TF-1812294 medium

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: PicassoLoader. Confidence: 50. First seen: 2026-05-14 20:10:44 UTC. Reporter: anonymous.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (3)

• External reference Threatfox IOCs/Threats
• Malpedia profile Threatfox IOCs/Threats
• ThreatFox IOC page Threatfox IOCs/Threats

  Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: PicassoLoader. Confidence: 50. First seen: 2026-05-14 20:10:44 UTC. Reporter: anonymous.

• PDF Cyber Threat Intelligence Advisory - assets.kpmg.com
  web:assets.kpmg.com

  The PicassoLoader malware employs sophisticated techniques, initiating its intrusion through phishing emails with misleading attachments posing as familiar file types like Excel or PowerPoint documents. Once opened, these attachments trigger hidden code, setting off a complex chain of actions. This includes the deployment of a ".LNK" file via an embedded VBA macro or by leveraging regsvr32.exe ...

  2026-05-22 00:45 UTC
• PicassoLoader - PolySwarm
  web:blog.polyswarm.io

  PicassoLoader , a downloader, was observed targeting government, military, and civilian entities in Ukraine and Poland. CERT-UA attributed this activity to GhostWriter. Key Takeaways PicassoLoader is a downloader used to target government, military, and civilian entities in Ukraine and Poland. The attacks occurred between April 2022 and July 2023.

  2026-05-22 00:45 UTC
• Botnet C&C domain blocking | FortiGate / FortiOS 7.0.15 | Fortinet ...
  web:docs.fortinet.com

  From your internal network PC, use a command line tool, such as dig or nslookup, to query this domain and verify that it is blocked by the DNS filter botnet C&C .

  2026-05-22 00:45 UTC
• C2 Tracker - Community-Driven Malware and C2 Monitoring Tool
  web:ethicalhacksacademy.com

  C2 Tracker is a free, community-driven Indicator of Compromise (IOC) feed designed to track IP addresses associated with known malware, botnets , and Command-and-Control (C2) infrastructure.

  2026-05-22 00:45 UTC
• Feodo Tracker | Blocklist - abuse.ch
  web:feodotracker.abuse.ch

  Dridex, Heodo (aka Emotet), TrickBot, QakBot (aka QuakBot / Qbot) and BazarLoader (aka BazarBackdoor) botnet command&control servers (C2s) usually reside on compromised servers and such that have been rented and setup by the threat actor itself for the sole purpose of botnet hosting. Feodo Tracker offers a blocklist of IP addresses that are associated with such botnet C2s. It can be used to ...

  2026-05-22 00:45 UTC
• Recognizing Botnet Command and Control Made Simple
  web:networkthreatdetection.com

  Learn how recognizing botnet command and control patterns reveals hidden threats and keeps your network safe from malicious attacks.

  2026-05-22 00:45 UTC
• PicassoLoader, 1 Phishing campaign - Top Antimalware
  web:nicolascoolman.eu

  PicassoLoader is a malware downloader used to distribute other malware to infected systems. It is capable of bypassing security mechanisms and deploying varied payloads, thereby facilitating the installation of spyware, ransomware or other malicious tools.

  2026-05-22 00:45 UTC
• PicassoLoader (Dropper) - Malware - CyberMaterial
  web:www.cybermaterial.com

  Execution and Communication Upon successful execution, PICASSOLOADER establishes communication with its command-and-control (C2) server. This server acts as the central hub for managing the malware's activities, enabling attackers to issue commands, deliver additional payloads, and receive stolen data from the compromised system.

  2026-05-22 00:45 UTC
• 4 Botnet Detection Techniques, Challenges & Best Practices
  web:www.radware.com

  4. Use sinkholing to study botnets and contain threats: Instead of blocking all botnet traffic immediately, redirect suspicious traffic to a controlled sinkhole server. This allows you to observe the botnet's C&C communication patterns and gather intelligence on infrastructure, malware distribution, and attacker motives. 5.

  2026-05-22 00:45 UTC
• Botnet Controller List (BCL) | Botnet C&C datasets | Spamhaus
  web:www.spamhaus.org

  The Spamhaus Botnet Controller List (BCL) is a specialized, advisory "drop all traffic" list. It consists of IP addresses that are actively used by cybercriminals to control malware-infected computers (bots). This is a high-confidence list, with false positives being extremely rare, to block as much high-risk, malicious traffic as possible.

  2026-05-22 00:45 UTC

Only Available for Registered Users. Sign in to view.