Security researchers detected multiple StagedC2 command and control server configurations on July 23, 2026. The malicious configurations were staged on Pastebin and employed various C2 endpoints including ngrok tunnels and custom domains.
No BS check run yet — press ⚖ to extract this story's claims and verify them against independent sources.
# StagedC2 config observed at Thu Jul 23 14:23:04 2026 UTC, located at hXXps://pastebin[.]com/raw/1K1VMwyc C2: 691bfc1a3a2df7[.]lhr[.]life:80 (IP: 3.208.46.244)
# StagedC2 config observed at Thu Jul 23 14:21:03 2026 UTC, located at hXXps://pastebin[.]com/raw/HsVx8uNT C2: 691bfc1a3a2df7[.]lhr[.]life:80 (IP: 54.172.225.3)
# StagedC2 config observed at Thu Jul 23 15:47:06 2026 UTC, located at hXXps://pastebin[.]com/raw/P5hnJHHc C2: 4[.]tcp[.]eu[.]ngrok[.]io:21846 (IP: 3.127.59.75)
# StagedC2 config observed at Thu Jul 23 16:24:05 2026 UTC, located at hXXps://pastebin[.]com/raw/x9bYWsMT C2: Umar6182-47530[.]portmap[.]host:47530 (IP: 193.161.193.99)
# StagedC2 config observed at Thu Jul 23 16:54:02 2026 UTC, located at hXXps://pastebin[.]com/raw/SFXy3Z9h C2: 0[.]tcp[.]eu[.]ngrok[.]io:16809 (IP: 3.78.28.71)
# StagedC2 config observed at Thu Jul 23 22:52:03 2026 UTC, located at hXXps://pastebin[.]com/raw/bMdHCUT6 C2: 185[.]247[.]208[.]32:7707
# StagedC2 config observed at Fri Jul 24 01:28:03 2026 UTC, located at hXXps://pastebin[.]com/raw/yYfpv7UC C2: 0[.]tcp[.]sa[.]ngrok[.]io:17401 (IP: 56.124.50.97)
# StagedC2 config observed at Fri Jul 24 09:02:04 2026 UTC, located at hXXps://pastebin[.]com/raw/nHGuUpfb C2: 87[.]120[.]84[.]133:9955
# StagedC2 config observed at Fri Jul 24 10:52:04 2026 UTC, located at hXXps://pastebin[.]com/raw/Z6c2ei7n C2: 74[.]80[.]182[.]95:7707
# StagedC2 config observed at Fri Jul 24 11:16:03 2026 UTC, located at hXXps://pastebin[.]com/raw/htCvTt9Q C2: 0oqbxfsygv[.]localto[.]net:5301 (IP: 129.151.142.36)
# StagedC2 config observed at Fri Jul 24 12:01:03 2026 UTC, located at hXXps://pastebin[.]com/raw/e6jhsCjg C2: q8dv6j1rdr[.]localto[.]net:5778 (IP: 129.151.142.36)
# StagedC2 config observed at Fri Jul 24 12:25:07 2026 UTC, located at hXXps://pastebin[.]com/raw/5iDweYCS C2: ZHOSKICHYVAK-33009[.]portmap[.]host:33009 (IP: 193.161.193.99)
# StagedC2 config observed at Fri Jul 24 13:00:05 2026 UTC, located at hXXps://pastebin[.]com/raw/wJG10e8F C2: 209[.]25[.]140[.]31:1045
# StagedC2 config observed at Fri Jul 24 15:47:03 2026 UTC, located at hXXps://pastebin[.]com/raw/GcQLLAc1 C2: 94[.]68[.]94[.]38:5173
# StagedC2 config observed at Fri Jul 24 15:48:03 2026 UTC, located at hXXps://pastebin[.]com/raw/YL90dUET C2: 94[.]68[.]94[.]38:5173
# StagedC2 config observed at Fri Jul 24 20:56:05 2026 UTC, located at hXXps://pastebin[.]com/raw/NdYFbFmE C2: 0[.]tcp[.]sa[.]ngrok[.]io:29073 (IP: 56.125.42.136)
# StagedC2 config observed at Fri Jul 24 22:49:02 2026 UTC, located at hXXps://pastebin[.]com/raw/3LxyJ2Tg C2: sakura[.]proxy[.]rlwy[.]net:25311 (IP: 66.33.22.221)
# StagedC2 config observed at Sat Jul 25 08:02:03 2026 UTC, located at hXXps://pastebin[.]com/raw/YUQ0BSje C2: me7polbush[.]localto[.]net:4390 (IP: 94.156.250.190)
# StagedC2 config observed at Sat Jul 25 11:17:03 2026 UTC, located at hXXps://pastebin[.]com/raw/3YHqkbMC C2: npxfuu18rh[.]localto[.]net:3287 (IP: 45.154.207.60)
# StagedC2 config observed at Sat Jul 25 21:49:05 2026 UTC, located at hXXps://pastebin[.]com/raw/NnjDjvVB C2: 196[.]89[.]20[.]25:4444
# StagedC2 config observed at Sun Jul 26 02:26:05 2026 UTC, located at hXXps://pastebin[.]com/raw/PpSkKh6X C2: enjoy-shaw[.]gl[.]at[.]ply[.]gg:6085 (IP: 147.185.221.230)
# StagedC2 config observed at Sun Jul 26 05:18:03 2026 UTC, located at hXXps://pastebin[.]com/raw/eZqTWNHy C2: w3rhu329u-32288[.]portmap[.]host:32288 (IP: 193.161.193.99)
this outlet adds: wne9mahy, basez, 59106
