TF-1932695 high

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: URL that is used for botnet Command&control (C&C). Attributed malware: Remus. Confidence: 75. First seen: 2026-09-25 06:37:24 UTC. Reporter: Myrtus0x0. Tags: Remus.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile ThreatFox IOCs
• ThreatFox IOC page ThreatFox IOCs

  Indicator that identifies a botnet command&control server (C&C). IOC type: URL that is used for botnet Command&control (C&C). Attributed malware: Remus. Confidence: 75. First seen: 2026-09-25 06:37:24 UTC. Reporter: Myrtus0x0. Tags: Remus.

• Remus Hides Its Command Server on Ethereum While Emptying Browser Vaults
  web:cybersecuritynews.com

  Remus Hides Its Command Server on Ethereum At the heart of this campaign is the decision to hide Remus's command server information inside an Ethereum smart contract rather than hard‑coding it in the malware.

  2026-09-25 08:48 UTC
• Remus Infostealer Removes Syscall Hooks to Evade EDR and Steal ...
  web:cybersecuritynews.com

  Remus Windows stealer uses ClickFix attacks to steal passwords, wallet data, files, browser information, and AI tool credentials.

  2026-09-25 08:48 UTC
• Remus Stealer: A New, Not-So-New Infostealer | Flashpoint
  web:flashpoint.io

  Remus stealer represents a sophisticated continuation of the MaaS infostealer model left behind by Lumma's collapse. While the developer asserts independence, the overwhelming code overlaps, matching obfuscation techniques, and administrative panels indicate that Remus is either heavily inspired by, or derived from the Lumma codebase.

  2026-09-25 08:48 UTC
• Remus Infostealer Uses Ethereum for Dynamic Command and Control
  web:portal.vyprsec.ai

  A new information-stealing malware, Remus , is employing an Ethereum smart contract to dynamically retrieve its command and control server address, making it harder to block.

  2026-09-25 08:48 UTC
• Remus Stealer: A New, Not-So-New Infostealer - Security Boulevard
  web:securityboulevard.com

  In this post, we explore the emergence of Remus Stealer, analyzing its structural and behavioral similarities to the infamous Lumma malware. The post Remus Stealer: A New, Not-So-New Infostealer appeared first on Flashpoint.

  2026-09-25 08:48 UTC
• ThreatFox | http://urbandm.click:4812/documents
  web:threatfox.abuse.ch

  You are viewing the ThreatFox database entry for url http ://urbandm.click:4812/documents.

  2026-09-25 08:48 UTC
• Botnet Controller List (BCL) | Botnet C&C datasets | Spamhaus
  web:www.spamhaus.org

  The Spamhaus Botnet Controller List (BCL) is a specialized, advisory "drop all traffic" list. It consists of IP addresses that are actively used by cybercriminals to control malware-infected computers (bots). This is a high-confidence list, with false positives being extremely rare, to block as much high-risk, malicious traffic as possible.

  2026-09-25 08:48 UTC
• Remus Malware Is Hiding Its Control Server Inside Ethereum
  web:www.thespacelab.tv

  How Remus Malware Uses Ethereum for Command and Control Instead of keeping one control-server address inside the malware, Remus asks a hardcoded Ethereum smart contract where to connect. The contract returns encoded server information, which the malware decodes before sending stolen data over ordinary web traffic.

  2026-09-25 08:48 UTC

Only Available for Registered Users. Sign in to view.