Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
high threatBackdoorMalware Family
Historical
Cobalt Strike
High severity
17.0k
IOCs Tracked
—
First Seen
—
Last Seen
0
YARA Rules
Associated IOCs16,982 total · showing 50
IP29
91.202.233.2142026-09-24High
67.219.102.2442026-09-24High
221.207.101.1752026-09-24High
109.73.193.2422026-09-24High
162.248.225.1652026-09-24High
15.204.95.2282026-09-24High
185.177.72.682026-09-24High
46.151.182.2052026-09-24High
101.200.193.2112026-09-24High
77.83.36.1632026-09-03High
5.101.86.982026-07-04High
5.101.86.1052026-07-06High
178.16.54.2482026-06-23High
88.119.167.1432026-08-17High
84.21.189.2252026-06-20High
107.175.148.682026-07-09High
137.184.163.272026-09-24High
39.107.242.1302026-09-24High
195.123.240.2362026-09-15High
163.181.208.792026-09-24High
Domain21
afxwd.ddns.net2026-06-18High
x-8.6-.sakura2026-09-24High
handshakebins.sh2026-09-24High
z.sh2026-09-24High
a-r.m-6.sakura2026-09-24High
cirqueira.sh_armv6l.sh2026-09-24High
rust.abi3.so2026-09-24High
cirqueira.sh_armv4l.sh2026-09-24High
wget.sh2026-09-24High
plugin.sh2026-09-24High
m-p.s-l.sakura2026-09-24High
bins.sh2026-09-24High
updatef.zip2026-09-24High
setup.sh2026-09-24High
vpn.sh2026-09-24High
i-5.8-6.sakura2026-09-24High
s-h.4-.sakura2026-09-24High
i.sh2026-09-24High
cirqueira.sh_powerpc-440fp.sh2026-09-24High
cirqueira.sh_sparc.sh2026-09-24High
Related Reports30 shown
Abuse.ch ThreatFox (8135 indicators)
Abuse.ch ThreatFoxSep 24, 2026
Abuse.ch ThreatFox (7252 indicators)
Abuse.ch ThreatFoxSep 24, 2026
Abuse.ch ThreatFox (7236 indicators)
Abuse.ch ThreatFoxSep 24, 2026
Abuse.ch ThreatFox (7237 indicators)
Abuse.ch ThreatFoxSep 24, 2026
Abuse.ch ThreatFox (7240 indicators)
Abuse.ch ThreatFoxSep 24, 2026
Abuse.ch ThreatFox (7245 indicators)
Abuse.ch ThreatFoxSep 24, 2026
CARBONATO: a botnet built around an AI agent
ThreatDownSep 23, 2026
Abuse.ch ThreatFox (7238 indicators)
Abuse.ch ThreatFoxSep 24, 2026
Abuse.ch ThreatFox (7234 indicators)
Abuse.ch ThreatFoxSep 23, 2026
Abuse.ch ThreatFox (7238 indicators)
Abuse.ch ThreatFoxSep 23, 2026
Abuse.ch MalwareBazaar (1588 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1573 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1515 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1440 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1430 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1428 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1400 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1391 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1385 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1388 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1409 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1421 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1431 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1439 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1461 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1476 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1490 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1493 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1486 samples)
Abuse.ch MalwareBazaar
Abuse.ch MalwareBazaar (1487 samples)
Abuse.ch MalwareBazaar
Threat Profile
TypeBackdoor
StatusHistorical
IOCs tracked16,982