Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Exposing Russian Malicious Infrastructure: 1,250+ C2 Servers Mapped Across 165 Providers

hunt.io | blog | #threat-intelligence | #malware | #threat-hunting | #russia | #command-and-control | #hosting-providers | #host-radar

Summary

Host Radar mapped 1,250+ active C2 servers across 165 Russian providers over three months, with TimeWeb, REG.RU and VDSina hosting the most, and Keitaro, Cobalt Strike and Sliver among top families.
Published
Collected

original ↗

Related coverage

blog · hunt.io
Redis Cryptomining Botnet Compromised 3,562 Servers, Exposed by the Operator's Own Files
Hunt.io parsed a Redis cryptomining botnet's own exposed logs: 3,562 servers compromised, rogue replication as the only technique that scaled, and 72.6% success against a no-auth target list.
blog · hunt.io
Inside Eastern Europe's C2 Sprawl: 3,900+ Servers and 302 Providers Mapped (Updated)
Host Radar mapped 3,900+ active C2 servers across 302 Eastern European hosting providers over three months, surfacing provider-level threat signals—updated after provider feedback.
blog · hunt.io
Middle East Malicious Infrastructure Report: 1,350+ C2 Servers Mapped Across 98 Providers
Host Radar mapped 1,350+ active C2 servers across 98 Middle East providers in a three-month window, breaking down hosting providers, telecom networks and campaigns by country.
blog · hunt.io
Inside China’s Hosting Ecosystem: 18,000+ Malware C2 Servers Mapped Across Major ISPs
Host Radar found 18,000+ active malware C2 servers across 48 Chinese providers, China Unicom, Alibaba Cloud and Tencent dominating; Mozi, Mirai and Cobalt Strike drive most framework-based abuse.
blog · crowdstrike.com
PhantomRaven: An LLM-Generated Information Stealer Developed for Bug Bounty Hunting
CrowdStrike identified a financially motivated threat actor who works as a bug bounty hunter and who developed and distributed the JavaScript-based information stealer PhantomRaven.
blog · blog.viettelcybersecurity.com
Hàng ngàn website lợi dụng covid-19 để lừa đảo và phát tán mã độc
Check Point reports a surge of COVID-19 themed domains and dark web sales, with malware campaigns (AZORult, Emotet, TrickBot) and APT36, BabyShark operations exploiting the pandemic.
back