@abuse-ch.bsky.social

@abuse-ch.bsky.social

484 Followers 3 Following

Fighting malware and botnets

Once the malware sample is executed, it displays the following text on the victim's machine
Top countries sourcing residential proxy scraping IPs targeting abuse.ch platforms
Unidentified botnet C2 trying to hide as FortiGate device
RemusStealer malware sample using havelbeenpwned .net a botnet C2 server
Spanish malspam
Malware detonation suggests that the threat actor was likely playing around with ScreenConnect RMM before
RemoteX RAT admin panel
Xillen Stealer admin panel on Cloudflare
Brazilian Banker "GHOST" panel
Malspam from Microsoft Outlook spreading LogMeIn GoToResolve RMM
turbokent .name - CHICXULUB IMPACT
Mirai malware delivery URLs
ClickFix infection chain
Malicious bast script deliverying Mirai payload
MaksRAT botnet C2 traffic
Mirai bot "zerobot"
URLhaus Top Contributor “Geenensp”
GrokPy botnet C2 traffic
Total IOCs Shared (Last 30 Days)
Malicious bash script turning the compromised machine into a proxy
URLHaus abuse reports sent (Last 30 Days) - up 48.88%
Top Contributor MalwareBazaar - JAMESWT_WT
Additional contextual information on Office OLE files on MalwareBazaar
Kaspersky OpenTIP integration on MalwareBazaar
https://threatfox.abuse.ch/browse/malware/win.lumma/
Morpheus loader admin panel
Amadey botnet C2 network traffic
Weaponized PDF leading to rogue ScreenConnect download
Fake gaming website leading to LummaStealer download
Am I going to have to pay for abuse.ch data?
Fortinet and Citrix NetScaler exploitation attempts originating from Galeon LLC (RU)
NoName057(16) threat
MalwareBazaar sample detection by Malva.RE
3 weeks remaining before mandatory authentication - starting June 30th.
DNS4EU blocklist coverage
New feature for hunting.abuse.ch
Rate limiting in effect for excessive API queries. Authenticate now.
Mirai botnet exploiting known vulnerbility in ZyXELL routers