SarlackLabMar 26

live #nanocore #C2 server
167.99.64[.]212:5005

confirmed 2026-03-26

SarlackLabMar 14
live #nanocore #C2 server
192.169.69[.]25:57222
sixershost[.]duckdns[.]org
confirmed 2026-03-14
Show threadKevin Karhan Mar 7

@munin yeah, it's just knowingly installing malware at this point...

https://infosec.space/@kkarhan/116189724585980472

Kevin Karhan :verified: (@[email protected])

@[email protected] personally I consider using #OpenClaw an act of criminal sabotage not dissimilar of #AffiliateMalware like #LockBit and installing #Shitciin - #Mining #malware…

Infosec.Space
Kevin Karhan Feb 27

#NanoCore is still in use?

  • JFC!
Scammers React to Laptop Seizure

YouTube
SarlackLabFeb 20

live #nanocore #C2 server
159.26.100[.]159:59476

confirmed 2026-02-19

SarlackLabFeb 18
live #nanocore #C2 server
45.55.35[.]48:80
isof63umlw[.]loclx[.]io
confirmed 2026-02-18
SarlackLabFeb 18

live #nanocore #C2 server
159.26.100[.]129:53024

confirmed 2026-02-18

SarlackLabFeb 17
live #nanocore #C2 server
192.169.69[.]25:6483
respainc[.]duckdns[.]org
confirmed 2026-02-16
SarlackLabFeb 8

live #nanocore #C2 server
31.13.190[.]234:5812

confirmed 2026-02-08

Kevin Karhan Feb 5

#NanoBaiter still using #NanoCore is so classic...

https://www.youtube.com/watch?v=BDpeQRyNnA8&t=781s

TORTURING Scammers With 10,000 Viruses Live On CCTV!

YouTube