From 237f2d9330398e0a0628980056db6b09098d5f2f Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 17 Aug 2026 07:45:20 -0400 Subject: feat: update bph iocs --- kevlar/2026-08-17/iocs/c2-paths.txt | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 kevlar/2026-08-17/iocs/c2-paths.txt (limited to 'kevlar/2026-08-17/iocs/c2-paths.txt') diff --git a/kevlar/2026-08-17/iocs/c2-paths.txt b/kevlar/2026-08-17/iocs/c2-paths.txt new file mode 100644 index 0000000..65c2a54 --- /dev/null +++ b/kevlar/2026-08-17/iocs/c2-paths.txt @@ -0,0 +1,11 @@ +/api/client/update?arch=amd64&commit=08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17&os=windows -- SPARK C2 beacon POST, 185.100.87.136 FLOKINET, 1 hit this week +/eventmanager -- SPARK C2 channel, 185.100.87.136 +/ajax -- SPARK C2 polling, 185.100.87.136 +/api/v1/update -- SPARK C2 update check, 185.100.87.136 +/FD873AC4-CF86-4FED-84EC-4BD59C6F17A7 -- SPARK agent UUID path, 185.100.87.136 +/images/transparentpix.gif -- beaconing pixel, 185.100.87.136 +/.env -- env file exfil, 77.83.39.6 KPRONET/PFCLOUD, 25+ hits high-confidence malicious +/.git/HEAD -- git metadata exfil, 77.83.39.94 +/wsman -- WinRM brute POST, 154.93.53.239 KAOPU + 179.43.185.147 PLI +/api/trpc/setup.setup -- tRPC setup probe, 179.43.150.26 PLI +/version -- Docker API probe, 179.43.175.56 PLI -- cgit v1.2.3