Dee

Over the 10k #malware C2 panels on tracker.viriback.com

Seth Loader panel: https://panel.b2brouter-secure[.]com/ "Secure Command & Control Panel" 🤷‍♂️ @1ZRR4H

Shared strictly for defensive threat intelligence and research purposes. Identified a C2 panel hosted on msomali[.]club and 89.34.90[.]33:4444 Analysis of the login page and /bots dashboard frontend indicates an Android-focused bot management platform. By directly accessing the /bots endpoint, the dashboard resources were briefly loaded before the application redirected to the login page. Capturing the frontend with HTTP Toolkit revealed the following Android-specific capabilities: Observed capabilities: - Android-specific command handlers and com. android.* package processing - Remote VNC and stealth camera streaming - Accessibility service abuse for device control and permission handling - SMS interception and USSD operations - Overlay injection capabilities - Keylogging support - Dynamic DEX module loading - Remote Android device management I did not observe Windows-specific management functionality in the exposed frontend. IOCs: Domain: msomali[.]club IP: 89.34.90[.]33:4444 Login: https://msomali[.]club/ Dashboard: https://msomali[.]club/bots Auth API: POST /api/auth/login Verify API: GET /api/auth/verify #C2Panel #C2 #Android #malware @malwrhunterteam @skocherhan @JAMESWT_WT @Fact_Finder03 @James_inthe_box

We added KHAOS to the #C2Matrix today KHAØS is a modern post-exploitation C2 framework with 5 covert channels and full evasion built in, created by @28Zaaky. github.com/28Zaaky/khaos-…

66.175.238[.130[:5000 @500mk500 @RacWatchin8872 @skocherhan @AndreGironda @JAMESWT_WT @ViriBack @malwrhunterteam @BlinkzSec #DDoS #C2 #ControlPanel #ThreatIntel #CTI #BlueTeam #Panel Strictly for defensive purpose

194.102.104[.220[:5000 🤔 @500mk500 @ViriBack @BlinkzSec #TGstealer #Stealer #C2 #ControlPanel #ThreatIntel #CTI #BlueTeam #Panel Strictly for defensive purpose

16.192.76[.221 mangelepaff[.duckdns.]org @500mk500 @skocherhan @AndreGironda @JAMESWT_WT @ViriBack @malwrhunterteam @BlinkzSec #DarkRAT #RAT #C2 #ControlPanel #ThreatIntel #CTI #BlueTeam #Panel Strictly for defensive purpose

still online LulzStresser 198.211.96/.176:3000 AS14061 DigitalOcean, LLC cc: @500mk500 #ddos #stresser

62.238[.40.21[:8888 @500mk500 @RacWatchin8872 @skocherhan @AndreGironda @JAMESWT_WT @ViriBack @malwrhunterteam @BlinkzSec #RAT #C2 #ControlPanel #ThreatIntel #CTI #BlueTeam #Panel Strictly for defensive purpose

111.228.31.109[:9191 @500mk500 @RacWatchin8872 @skocherhan @AndreGironda @JAMESWT_WT @ViriBack @malwrhunterteam @BlinkzSec #Stealer #WebUI #C2 #ControlPanel #ThreatIntel #CTI #BlueTeam Strictly for defensive purpose

Some panel with title "Remote Support Console": https://cdn.defenders.workers[.]dev/ https://nextjs2385.ngrok[.]io/ "Operations desktop for live endpoint control. Authenticate against the backend control plane and drop straight into the fleet dashboard, audit trail, and tenant management surfaces." 🤷‍♂️

64.95.13[.39 pacermonitorbilling[.com @500mk500 @RacWatchin8872 @skocherhan @AndreGironda @JAMESWT_WT @ViriBack @malwrhunterteam @BlinkzSec #HVNC #C2 #ControlPanel #ThreatIntel #CTI #BlueTeam Strictly for defensive purpose

185.212.128[.6 @500mk500 @RacWatchin8872 @skocherhan @AndreGironda @JAMESWT_WT @ViriBack @malwrhunterteam @BlinkzSec #Botnet #Panel #ThreatIntel #CTI #BlueTeam Strictly for defensive purpose

2.59.133[.148[:4312 @500mk500 @RacWatchin8872 @skocherhan @AndreGironda @JAMESWT_WT @ViriBack @malwrhunterteam #Nexus #C2 #ControlPanel #ThreatIntel #CTI #BlueTeam Strictly for defensive purpose

77.91.123[.181[:5000 @500mk500 @RacWatchin8872 @skocherhan @AndreGironda @JAMESWT_WT @VBackburn64355 @malwrhuntertean @BlinkzSec #Genesis #Loader #C2 #ControlPanel #ThreatIntel #CTI #BlueTeam Strictly for defensive purpose

#malware Some C2 Panel and opendir on same ip: s://panel.edge-msdn[.]com/login 66.42.114[.]65:8080

"C2 Login" 103[.]122[.]247[.]36:80 AS152918 Liberally Network LLC 🇭🇰 #c2 @Fact_Finder03 @500mk500

"Sniffer Panel" https://188.137.231.56/login

Some panel with title "Bot Manager": http://188.137.230.216:8000/login 🤷‍♂️

174.138[.18.212:[8080 Stressify C2 - Login @500mk500 @RacWatchin8872 @skocherhan @AndreGironda @JAMESWT_WT @ViriBack @malwrhunterteam #Stressify #C2 #ControlPanel #ThreatIntel #CTI #BlueTeam Strictly for defensive purpose

20.87.213[.75:]8080 751 Stealer @500mk500 @RacWatchin8872 @skocherhan @AndreGironda @JAMESWT_WT @ViriBack @malwrhunterteam #Stealer #C2 #ControlPanel #ThreatIntel #CTI #BlueTeam Strictly for defensive purpose