TF-1812295 medium

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: PicassoLoader. Confidence: 50. First seen: 2026-05-14 20:10:44 UTC. Reporter: anonymous.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (3)

• External reference Threatfox IOCs/Threats
• Malpedia profile Threatfox IOCs/Threats
• ThreatFox IOC page Threatfox IOCs/Threats

  Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: PicassoLoader. Confidence: 50. First seen: 2026-05-14 20:10:44 UTC. Reporter: anonymous.

• PDF Cyber Threat Intelligence Advisory - assets.kpmg.com
  web:assets.kpmg.com

  The PicassoLoader malware employs sophisticated techniques, initiating its intrusion through phishing emails with misleading attachments posing as familiar file types like Excel or PowerPoint documents. Once opened, these attachments trigger hidden code, setting off a complex chain of actions. This includes the deployment of a ".LNK" file via an embedded VBA macro or by leveraging regsvr32.exe ...

  2026-05-22 00:45 UTC
• PicassoLoader - PolySwarm
  web:blog.polyswarm.io

  PicassoLoader , a downloader, was observed targeting government, military, and civilian entities in Ukraine and Poland. CERT-UA attributed this activity to GhostWriter. Key Takeaways PicassoLoader is a downloader used to target government, military, and civilian entities in Ukraine and Poland. The attacks occurred between April 2022 and July 2023.

  2026-05-22 00:45 UTC
• C2 Tracker - Community-Driven Malware and C2 Monitoring Tool
  web:ethicalhacksacademy.com

  C2 Tracker is a free, community-driven Indicator of Compromise (IOC) feed designed to track IP addresses associated with known malware, botnets , and Command-and-Control (C2) infrastructure.

  2026-05-22 00:45 UTC
• Feodo Tracker | Blocklist - abuse.ch
  web:feodotracker.abuse.ch

  Dridex, Heodo (aka Emotet), TrickBot, QakBot (aka QuakBot / Qbot) and BazarLoader (aka BazarBackdoor) botnet command&control servers (C2s) usually reside on compromised servers and such that have been rented and setup by the threat actor itself for the sole purpose of botnet hosting. Feodo Tracker offers a blocklist of IP addresses that are associated with such botnet C2s. It can be used to ...

  2026-05-22 00:45 UTC
• Recognizing Botnet Command and Control Made Simple
  web:networkthreatdetection.com

  Learn how recognizing botnet command and control patterns reveals hidden threats and keeps your network safe from malicious attacks.

  2026-05-22 00:45 UTC
• PicassoLoader, 1 Phishing campaign - Top Antimalware
  web:nicolascoolman.eu

  PicassoLoader is a malware downloader used to distribute other malware to infected systems. It is capable of bypassing security mechanisms and deploying varied payloads, thereby facilitating the installation of spyware, ransomware or other malicious tools.

  2026-05-22 00:45 UTC
• PicassoLoader (Dropper) - Malware - CyberMaterial
  web:www.cybermaterial.com

  Execution and Communication Upon successful execution, PICASSOLOADER establishes communication with its command-and-control (C2) server. This server acts as the central hub for managing the malware's activities, enabling attackers to issue commands, deliver additional payloads, and receive stolen data from the compromised system.

  2026-05-22 00:45 UTC
• FrostyNeighbor: Fresh mischief and digital shenanigans
  web:www.cyberswissguards.com

  FrostyNeighbor is a long-running cyberespionage actor apparently aligned with the interests of Belarus. The group primarily targets governmental, military, and key sectors in Eastern Europe. This report documents new activity observed that started in March 2026, showing continued evolution of tooling and compromise chains. FrostyNeighbor uses server-side validation of its victims before ...

  2026-05-22 00:45 UTC
• The Extended Botnet Controller List is now available via the Spamhaus ...
  web:www.spamhaus.com

  What is the extended Botnet Controller List (eBCL)? This dataset contains single IPv4 addresses used by miscreants to control infected devices, otherwise known as Botnet Command and Controllers, C&Cs , or C2s. At its heart, the eBCL is a "drop all traffic" list detailing the worst of the worse.

  2026-05-22 00:45 UTC
• Botnet Controller List (BCL) | Botnet C&C datasets | Spamhaus
  web:www.spamhaus.org

  The Spamhaus Botnet Controller List (BCL) is a specialized, advisory "drop all traffic" list. It consists of IP addresses that are actively used by cybercriminals to control malware-infected computers (bots). This is a high-confidence list, with false positives being extremely rare, to block as much high-risk, malicious traffic as possible.

  2026-05-22 00:45 UTC

Only Available for Registered Users. Sign in to view.

Reputation of linked indicators

DomScan scores the domains, AbuseIPDB + GreyNoise score the IPs. Verdicts are per-indicator — this is a roll-up, so no lookup is triggered by opening this page.