TF-2020031 high

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Unknown RAT. Confidence: 90. First seen: 2026-11-08 07:47:46 UTC. Reporter: LoneNco. Tags: ens, etherhiding, IRAHook, java, minecraft, RAT, stealer.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (3)

• External reference Threatfox IOCs/Threats
• Malpedia profile Threatfox IOCs/Threats
• ThreatFox IOC page Threatfox IOCs/Threats

  Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: Unknown RAT. Confidence: 90. First seen: 2026-11-08 07:47:46 UTC. Reporter: LoneNco. Tags: ens, etherhiding, IRAHook, java, minecraft, RAT, stealer.

• Identification of Command and Control Servers
  web:101.school

  Command and Control (C&C) servers play a crucial role in the operation of botnets and other forms of malware. They serve as the central hub from which cybercriminals can control infected machines, known as 'bots'.

  2026-11-08 17:32 UTC
• Botnets: Structure & How to Disrupt Them - acsmi.org
  web:acsmi.org

  A botnet's command and control (C2) structure dictates its efficiency and resilience. Centralized models use singular C2 servers that broadcast commands to infected nodes, offering simplicity but with a critical vulnerability—once identified, authorities can dismantle them.

  2026-11-08 17:32 UTC
• Inside C2 Attacks: How Hackers Control Compromised Systems
  web:cymulate.com

  A Command and Control (C2) attack is a cyberattack where attackers establish a covert communication channel between a compromised system and an attacker-controlled server. This backdoor channel allows the attacker to send commands to the infected machine and receive data from it, effectively remotely controlling the victim system.

  2026-11-08 17:32 UTC
• Cyber Threat Intelligence (CTI): Finding C2 Servers, Malware and ...
  web:hackers-arise.com

  In that regard, we have a new tool to identify and track command and control servers, malware and botnets using telltale fingerprinting from Shodan and Censys. Command and Control Servers: History, Development & Tracking In the fast-changing world of cybersecurity, Command and Control (C2) servers have been crucial.

  2026-11-08 17:32 UTC
• Botnet Infection Findings - Bitsight Knowledge Base
  web:help.bitsighttech.com

  The Botnet Infections risk vector is an indication of a host participating in a botnet , including active bots and Command and Control servers ( C&C servers).Navigation Options SPM App Findings ...

  2026-11-08 17:32 UTC
• Botnet Command and Control and the Geolocation of Botnets
  web:layerlogix.com

  How botnet command-and-control works, from central servers to peer-to-peer designs, and what geolocating a botnet's infrastructure tells defenders.

  2026-11-08 17:32 UTC
• Command and Control: How to Prevent a C2 Server Attack - DNSFilter
  web:www.dnsfilter.com

  What is a command and control attack? Discover how a C2 server works in a botnet C&C attack and learn how to take action to ensure your security.

  2026-11-08 17:32 UTC
• The Architecture and Operation of Botnet Command and Control
  web:www.flyriver.com

  Alternatively, a botnet could use a centralized server for initial command distribution and bot updates, while employing P2P communication for specific operations or to relay information back to the botmaster. This allows for efficient command dissemination while providing a fallback mechanism if the primary C2 servers are compromised.

  2026-11-08 17:32 UTC
• Botnet Controller List (BCL) | Botnet C&C datasets | Spamhaus
  web:www.spamhaus.org

  The Spamhaus Botnet Controller List (BCL) is a specialized, advisory "drop all traffic" list. It consists of IP addresses that are actively used by cybercriminals to control malware-infected computers (bots). This is a high-confidence list, with false positives being extremely rare, to block as much high-risk, malicious traffic as possible.

  2026-11-08 17:32 UTC
• Botnet C&C | Blogs, news articles and reports | Spamhaus
  web:www.spamhaus.org

  With every Botnet Threat Update we publish, the same networks consistently appear in the Top 20 for hosting botnet command and control (C&C) servers. But why does this keep happening? In this Botnet Spotlight, we look into the root causes behind this persistent issue and what networks must do to break the cycle. Botnet C&C Malware Service providers

  2026-11-08 17:32 UTC

Only Available for Registered Users. Sign in to view.