Between 15 and 17 September 2026, infosec monitoring accounts detected six StagedC2 malware command-and-control (C2) server configurations posted on Pastebin, with C2 endpoints hosted on portmap.host and other domains (viniciusnoluck, IZON, inmarkfo, yhwgmg63, and webmessage.bond) spanning multiple IP addresses including 193.161.193.99 and others. Posts were timestamped and shared across infosec channels.
No BS check run yet — press ⚖ to extract this story's claims and verify them against independent sources.
# StagedC2 config observed at Tue Sep 15 00:17:03 2026 UTC, located at hXXps://pastebin[.]com/raw/NciDe1q8 C2: viniciusnoluck-36192[.]portmap[.]host:36192 (IP: 193.161.193.99)
this outlet adds: eunmtkp1, izon, 56323
# StagedC2 config observed at Tue Sep 15 04:21:05 2026 UTC, located at hXXps://pastebin[.]com/raw/z1NbEu3h C2: 82[.]26[.]104[.]193:433
# StagedC2 config observed at Tue Sep 15 04:39:02 2026 UTC, located at hXXps://pastebin[.]com/raw/Rc2yZUyC C2: 82[.]26[.]104[.]193:5228
# StagedC2 config observed at Tue Sep 15 05:28:03 2026 UTC, located at hXXps://pastebin[.]com/raw/N6h4Uupf C2: zaaxx-63486[.]portmap[.]host:63486 (IP: 193.161.193.99)
# StagedC2 config observed at Tue Sep 15 10:41:02 2026 UTC, located at hXXps://pastebin[.]com/raw/dYnzE1DP C2: 82[.]26[.]104[.]193:8989
# StagedC2 config observed at Tue Sep 15 11:35:02 2026 UTC, located at hXXps://pastebin[.]com/raw/1hX4X0xz C2: hexfxwabkn[.]localto[.]net:8359 (IP: 129.151.142.36)
# StagedC2 config observed at Tue Sep 15 15:54:07 2026 UTC, located at hXXps://pastebin[.]com/raw/u5f9cFAj C2: linkdgrge[.]aternos[.]me:40773 (IP: 185.107.194.104)
# StagedC2 config observed at Tue Sep 15 17:20:03 2026 UTC, located at hXXps://pastebin[.]com/raw/f55MZAy4 C2: linkdgrge[.]aternos[.]me:40773 (IP: 185.107.192.163)
# StagedC2 config observed at Tue Sep 15 20:50:03 2026 UTC, located at hXXps://pastebin[.]com/raw/HGsL1tEF C2: 132[.]145[.]109[.]60:9147
# StagedC2 config observed at Tue Sep 15 22:00:04 2026 UTC, located at hXXps://pastebin[.]com/raw/JsT4uhc3 C2: 89[.]22[.]239[.]18:443
# StagedC2 config observed at Tue Sep 15 22:09:02 2026 UTC, located at hXXps://pastebin[.]com/raw/YV2jJJLF C2: Fleex-62313[.]portmap[.]host:62313 (IP: 193.161.193.99)
# StagedC2 config observed at Wed Sep 16 03:02:03 2026 UTC, located at hXXps://pastebin[.]com/raw/hDeibDm0 C2: viki999-57009[.]portmap[.]host:57009 (IP: 193.161.193.99)
# StagedC2 config observed at Wed Sep 16 03:21:03 2026 UTC, located at hXXps://pastebin[.]com/raw/EjP9Wmka C2: viki999-40891[.]portmap[.]host:40891 (IP: 193.161.193.99)
# StagedC2 config observed at Wed Sep 16 04:07:03 2026 UTC, located at hXXps://pastebin[.]com/raw/AWmfrx8Z C2: viki999-57861[.]portmap[.]host:57861 (IP: 193.161.193.99)
# StagedC2 config observed at Wed Sep 16 07:00:04 2026 UTC, located at hXXps://pastebin[.]com/raw/SUfxPTRK C2: 94[.]26[.]106[.]247:56002
# StagedC2 config observed at Wed Sep 16 12:04:02 2026 UTC, located at hXXps://pastebin[.]com/raw/kBBfHHK5 C2: Userqrv-38208[.]portmap[.]host:38208 (IP: 193.161.193.99)
# StagedC2 config observed at Wed Sep 16 21:20:07 2026 UTC, located at hXXps://pastebin[.]com/raw/gu07Sv28 C2: inmarkfo-41284[.]portmap[.]host:41284 (IP: 193.161.193.99)
# StagedC2 config observed at Thu Sep 17 10:30:06 2026 UTC, located at hXXps://pastebin[.]com/raw/jLPQhGEK C2: webmessage[.]bond:4747 (IP: 134.255.218.127)
# StagedC2 config observed at Thu Sep 17 15:20:04 2026 UTC, located at hXXps://pastebin[.]com/raw/LWtnUkEy C2: yhwgmg63-36394[.]portmap[.]host:36394 (IP: 193.161.193.99)