VirusTotal Adds Scanning for Public IPv4 Space to Expose C2 Servers and Malware Infrastructure
VirusTotal now scans public IPv4 daily, recording ports, banners, and fingerprints to surface C2 infrastructure.
54
Product
Cobalt Strike
- Mentions · 7d0
- Mentions · 30d1
- All mentions6
- First seenAug 17, 2026
- Last mentioned23d ago
Timeline
6 articles · newest firstMulti-View Fusion for Encrypted C2 Detection: A Leakage-Controlled Measurement Study of Evaluation Pitfalls
A leakage-controlled study of Cobalt Strike TLS flows finds fusion gains are tiny and evaluation pitfalls dwarf real detection effects.
46
FamousSparrow Swaps SparrowDoor For New SparroWocky Backdoor
China-aligned FamousSparrow deployed its new SparroWocky backdoor against Latin American governments since August 2025, initially accessing networks via exploited Exchange servers.
78
Ukrainian lawyer's second career as a Conti coder earns him 4 years behind bars
Ukrainian lawyer turned Conti malware coder sentenced to four years in US prison, ordered to forfeit $25,042 in Bitcoin.
60
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
Symantec reports multiple threat actors, including KongTuke, abusing the trusted signed Node.js runtime and blockchain C2 (EtherHiding) to deliver backdoors in targeted attacks.
62
Tracking OceanLotus’ new Downloader, KerrDown
Unit 42 identifies KerrDown, a new OceanLotus (APT32) downloader active since 2018 targeting Vietnamese speakers via malicious macros and DLL side-loading.
52
Appears with
- Palo Alto Networksvendor · 1
- OceanLotusthreat actor · 1
- KongTukethreat actor · 1
- AsukaStealerproduct · 1
- ESETorganization · 1
- FamousSparrowthreat actor · 1
- Rocket.Chatproduct · 1
- Node.jsvendor · 1
- Symantecorganization · 1
- C2Looperproduct · 1
- Exchangeproduct · 1
- GateKeepermalware · 1
- Havocmalware · 1
- EtherRATproduct · 1
- Trend Microvendor · 1
- AsukaStealermalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.