Brazilian banker 🇧🇷

GHOST panel 🧐

007consultoriafinanceira .net ➡️ GoDaddy 🇺🇸
83.229.17.124:80 ➡️ Clouvider 🇺🇸

Payload delivery URL 🌐:
https://urlhaus.abuse.ch/url/3759148/

Malware sample (MSI) ⚙️:
https://bazaar.abuse.ch/sample/2cbafc607c5d38a891ab89799f98b6b754b519706eb6597e4c4f2d4f6fc5db21/

🤖 Jul-Dec 2025 Botnet Threat Update out now!

⬆️ 21,425 #botnet C&Cs observed, up by +24%.
⏫ Botnet C&C domains soar +9,608% for 🇷🇺 Russia-based REGRU
⬆️ Remote Access Trojans represent 42% of Top 20 malware associated with botnet C&Cs.

But it isn’t all bad news – several large cloud network operators have taken action to tackle active botnet C&Cs - find out which ones in the latest FREE report here👇
https://www.spamhaus.org/resource-hub/botnet-c-c/botnet-threat-update-july-to-december-2025/

#Botnet #ThreatIntel

Malspam sent from Microsoft Outlook that is spreading #LogMeIn GoToResolve RMM, enabling threat actors to access the victim's machine from remote 💻🔍🕵️

IOCs:
📡 adwestmailcenter .com ➡️ Landing page
📡 insightme .im ➡️ fake PDF download

Payload hosted on Cloudflare R2 bucket, but already got nuked due to an abuse report from URLhaus 🙌
https://urlhaus.abuse.ch/url/3751500/

LogMeIn #GoToResolve payload 📄
https://bazaar.abuse.ch/sample/77e22f4e1af7758d6f7284f32a92539ea36a527fa89c8c6765f10a3f98a8d13e/

CHICXULUB IMPACT 💥

Botnet C2 URLs:
📡 https://turbokent .name/api/initialize
📡 https://turbokent .name/api/status

Sponsoring domain registrar: NICENIC 🇭🇰

Malware sample 📄:
https://bazaar.abuse.ch/sample/c32e1db396e6b64846792f05c776c5b52f34834b0500bc18f982927e07ca3eeb/

New Stealer in town: SantaStealer 🎅🎄

Botnet C2s ➡️all hosted at AS399486 VIRTUO 🇨🇦:

📡31.57.38.119:6767
📡31.57.38.244:6767
📡80.76.49.114:6767

Stealer admin panel (via @DarkWebInformer 💪):
🕵️ stealer. su

Artifacts 💻:
C:\tempLog\Clipboard.txt
%LocalAppData%\Temp\passwordslog.txt

Malware samples 🤖:
https://bazaar.abuse.ch/browse/tag/SantaStealer/

IOCs available on ThreatFox 🦊:
https://threatfox.abuse.ch/browse/tag/SantaStealer/

Love letter ❤️ from a threat actor 🕵️exploiting React2Shell vulnerability (CVE-2025-55182) to spread #Mirai malware ⤵️

fuckoffurlhaus 😂

Payload URLs 🌐:
https://urlhaus.abuse.ch/host/45.153.34.201/

Mirai botnet C2s 📡:
marvisxoxo .st (ISTanCo 🇷🇸)
45.156.87 .231:23789 (AS51396 PFCLOUD 🇩🇪)

Malware sample 📄:
https://bazaar.abuse.ch/sample/9a84057ceb444e73f6f8733eda2fbd0db46fd9a6e182179256289558871427d6/

Unknown malware using WebSockets for botnet command&control, spreading through #ClickFix ⤵️

🖱️ClickFix -> 📃VBS -> ⚙️MSI

Payload delivery host:
🌐 https://urlhaus.abuse.ch/host/103.27.157.60/

Malware sample 🤖:
https://bazaar.abuse.ch/sample/4d8e5e890e8be3a1d3529edd384517f99ec1b05bbed7edb38da936d7b3d7749b/

Botnet C2 domains:
📡 w2li .xyz
📡 w2socks .xyz

The same malware is also being spread by #Amadey pay-per-install (PPI):
➡️ https://urlhaus.abuse.ch/url/3733103/

Exploitation of recent React RCE vul (CVE-2025-55182 - #React2Shell) leading to #Mirai infection ⤵️

Botnet Mirai C2 domains 📡:
effeminate.fuckphillipthegerman .ru
trap.fuckphillipthegerman .ru
tranny.fuckphillipthegerman .ru

Botnet Mirai C2 servers , all hosted at FORTIS 🇷🇺:
138.124.72.251:52896
138.124.69.154:60328
5.144.176.19:60328

Mirai #malware sample 🤖:
https://bazaar.abuse.ch/sample/ee2fe11a7f43aba14f37897b7c69e2c4b26eef20a8854a838353b59866ee4861/

Payload delivery host 🌐:
https://urlhaus.abuse.ch/host/172.237.55.180/

Releated IOCs 🦊:
https://threatfox.abuse.ch/browse/tag/CVE-2025-55182/

MaksRAT

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\javacom

Botnet C2s 📡
104.198.24 .41:6656
avocado .gay
www.foldacces .online
www.makslove .xyz
www.mavenrat .xyz
www.blackprofit .online

Malware sample 🤖
https://bazaar.abuse.ch/sample/883108e1491ab90780fa3b43ed1580e29786287fdca5cae1a49eea6ec91d90fd/

