Staged command-and-control malware infrastructure detected

StagedC2 6 C2 servers 2026-09-08

Between 2026-09-08 and 2026-09-10, infosec researchers on Mastodon reported six independent observations of StagedC2 malware configurations posted to Pastebin, each with command-and-control server details and IP addresses (147.185.221.214, 193.161.193.99, 64.89.160.127). Ongoing malware deployment activity.

17 social postsother

Staged command-and-control malware infrastructure detected

Claim audit

All coverage

# StagedC2 config observed at Tue Sep 8 20:49:04 2026 UTC, located at hXXps://pastebin[.]com/raw/DaceJZvs C2: practicing-showers[.]tun[.]ply[.]gg:52519 (IP: 147.185.221.214)

# StagedC2 config observed at Wed Sep 9 09:16:05 2026 UTC, located at hXXps://pastebin[.]com/raw/55pJxPUA C2: kunjs-57645[.]portmap[.]host:57645 (IP: 193.161.193.99)

# StagedC2 config observed at Wed Sep 9 16:33:02 2026 UTC, located at hXXps://pastebin[.]com/raw/c9r0WFFc C2: kunjs-52039[.]portmap[.]host:52039 (IP: 193.161.193.99)

# StagedC2 config observed at Wed Sep 9 23:41:02 2026 UTC, located at hXXps://pastebin[.]com/raw/g02CRH6E C2: lsnr-48994[.]portmap[.]host:48994 (IP: 193.161.193.99)

# StagedC2 config observed at Wed Sep 9 23:51:03 2026 UTC, located at hXXps://pastebin[.]com/raw/WHFiyetL C2: yns2lyon-63466[.]portmap[.]host:63466 (IP: 193.161.193.99)

# StagedC2 config observed at Thu Sep 10 06:20:07 2026 UTC, located at hXXps://pastebin[.]com/raw/tAadXiQp C2: 172[.]94[.]92[.]162:1177

# StagedC2 config observed at Thu Sep 10 09:51:02 2026 UTC, located at hXXps://pastebin[.]com/raw/W1w6nATc C2: iass6969-39362[.]portmap[.]host:39362 (IP: 193.161.193.99)

# StagedC2 config observed at Thu Sep 10 10:30:02 2026 UTC, located at hXXps://pastebin[.]com/raw/ZY5GMEqS C2: 143[.]246[.]222[.]184:7000

# StagedC2 config observed at Thu Sep 10 15:08:03 2026 UTC, located at hXXps://pastebin[.]com/raw/Sgi0jD8c C2: Anton1-43275[.]portmap[.]host:43275 (IP: 193.161.193.99)

# StagedC2 config observed at Thu Sep 10 17:49:05 2026 UTC, located at hXXps://pastebin[.]com/raw/0a62NWaA C2: sjxa2pbolg[.]localto[.]net:4526 (IP: 188.132.242.67)

# StagedC2 config observed at Thu Sep 10 18:01:05 2026 UTC, located at hXXps://pastebin[.]com/raw/1U2ntqhH C2: m1z0kgs8ew[.]localto[.]net:7670 (IP: 188.132.242.67)

# StagedC2 config observed at Thu Sep 10 18:23:04 2026 UTC, located at hXXps://pastebin[.]com/raw/Zx4zNzE6 C2: azudo-32441[.]portmap[.]host:32441 (IP: 193.161.193.99)

# StagedC2 config observed at Thu Sep 10 18:31:04 2026 UTC, located at hXXps://pastebin[.]com/raw/ggMJZi92 C2: marwan5555-64814[.]portmap[.]host:64814 (IP: 193.161.193.99)

# StagedC2 config observed at Thu Sep 10 18:42:05 2026 UTC, located at hXXps://pastebin[.]com/raw/t3ffNn9y C2: azudo-46985[.]portmap[.]host:46985 (IP: 193.161.193.99)

# StagedC2 config observed at Thu Sep 10 19:26:07 2026 UTC, located at hXXps://pastebin[.]com/raw/pycvP838 C2: 64[.]89[.]160[.]127:2954

# StagedC2 config observed at Thu Sep 10 19:42:04 2026 UTC, located at hXXps://pastebin[.]com/raw/GQuGLhHa C2: siegekuba-45836[.]portmap[.]host:45836 (IP: 193.161.193.99)

# StagedC2 config observed at Thu Sep 10 19:50:04 2026 UTC, located at hXXps://pastebin[.]com/raw/iby9e7HK C2: siegekuba-45836[.]portmap[.]host:45836 (IP: 193.161.193.99)