# StagedC2 config observed at Sun Jul 26 06:49:02 2026 UTC, located at hXXps://pastebin[.]com/raw/CQaSQk9T C2: RatimSportmap-56719[.]portmap[.]host:56719 (IP: 193.161.193.99)
# StagedC2 config observed at Sun Jul 26 12:08:03 2026 UTC, located at hXXps://pastebin[.]com/raw/8WSzUnGA C2: ca0yzahevb[.]localto[.]net:4383 (IP: 45.154.207.60)
# StagedC2 config observed at Sun Jul 26 14:10:03 2026 UTC, located at hXXps://pastebin[.]com/raw/xWErwcbM C2: 91[.]92[.]41[.]157:57339
# StagedC2 config observed at Sun Jul 26 15:26:03 2026 UTC, located at hXXps://pastebin[.]com/raw/jfjm9YBY C2: bore[.]pub:12345 (IP: 159.223.110.159)
# StagedC2 config observed at Sun Jul 26 15:39:02 2026 UTC, located at hXXps://pastebin[.]com/raw/uiZ3aRqq C2: bore[.]pub:35299 (IP: 159.223.110.159)
# StagedC2 config observed at Sun Jul 26 17:09:03 2026 UTC, located at hXXps://pastebin[.]com/raw/au8fdJTm C2: 4[.]tcp[.]eu[.]ngrok[.]io:11156 (IP: 3.127.253.86)
# StagedC2 config observed at Sun Jul 26 18:59:06 2026 UTC, located at hXXps://pastebin[.]com/raw/tLLZ6Rqy C2: npxfuu18rh[.]localto[.]net:9177 (IP: 45.154.207.60)
# StagedC2 config observed at Sun Jul 26 19:42:03 2026 UTC, located at hXXps://pastebin[.]com/raw/PapJWMy7 C2: 6[.]tcp[.]eu[.]ngrok[.]io:22407 (IP: 52.28.247.255)
# StagedC2 config observed at Sun Jul 26 20:10:07 2026 UTC, located at hXXps://pastebin[.]com/raw/J93nVaSm C2: 171[.]252[.]153[.]160:8888
# StagedC2 config observed at Sun Jul 26 21:02:04 2026 UTC, located at hXXps://pastebin[.]com/raw/1YDjUxXS C2: 54[.]20[.]52[.]18:5173
# StagedC2 config observed at Mon Jul 27 15:37:02 2026 UTC, located at hXXps://pastebin[.]com/raw/B535AFBn C2: 93[.]123[.]85[.]144:1080
# StagedC2 config observed at Mon Jul 27 17:49:02 2026 UTC, located at hXXps://pastebin[.]com/raw/9XsqaFFY C2: mehost1-54155[.]portmap[.]host:54155 (IP: 193.161.193.99)
# StagedC2 config observed at Mon Jul 27 21:03:02 2026 UTC, located at hXXps://pastebin[.]com/raw/kMTrVYJH C2: crime1337-59862[.]portmap[.]host:59862 (IP: 193.161.193.99)
# StagedC2 config observed at Mon Jul 27 22:26:02 2026 UTC, located at hXXps://pastebin[.]com/raw/tpKJmXKp C2: tharealjuggboy-53795[.]portmap[.]host:53795 (IP: 193.161.193.99)
# StagedC2 config observed at Tue Jul 28 09:09:05 2026 UTC, located at hXXps://pastebin[.]com/raw/mvu85Ws4 C2: etyopujghd[.]localto[.]net:2025 (IP: 188.132.242.67)
# StagedC2 config observed at Tue Jul 28 09:28:02 2026 UTC, located at hXXps://pastebin[.]com/raw/FknfYUG5 C2: isaydiscoyousayparty-51313[.]portmap[.]host:51313 (IP: 193.161.193.99)
# StagedC2 config observed at Tue Jul 28 15:57:03 2026 UTC, located at hXXps://pastebin[.]com/raw/fTVstrW2 C2: mohammedtcp-34942[.]portmap[.]host:34942 (IP: 193.161.193.99)
# StagedC2 config observed at Tue Jul 28 16:05:06 2026 UTC, located at hXXps://pastebin[.]com/raw/BuKznpVW C2: npxfuu18rh[.]localto[.]net:1852 (IP: 45.154.207.60)
# StagedC2 config observed at Tue Jul 28 16:45:04 2026 UTC, located at hXXps://pastebin[.]com/raw/F3a1Ks5J C2: wepabil773-36701[.]portmap[.]host:36701 (IP: 193.161.193.99)
# StagedC2 config observed at Tue Jul 28 18:07:05 2026 UTC, located at hXXps://pastebin[.]com/raw/B5PDStEj C2: npxfuu18rh[.]localto[.]net:1446 (IP: 45.154.207.60)
# StagedC2 config observed at Tue Jul 28 18:53:06 2026 UTC, located at hXXps://pastebin[.]com/raw/m6EwdhKK C2: 185[.]215[.]151[.]16:7000