IOCs are available on ThreatFox 🦊
https://threatfox.abuse.ch/browse/tag/MaksRAT/

Mirai campaign spreading through 213.209.143.85 (Railnet 🇳🇱), messing around with the victim's system iptables 🤔

Mirai botnet C2 domain:
womp.datasurge .vip (NameCheap 🇺🇸)

Mirai botnet C2 server:
176.65.148.57:6969 (Pfcloud 🇩🇪)

Payload URL:
🌐 https://urlhaus.abuse.ch/url/3725743/

Mirai malware sample:
🤖 https://bazaar.abuse.ch/sample/112481469fb1a0e94a8f0a34ff70b76e874540f3913db2a1d6b9b6c3899367e0/

More #Mirai IOCs are available on ThreatFox:
🦊 https://threatfox.abuse.ch/browse/malware/elf.mirai/

Mirai botnet #zerobot spreading through 172.86.123.179 (cloudzy 🇦🇪) ⤵️

Mirai botnet C2 domain:
0bot.qzz .io (Gandi SAS 🇫🇷)

Mirai botnet C2 server:
140.233.190.96:69 (Internet Magnate 🇿🇦)

Payload URLs:
🌐 https://urlhaus.abuse.ch/host/172.86.123.179/

Mirai malware sample:
🤖 https://bazaar.abuse.ch/sample/9f64ea43d9ba0bed705b94251dfbcdc596fc594df8c0d94c512e4573c55b30e5/

More #Mirai IOCs are available on ThreatFox:
🦊 https://threatfox.abuse.ch/browse/malware/elf.mirai/

🎉 Massive shout out to URLhaus Top Contributor “geenensp”

First seen April 13th 2020 and since then, they’ve shared an unbelievable 844,345 malware URLs!! 😮 Over the last 30 days, they have shared 8,902 URLs, firmly securing their position at the top of the leaderboard 💪

URLhaus simply wouldn't exist without the help of awesome contributors like this who report malware URLs everyday 🙏

URLhaus ➡️ https://urlhaus.abuse.ch/
Stats ➡️ https://urlhaus.abuse.ch/statistics/

🔍 has OCR capabilities for screenshots obtained via CDP, which are used to extract text from captcha
🤖 uses a Grok LLM model that resides in the botnet C2 server to solve the captcha

Botnet C2 servers are all hosted at Hetzner 🇩🇪 on port 8008 TCP:
46[.]62.225.51 [active]
46[.]62.224.205
46[.]62.205.38

GrokPy malware samples on MalwareBazaar:
📄 https://bazaar.abuse.ch/browse/signature/GrokPy/

Botnet C2s on ThreatFox:
🦊 https://threatfox.abuse.ch/browse/tag/GrokPy/

⚙️ uses the CDP (Chrome developer protocol) of either Edge or Chrome installed on the victim machine for further malicious actions
📡 calls back to the botnet C2 on the various stages of the infection and the results of its malicious actions
👱 creates new accounts on Discord to obtain authentication tokens, which are then reported back to the botnet C2
📧 uses dilly + [a-zA-Z0-9]{8,11}@Gmail
.com + password [a-zA-Z0-9]{8} as the email and password for the Discord registration process

We’ve identified an interesting malware family 🔍, which we’ve named #GrokPy due to its use of a Grok LLM model 🤖 to solve and subsequently bypass CAPTCHAs 🔥

The malware gets dropped by #Amadey and:

🪝 collects information about the infected device, such as screen resolution, public IP & location, ram usage and CPU name
💻 attempts to escalate privileges by running as admin or as a scheduled task

@7666 I recommend you to just remove the PS and serve 404. URLhaus cant distinguish between malicious PS and legitinate PS and as that URL was serving a PS initially, the URL will be flagged as online as long as it servs a PS

@7666 URLhaus re-scans every URL several times per hour. No need for a manual rescan

This week, everywhere you look, bulletproof hosting (BPH) is in cyber news headlines. From the CrazyRDP takedown, to sanctions against entities adjacent to Aeza, and most recently Media Land LLC and ML[.]Cloud] LLC (do these measures actually move the needle?), to new CISA guidance on mitigating BPH activities.🛡️

It’s clear the spotlight is firmly on one of cybercrime’s most persistent enablers. And for a good reason. Few infrastructures have enabled so much criminal activity, for so long, with such resilience.

Spamhaus has tracked BPH operators and their evolving tactics for decades. 🕵️ We've watched the ecosystem shift from monolithic BPHs to layered and complex business structures.

So, amid the sensational headlines, we’ve compiled a grounded look at the topic, covering: the history, the current landscape, and where the threat landscape is likely to head next.

Read it in full here 👉 https://www.spamhaus.org/resource-hub/bulletproof-hosting/the-anatomy-of-bulletproof-hosting-past-present-future-/

#Bulletproofhosting #Cybercrime

@spamhaus Taking down the infrastructure is only half the battle, supporting those affected is just as important. Thank you, for stepping in again to help remediate machines infected with the Rhadamanthys malware 👏👏 #Community #Endgame3 #Remediation

ENDGAME 3.0 REMEDIATION | Following on from the 📢 announcement last week Spamhaus is now sending notification emails 📩 to ISPs associated with infected machines.

Here's what to do if you receive one: ⤵️