IOC Radar
DomainMediumSignal 81/100

artemis-rat.com

Location
AnguillaAnguilla
First Seen
Mar 14, 2024
Last Seen
May 21, 2026
Mar 14
First Seen
819d ago
May 21
Last Seen
22d ago
9
Reports
source reports
81%
Confidence
medium
Found in 9 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
Domain Name
Malicious domain used for C2, phishing, or malware distribution.
MISP Category
Network Activity
Confidence
81%
Signal Score
81 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK

MITRE ATT&CK TTPs

25 techniques

Feed Intelligence Summary

9 reports81% confidence
9
Source reports
81%
Confidence score
Category tags
academic institutionsactive scanagentagent teslaai applicationsai researchai solutionsamsiandroidanguillaartemis ratartificial intelligencebankbank securitybotnetbotnet activitybrute forcec2 domainclinical researchcode executioncommand & controlcommand and controlcommand executioncomputer visioncredential harvestingcredential stealercredential stuffingcryptocurrencycryptocurrency threatscryptojackingdata exfiltrationdata store exposuredeep learningdemodistributed attacksdrug developmentdrug manufacturingeducationeducational resourceseducational serviceseducational technologyeu cyber policieseuropeeuropean unionexploitation activityfinancefinancial institutionfinancial servicesgenericgo langguloaderhealthcare innovationhigher educationidentity & access exploitationindicatorinformation stealerinformation technologyinfostealerinfrastructure acquisitionreconnaissanceingress tool transferinjection activityiociot securityit infrastructurek-12 educationkeyloggerkhtmlkiller geckoloadermachine learningmalicious downloadmalicious softwaremalvertisingmalwaremalware analysismalware distributionmalware: agent teslamanualmedical researchmobilemobile malwaremobile securitymobile threatnatural language processingnetworknorth americaosintpharmaceutical and medicine manufacturingpharmaceutical supply chainphishingphishing attackprocess injectionputtyransomwarerayregional securityregulatory complianceresearchedresource hijackingsmoke loadersmtpsocial engineeringsoftware developmentsoftware exploitationstrelastealerstrongsupply chain attackt1005t1027t1041t1055t1059t1064t1071t1071.001t1078t1105t1189t1203t1486t1496t1499.001t1499.002t1499.003t1565t1566t1566.001t1566.002t1566.003t1573t1587.001t1590.001threat actorthreat intelligencetor nodeunited statesvariantvulturwindows ntword

Activity Timeline

1 total obs
May 21May 21

Threat Activity Heatmap

· Peak: 2026-05-21
Less
More
Mon
Wed
Fri
Jun
·
·
·
Jul
·
·
·
Aug
·
·
·
Sep
·
·
·
·
Oct
·
·
·
Nov
·
·
·
Dec
·
·
·
·
Jan
·
·
·
Feb
·
·
·
Mar
·
·
·
·
Apr
·
·
·
May
·
·
·
Jun
24h
0
Dormant
7d
0
Dormant
30d
1
Minimal
3mo
1
Minimal
Intelligence SummaryAI Generated

The domain **artemis-rat.com**, registered in Anguilla, has emerged as a significant indicator of compromise (IOC) in recent threat intelligence reports. First observed on March

Threat ScoreHigh Risk
81
SIGNAL
Signal Score
81%
Confidence
9
Reports
First seenMar 14, 2024
Last seenMay 21, 2026

VirusTotal

Not checked

WHOIS

registrar
NICENIC INTERNATIONAL GROUP CO., LIMITED
description
Command and Control domains for malware known as FormBook. These domains are extracted from malware sandbox reports using a Machine Learning model trained on a corpus of good and bad domains.
domain rank
-1
raw
Creation Date: 2023-10-13T17:07:36Z DNSSEC: unsigned Domain Name: ARTEMIS-RAT.COM Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited Domain Status: redemptionPeriod https://icann.org/epp#redemptionPeriod Name Server: EXPIRED-NS1.NICEISP.COM Name Server: EXPIRED-NS2.NICEISP.COM Registrar Abuse Contact Email: [email protected] Registrar Abuse Contact Phone: +852.68584411 Registrar IANA ID: 3765 Registrar URL: http://www.nicenic.net Registrar WHOIS Server: whois.nicenic.net Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED Registry Domain ID: 2821485734_DOMAIN_COM-VRSN Registry Expiry Date: 2024-10-13T17:07:36Z Updated Date: 2024-11-23T01:15:19Z
references
https://www.virustotal.com/graph/geb0e64fe3ff54b1ea2805cf1ab6f58245cd0654cf325426a973fd60f600a74bf, https://community.riskiq.com/article/0bb98406, https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/agent-teslas-new-ride-the-rise-of-a-novel-loader/, https://thehackernews.com/2024/03/alert-new-phishing-attack-delivers.html
subdomains count
0

Export & API

STIX 2.1 Bundle
CSV Export
Permalink

IOC Journey

medium
First detected 2 years ago · Last seen 22 days ago
Appeared in 9 threat reports