TF-1932677 high

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: ip:port combination that is used for botnet Command&control (C&C). Attributed malware: Remcos (aliases: RemcosRAT,Remvio,Socmer). Confidence: 100. Observed port: 65070. First seen: 2026-09-25 06:27:28 UTC. Last seen: 2026-09-25 10:19:34 UTC. Reporter: Bitsight. Tags: c2, Crypters&tools, remcos.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile ThreatFox IOCs
• ThreatFox IOC page ThreatFox IOCs

  Indicator that identifies a botnet command&control server (C&C). IOC type: ip:port combination that is used for botnet Command&control (C&C). Attributed malware: Remcos (aliases: RemcosRAT,Remvio,Socmer). Confidence: 100. Observed port: 65070. First seen: 2026-09-25 06:27:28 UTC. Reporter: Bitsight. Tags: c2, Crypters&tools, remcos.

• Home - Splunk Lantern
  web:lantern.splunk.com

  We would like to show you a description here but the site won't allow us.

  2026-09-25 10:06 UTC
• WSTG - Latest - OWASP Foundation
  web:owasp.org

  The Access-Control-Request-Method header is used when a browser performs a preflight OPTIONS request and lets the client indicate the request method of the final request. On the other hand, the Access-Control-Allow-Method is a response header used by the server to describe the methods the clients are allowed to use.

  2026-09-25 10:06 UTC
• Proofpoint
  web:rules.emergingthreats.net

  We would like to show you a description here but the site won't allow us.

  2026-09-25 10:06 UTC
• Defending Against China-Nexus Covert Networks of Compromised Devices - CISA
  web:www.cisa.gov

  The number of covert networks used by China-nexus cyber actors is large, with new networks regularly developed and deployed. The existing covert networks change too, either because of defensive or legal action, or simply as a result of software updates and new exploits being used to target different technologies for incorporation into the network.

  2026-09-25 10:06 UTC
• Elastic
  web:www.elastic.co

  Elastic

  2026-09-25 10:06 UTC
• Reddit
  web:www.reddit.com

  We would like to show you a description here but the site won't allow us.

  2026-09-25 10:06 UTC
• Backdoor.Win32.REMCOS.UGR - 脅威データベース | Trend Micro (JP)
  web:www.trendmicro.com

  手順 7 コンピュータを通常モードで再起動し、最新のバージョン（エンジン、パターンファイル）を導入したウイルス対策製品を用い、「Backdoor.Win32. REMCOS .UGR」と検出したファイルの検索を実行してください。

  2026-09-25 10:06 UTC

Only Available for Registered Users. Sign in to view.