Tessera
Folgen

@abuse-ch.bsky.social

Fighting malware and botnets

207 Posts484 Follower3 Folgt
@abuse-ch.bsky.social · 6d ago

📢 SERVICE UPDATE | As you may have noticed, we've experienced some downtime recently which was largely caused by a small number of users exceeding our Fair Use Policy. To protect platform stability and ensure fair access for everyone as our user base grows, we are introducing API rate limits. 1/2

Bild
@abuse-ch.bsky.social · last wk.

It's here!! The @abuse_ch #CommunityHub is LIVE 🔥🔥🔥 Every day, this community shares data that helps take down malicious infrastructure and now you can see the scale of it, all in one place. The Hub gives you a live view of:

Bild
@abuse-ch.bsky.social · 2w ago

Interesting unlabeled malware sample shared by our friend smica83, apparently targeting UA users 🇺🇦🕵️ The malware sample: 1️⃣ Obtains the DNS A record of ns2.theendlessweb .com 2️⃣ Queries directly the DNS A record (207.90.251 .10) for the DNS TXT record of sni13.docsmanagement.endl .site

Once the malware sample is executed, it displays the following text on the victim's machineMalware obtaining a PowerShell command via DNS TXT record
@abuse-ch.bsky.social · last mo.

Our platforms were recently targeted by a large-scale web scraping operation originating from devices that are apparently participating in residential proxy networks 🏘️ 🖥️ . The vast majority of these requests were successfully blocked by our existing mitigations 🛑 .

Top countries sourcing residential proxy scraping IPs targeting abuse.ch platforms
@abuse-ch.bsky.social · 5mo ago

Proofpoint recently identified a fake RMM (Remote Monitoring and Management Tool) called #TrustConnect and #DocConnect🔎💻 Pivoting the threat in our collection reveals that the threat actors spread the same malware under additional names, including: ➡️SoftConnect ➡️HardConnect ➡️AxisControl

@abuse-ch.bsky.social · 6mo ago

Yet another RAT in town: RemoteX🖥️🖱️ 🪲 Dropped by Amadey 📃 Written in Golang 💻 Uses HKCU\...\CurrentVersion\Run\RemoteX for persitence (lame 🚽) 🌐 Uses WebSocket for C2 communication 🕵️‍♂️ Unauthenticated RAT admin panel 🤡 Botnet C2: 📡 109.107.168.147:80 (Partner Hosting LTD 🇬🇧)

RemoteX RAT admin panel
@abuse-ch.bsky.social · 7mo ago

Brazillian banker 🇧🇷 caught by @johnk3r 🎣 GHOST panel 🧐 007consultoriafinanceira .net 83.229.17.124:80 Clouvider 🇺🇸 Payload delivery URL: 🌐https://urlhaus.abuse.ch/url/3759148/ Malware sample (MSI): ⚙️https://bazaar.abuse.ch/sample/2cbafc607c5d38a891ab89799f98b6b754b519706eb6597e4c4f2d4f6fc5db21/

Brazilian Banker "GHOST" panel
@abuse-ch.bsky.social · 7mo ago

Malspam sent from Microsoft Outlook that is spreading #LogMeIn GoToResolve RMM, enabling threat actors to access the victim's machine from remote 💻🔍🕵️ IOCs: 📡 adwestmailcenter .com ➡️ Landing page 📡 insightme .im ➡️ fake PDF download

Malspam from Microsoft Outlook spreading LogMeIn GoToResolve RMMFake PDF download spreading LogMeIn GoToResolve RMM
@abuse-ch.bsky.social · 8mo ago

New Stealer in town: SantaStealer 🎅🎄 Botnet C2s ➡️all hosted at AS399486 VIRTUO 🇨🇦: 📡31.57.38.119:6767 📡31.57.38.244:6767 📡80.76.49.114:6767 Stealer admin panel (via @darkwebinformer.com 💪): 🕵️ stealer. su Artifacts 💻: C:\tempLog\Clipboard.txt %LocalAppData%\Temp\passwordslog.txt

Rapid7@rapid7.com · 8mo ago

'Tis the season for a new infostealer: #SantaStealer. Active promotion on Telegram and underground forums state the malware-as-a-service plans to be released before year-end. Rapid7 Labs analyzed unstripped samples to detail how it operates and what defenders should know: https://r-7.co/4q5pk75

@abuse-ch.bsky.social · 8mo ago

Exploitation of recent React RCE vul (CVE-2025-55182 - #React2Shell) leading to #Mirai infection ⤵️ Botnet Mirai C2 domains 📡: fuckphillipthegerman .ru Botnet Mirai C2 servers , all hosted at FORTIS 🇷🇺: 138.124.72.251:52896 138.124.69.154:60328 5.144.176.19:60328

Malicious bast script deliverying Mirai payload
@abuse-ch.bsky.social · 8mo ago

Mirai campaign spreading through 213.209.143.85 (Railnet 🇳🇱), messing around with the victim's system iptables 🤔 Mirai botnet C2 domain: womp.datasurge .vip (NameCheap 🇺🇸) Mirai botnet C2 server: 176.65.148.57:6969 (Pfcloud 🇩🇪) Payload URL: 🌐 urlhaus.abuse.ch/url/3725743/

Bild
@abuse-ch.bsky.social · 8mo ago

🎉 Massive shout out to URLhaus Top Contributor “geenensp” First seen April 13th 2020 and since then, they’ve shared an unbelievable 844,345 malware URLs!! 😮 Over the last 30 days, they have shared 8,902 URLs, firmly securing their position at the top of the leaderboard 💪 ⤵️

URLhaus Top Contributor “Geenensp”
@abuse-ch.bsky.social · 8mo ago

We’ve identified an interesting malware family 🔍, which we’ve named #GrokPy due to its use of a Grok LLM model 🤖 to solve and subsequently bypass CAPTCHAs 🔥 The malware gets dropped by #Amadey and: