TF-1821677 high

Description

Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: ACR Stealer. Confidence: 100. First seen: 2026-06-03 06:08:25 UTC. Reporter: abuse_ch. Tags: ACRStealer.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (3)

• External reference ThreatFox IOCs
• Malpedia profile ThreatFox IOCs
• ThreatFox IOC page ThreatFox IOCs

  Indicator that identifies a botnet command&control server (C&C). IOC type: Domain that is used for botnet Command&control (C&C). Attributed malware: ACR Stealer. Confidence: 100. First seen: 2026-06-03 06:08:25 UTC. Reporter: abuse_ch. Tags: ACRStealer.

• ACR Stealer Malware Analysis, Overview by ANY.RUN
  web:any.run

  ACR Stealer is a modern information-stealing malware designed to harvest sensitive data from infected devices. Like other infostealers, it targets credentials, financial details, browser data, and files, enabling cybercriminals to monetize stolen information through direct fraud or underground market sales.

  2026-06-03 22:27 UTC
• ACR Stealer - Uncovering Attack Chains, Functionalities And IOCs
  web:cybersecuritynews.com

  This malware has gained particular notoriety for its innovative use of legitimate platforms as command-and-control infrastructure, making detection and mitigation exceptionally challenging for security teams.

  2026-06-03 22:27 UTC
• Botnet C&C domain blocking | FortiGate / FortiOS 7.6.4 | Fortinet ...
  web:docs.fortinet.com

  From your internal network PC, use a command line tool, such as dig or nslookup, to query this domain and verify that it is blocked by the DNS filter botnet C&C .

  2026-06-03 22:27 UTC
• Botnet - C&C feed | ESET Threat Intelligence | ESET Online Help
  web:help.eset.com

  This feed is a subset of a Botnet feed and provides information about URLs of Command and Control (C&C) servers and associated data.

  2026-06-03 22:27 UTC
• ACR Stealer (Malware Family) - Fraunhofer
  web:malpedia.caad.fkie.fraunhofer.de

  The malware, written in C++, is compatible with Windows 7 through 10, and the seller manages all command and control (C2) infrastructure. ACR Stealer can harvest system information, stored credentials, web browser cookies, cryptocurrency wallets, and configuration files for various programs.

  2026-06-03 22:27 UTC
• New Malware Campaign Uses Cracked Software to Spread Lumma and ACR Stealer
  web:social.cyware.com

  A notable aspect of the stealer malware is the use of a technique called dead drop resolver to extract the actual C2 server. This includes relying on legitimate services like Steam, Telegram's Telegraph, Google Forms, and Google Slides. Read More Malware Campaign cracked software Lumma stealer ACR Stealer Microsoft Management Console (MMC ...

  2026-06-03 22:27 UTC
• ACR Stealer - Malware removal instructions (updated) - PCrisk
  web:www.pcrisk.com

  Throughout its existence ACR has used various tactics for C&C (Command and Control) servers, and the newest versions have relied on unique platforms like obtaining commands from Google Docs. The stealer can extract data from systems and installed applications (non-exhaustive list below).

  2026-06-03 22:27 UTC
• Amatera Stealer: Rebranded ACR Stealer With Improved Evasion ...
  web:www.proofpoint.com

  This shellcode ultimately runs Amatera Stealer . Malware analysis Overview Amatera Stealer is a stealer written in C++ which is actively being developed and maintained as a MaaS. The rebranded malware is equipped with new features, including improved stealer capabilities and evasion features used to circumvent detection.

  2026-06-03 22:27 UTC
• 4 Botnet Detection Techniques, Challenges & Best Practices
  web:www.radware.com

  4. Use sinkholing to study botnets and contain threats: Instead of blocking all botnet traffic immediately, redirect suspicious traffic to a controlled sinkhole server. This allows you to observe the botnet's C&C communication patterns and gather intelligence on infrastructure, malware distribution, and attacker motives. 5.

  2026-06-03 22:27 UTC
• Botnet C&C | Blogs, news articles and reports | Spamhaus
  web:www.spamhaus.org

  Networks hosting botnet C&Cs : Same players, same problems With every Botnet Threat Update we publish, the same networks consistently appear in the Top 20 for hosting botnet command and control (C&C) servers. But why does this keep happening?

  2026-06-03 22:27 UTC

Only Available for Registered Users. Sign in to view.