---
id: 6283
title: "WarmCookie Infrastructure Update: Uncovering New C2 Servers and Threats"
source_domain: hunt.io
source_url: "https://hunt.io/blog/from-warm-to-burned-shedding-light-on-updated-warmcookie-infrastructure"
published_at: "2024-10-17T00:00:00Z"
tags: ["threat-hunting", "backdoor", "ssh-keys", "c2-infrastructure", "warmcookie", "fakeupdate"]
phying_url: "https://phying.com/item/6283"
lang: en
---

# WarmCookie Infrastructure Update: Uncovering New C2 Servers and Threats

## Summary

Hunt.io expands on a WarmCookie C2 server flagged by Gen Threat Labs, using certificate history, HTTP response patterns and shared SSH keys to surface additional hosts tied to the updated backdoor.

## Intelligence Metadata

- **Sources:** hunt.io
- **Published:** 2024-10-17T00:00:00Z
- **Original:** https://hunt.io/blog/from-warm-to-burned-shedding-light-on-updated-warmcookie-infrastructure
- **Phying News:** https://phying.com/item/6283