Malicious Command and Control (C2) configurations were observed in specific locations on given dates.

#StagedC2 config observed at Tue May 5 05:41:16 2026 UTC, located at hXXps://pastebin[.]com/raw/sWbXuPjp C2: jahf7286ld[.]localto[.]net:5728 (IP: 94.156.250.190)

#StagedC2 config observed at Thu Apr 30 11:45:04 2026 UTC, located at hXXps://pastebin[.]com/raw/wK47UQyE C2: etg3ou6ljm[.]localto[.]net:5435 (IP: 129.151.142.36)

#StagedC2 config observed at Thu Apr 30 12:24:12 2026 UTC, located at hXXps://pastebin[.]com/raw/iAKr7D8C C2: portbuddy[.]dev:40633 (IP: 158.160.75.185)

#StagedC2 config observed at Thu Apr 30 12:49:02 2026 UTC, located at hXXps://pastebin[.]com/raw/PZZSCH6C C2: uadahjxaxasn-63630[.]portmap[.]host:63630 (IP: 193.161.193.99)

#StagedC2 config observed at Thu Apr 30 18:39:02 2026 UTC, located at hXXps://pastebin[.]com/raw/xjLp6Jhp C2: 140[.]228[.]21[.]108:21236

#StagedC2 config observed at Thu Apr 30 19:35:12 2026 UTC, located at hXXps://pastebin[.]com/raw/0Gj7M4gk C2: 185[.]100[.]157[.]175:9455

#StagedC2 config observed at Thu Apr 30 19:49:05 2026 UTC, located at hXXps://pastebin[.]com/raw/gHkFPbFR C2: Doni2186731687-49699[.]portmap[.]host:49699 (IP: 193.161.193.99)

#StagedC2 config observed at Thu Apr 30 19:43:02 2026 UTC, located at hXXps://pastebin[.]com/raw/nZdPvdyA C2: abdoussa-64980[.]portmap[.]host:64980 (IP: 193.161.193.99)

#StagedC2 config observed at Thu May 7 07:41:04 2026 UTC, located at hXXps://pastebin[.]com/raw/6pLwHHC6 C2: wkc5f83bcr[.]localto[.]net:5438 (IP: 129.151.142.36)

#StagedC2 config observed at Fri May 1 07:05:18 2026 UTC, located at hXXps://pastebin[.]com/raw/Ss55uYR2 C2: cfdexfcfrcfrx-33168[.]portmap[.]host:33168 (IP: 193.161.193.99)

#StagedC2 config observed at Fri May 1 07:42:06 2026 UTC, located at hXXps://pastebin[.]com/raw/yCwX8hbV C2: uacnhmzhv3[.]localto[.]net:1819 (IP: 94.156.250.190)

#StagedC2 config observed at Fri May 1 11:14:02 2026 UTC, located at hXXps://pastebin[.]com/raw/AcyWWijz C2: Vibe992846-60679[.]portmap[.]host:60679 (IP: 193.161.193.99)

#StagedC2 config observed at Fri May 1 11:58:07 2026 UTC, located at hXXps://pastebin[.]com/raw/vNgSd4s2 C2: dwafa545345-49644[.]portmap[.]host:49644 (IP: 193.161.193.99)

#StagedC2 config observed at Fri May 1 12:16:06 2026 UTC, located at hXXps://pastebin[.]com/raw/XrAn12v8 C2: olek980-48257[.]portmap[.]host:48257 (IP: 193.161.193.99)

#StagedC2 config observed at Fri May 1 14:38:22 2026 UTC, located at hXXps://pastebin[.]com/raw/M1xUuuZr C2: 31[.]58[.]143[.]170:7777