Mostly here for posting C2s. Thank you to @modat_magnify for the raw data. Grateful to @censysio for the support in past years.
Joined August 2021
- Tweets101K
- Following0
- Followers5.1K
- Likes1.4K
Pinned Tweet
We’ve secured a new data source - thanks to @modat_magnify for extended API access. We’ll migrate soon and share fresh content.
This one was easy... Added to the feeds, thank you @MichalKoczwara
Yet another AI attack tool added to the list - github.com/Clouditera/VulnHu…
Added two new items to the feeds, courtesy of the item below and @C2HuntersLabs
- VShell C2
- DesRedTeam (a.k.a. DesShell)
items should be live soon.
VShell C2 (v4.9.3) panel identified.
VShell is a cross-platform post-exploitation framework popular with Mandarin-speaking threat actors.
WebSocket connection found in the panel: wss://www.haiwoi[.]top/api/v2/sync
IOC: haiwoi.top
#ThreatIntel #C2 #VShell
Also adding github.com/shell-dot/tuoni and github.com/AlteredSecurity/3… courtesy of @modat_magnify Thank you, once again!
Thank you! Adding the following as they seemed easy and reliable to track: PentAGI / Xalgorix / RedAmon
I have a list github.com/EvanThomasLuke/Aw…
Haven't done one of these in a long time but since we are on the AI topic, this one just popped up too:
C2 BeaconType: Hybrid HTTP DNS
C2 IP: 42[.]193[.]238[.]29 C2 Port: 53
C2 Server: ns1[.]deepsekapi[.]cn,/omp/api/get_page_config
Starting to see offensive AI tools being abused in real-world intrusions. Adding them to the feeds alongside other offensive tooling that can be an early indicator of something worse to come.
github.com/AIPentest/CyberSt…
github.com/oritera/Cairn
github.com/CyberStrikeus/Cyb…
Another addition courtesy of the folks @modat_magnify - Rogue C2 - github.com/ekomsSavior/rogue
C2IntelFeedsBot retweeted
We found an attacker's FortiGate toolkit sitting in a public directory.
Exploit tool. Implant source code. Stolen configs from compromised firewalls. And the operator's own working notes.
We read all of it and wrote up what they actually did.
c2huntersresearch.com/blog/2…
Another entry to the feeds, this one seems interesting, Pivot-C2, credit to teapawt.net/C2HuntersLabs/status/2… for the detailed post.
We found an attacker's FortiGate toolkit sitting in a public directory.
Exploit tool. Implant source code. Stolen configs from compromised firewalls. And the operator's own working notes.
We read all of it and wrote up what they actually did.
c2huntersresearch.com/blog/2…
Looks like it's been officially 5 years for this account but sharing of data started earlier. A lot as changed in these 5 years.
C2IntelFeedsBot retweeted
The new Modat Magnify is live.
Click an IP, land on the whole host. Compare and pivot across multiple services in Threat Investigator. One query language across the UI and the API, backwards compatible.
Less distance between a question and its answer.
Find out more: modat.io/blog/modat-magnify-…
Yet another one #HypeAgent courtesy of teapawt.net/abuse_ch/status/208966… via @modat_magnify team. Data should be in the feeds soon.
We identified a new malware called #HypeAgent which acts as information stealer & loader. It is dominantly spread through malspam 📧, first observed on August 1, 2026 🔭👀
Key Capabilities ⤵️
🕵️ Stealer & Loader: Supports 200+ commands; drops/executes payloads, including crypto miners 💸
🔎 Targeted Harvesting: Steals web browser & email credentials, crypto wallets, and gaming accounts (Steam, Roblox) 🎮
🤖 AI & Platform Cookie Stealing: Targets a list of hardcoded domains like Grok, Anthropic, Coinbase, ByBit, Instagram, and Rockstar Games for which it steals session cookies 🍪
💰 Electron App Webinjects: Intercepts activity on desktop apps like Exodus Wallet 👛
Artifacts observed ⤵️
1️⃣ Stores stealers logs under C:\Users\USERNAME\AppData\Local\Temp\hype-YYYY-MM-DD.log
2️⃣ Uses HTTP host header "X-Hype-Agent-Token" during botnet C2 communication
HypeAgent communicates via WebSocket using JSON. Here are some Botnet C2 servers we have been observed ⤵️
📡 31.40.204.178:7080 WhiteLabel 🇹🇷
📡 94.26.3.211:7443 Stellar Group SAS 🇫🇷
📡 192.109.139.91:7443 Stellar Group SAS 🇺🇸
📡 195.177.94.60:7443 Stellar Group SAS 🇫🇷
📡 107.175.148.122:7443 HostPapa 🇺🇸
📡 209.54.103.173:7443 HostPapa 🇺🇸
📡 132.243.225.173:7080 QWINS-Hosting 🇩🇪
📡 78.40.209.113:7081 QWINS-Hosting 🇫🇮
📡 31.77.138.55:5654 QWINS-Hosting 🇫🇮
🦊 Releated IOCs on ThreatFox:
threatfox.abuse.ch/browse/ta…
📄 Releated malware samples on MalwareBazaar:
bazaar.abuse.ch/browse/signa…
ALT HypeAgent botnet C2 communication observed during tria.ge sandbox run
Another new C2, Space X 1337, courtesy of blog.deception.pro/blog/clic… data should be on the feeds soon.
![[Op Report] From ClickFix SpaceX1337 to Hands-on-Keyboard AD Attack — Deception.Pro Blog](https://pbs.twimg.com/card_img/2117448595884720128/d2gy3m8E?format=jpg&name=420x420_2)
Up next Komari Monitor is being added too. Reference among other items huntress.com/blog/komari-c2-…
Slight update, we didn't have this as an RMM as we should. This is now fixed, the updates should be in the repo shortly. Thank you @modat_magnify for keeping me honest on top of all else you do for us.
Soon posting PureRAT courtesy of @modat_magnify once again and sourced from socprime.com/active-threats/… Thank you to both.
Will start posting github.com/iIIusi0n/DevilGin… data too. Thank you to @modat_magnify team.
Now posting Dindoor to feeds (hunt.io/blog/dindoor-deno-ru…) courtesy of @pedrinazziM
