hxxps://45.91.226[.]96:65503 #reNgine hxxps://142.93.232[.]213 #Viper hxxps://74.48.220[.]31:60000 #Meterpreter hxxps://109.107.173[.]60 #AsyncRAT hxxps://104.243.37[.]176:5555 #Supershell hxxp://34.81.83[.]87:8080

#IronRadar has detected two suspected #Rhadamanthys C2 servers hxxps://216.250.255[.]120:12443 hxxps://194.156.99[.]146:19000