#StagedC2 config observed at Tue Mar 17 21:34:07 2026 UTC, located at hXXps://pastebin[.]com/raw/X532sHuv C2: theo[.]hidencloud[.]com:25249 (IP: 20.5.41.14)

#StagedC2 config observed at Tue Mar 17 17:52:10 2026 UTC, located at hXXps://pastebin[.]com/raw/nPN6AbAm C2: san3279-48044[.]portmap[.]host:48044 (IP: 193.161.193.99)

#StagedC2 config observed at Tue Mar 17 17:00:29 2026 UTC, located at hXXps://pastebin[.]com/raw/nMvYMcEw C2: 27[.]tcp[.]cpolar[.]top:13230 (IP: 8.162.0.105)

#StagedC2 config observed at Tue Mar 17 17:04:03 2026 UTC, located at hXXps://pastebin[.]com/raw/YQWFfr3D C2: 209[.]25[.]140[.]20:9082

#StagedC2 config observed at Tue Mar 17 16:43:07 2026 UTC, located at hXXps://pastebin[.]com/raw/JLL0AeCC C2: 154[.]215[.]14[.]95:5442

#ZHacker13ReverseTCPShell SHA256: e805679defc2370c59739223acbd4cea1d75212c649cffbf6ed4a4b4640955d3 C2: 172[.]22[.]82[.]53:4444

#StagedC2 config observed at Tue Mar 17 10:40:22 2026 UTC, located at hXXps://pastebin[.]com/raw/4rYwymuS C2: portmap425262-45266[.]portmap[.]host:45266 (IP: 193.161.193.99)

#StagedC2 config observed at Tue Mar 17 03:10:03 2026 UTC, located at hXXps://pastebin[.]com/raw/YfMDKanh C2: 5[.]tcp[.]eu[.]ngrok[.]io:15104 (IP: 3.64.4.198)

#StagedC2 config observed at Tue Mar 17 01:34:10 2026 UTC, located at hXXps://pastebin[.]com/raw/5ETR2xcB C2: ip[.]onlinevbs[.]dpdns[.]org:3000 (IP: 139.59.10.225)

#StagedC2 config observed at Mon Mar 16 23:18:04 2026 UTC, located at hXXps://pastebin[.]com/raw/k5uKrPqs C2: apolito200-51026[.]portmap[.]host:51026 (IP: 193.161.193.99)