TF-1916962
high
📛 Threat Title
Unknown RAT: Domain that is used for botnet Command&control (C&C) relay.miranarts-top.cc
Description
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Unknown RAT. Confidence: 100. First seen: 2026-09-13 19:50:29 UTC. Reporter: abuse_ch. Tags: ConnectWise, rmm, ScreenConnect.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
relay.miranarts-top.cc
UrlVoid 3 / 36
IOC database
- Type
- domain
- Value
relay.miranarts-top.cc- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Ingested from IOC source: https://threatfox.abuse.ch/downloads/hostfile/
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (3)
- External reference ThreatFox IOCs
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Unknown RAT. Confidence: 100. First seen: 2026-09-13 19:50:29 UTC. Reporter: abuse_ch. Tags: ConnectWise, rmm, ScreenConnect.
Remediations (10)
-
web:content.spamhaus.org
The number of botnet command and control (C&C) servers continued to rise between July and December 2025, increasing by +24%. During this period, Remote Access Trojans ( RATs ) grew in popularity to 42% of malware associated with observed botnet C&Cs , overtaking penetration testing frameworks as the most prevalent malware type.
-
web:help.bitsighttech.com
The Botnet Infections risk vector is an indication of a host participating in a botnet , including active bots and Command and Control servers ( C&C servers). Navigation Options SPM App: Finding...
-
web:networkthreatdetection.com
Learn how recognizing botnet command and control patterns reveals hidden threats and keeps your network safe from malicious attacks.
-
web:www.crowdstrike.com
What are command and control attacks? C&C (also known as C2) is a method that cybercriminals use to communicate with compromised devices within a target company's network. In a C&C attack, an attacker uses a server to send commands to — and receive data from — computers compromised by malware. This server is also known as a C2 or C&C server. The attacker can use the server to perform ...
-
web:www.edxsecurityhub.org
What is a Botnet ? A botnet (robot network) is a network of compromised computers, servers, IoT devices, and other internet-connected devices (bots or zombies) controlled remotely by an attacker (botmaster or bot herder). Each bot is infected with malware that allows the botmaster to issue commands via Command & Control (C2 or C&C ) servers. Botnets are used to perform large-scale cyberattacks ...
-
web:www.malwarebytes.com
Botnets are networks of computers infected by a botnet agent that are under hidden control of a third party. They are used to execute various commands ordered by the attacker. Most common uses of botnets are criminal operations that require distributed resources, such as DDoS attacks on selected targets, spam campaigns, and performing click fraud.
-
web:www.radware.com
Organizations deploy botnet defense tools to identify infected devices, disrupt command-and-control (C&C) communications, and block malicious traffic originating from these networks.
-
web:www.spamhaus.com
Explore the Spamhaus Live Botnet Threat Map. Track global botnet activity in real time and see where malware and infected devices are operating worldwide.
-
web:www.spamhaus.org
The Spamhaus Botnet Controller List (BCL) is a specialized, advisory "drop all traffic" list. It consists of IP addresses that are actively used by cybercriminals to control malware-infected computers (bots). This is a high-confidence list, with false positives being extremely rare, to block as much high-risk, malicious traffic as possible.
-
web:www.spamhaus.org
With every Botnet Threat Update we publish, the same networks consistently appear in the Top 20 for hosting botnet command and control (C&C) servers. But why does this keep happening? In this Botnet Spotlight, we look into the root causes behind this persistent issue and what networks must do to break the cycle.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.