Topic
Servers, domains, or channels (web, DNS, MQTT, cloud services) that malware uses to receive commands and exfiltrate data from infected systems.
Infoblox Threat Intel says dropcatch registrations are now close to one in five new domains, and one actor spent over $7 million on 10,000 of them. Clean history is being bought, not earned.
Reality
Black Lotus Labs counted about a dozen compromised enterprises, mostly in Asia and South America, on a framework that has been publishing operator commands to infected hosts through IoT message brokers since 2024.
Perspective Coverage
3 publishersReality
Aikido found the Graphalgo implant inside two Terraform providers and two Go modules. The Go build polls a hard-coded testnet contract every three seconds and keeps a Slack bot channel open as its second route.
Reality
Aikido found the Graphalgo campaign's Go port inside two Terraform providers, one of them a typosquat of kreuzwerker/docker. The payload decrypts only when containerName and networkID hash to a hardcoded SHA256.
Reality
ThreatFabric says the Android trojan hands collected data to nearby infected devices over Wi-Fi Direct or Bluetooth until one can reach command and control.
Reality
Astrolavos Lab counted 27,758 blacklisted and 238,279 malware-resolved domains that expired and were then maliciously re-registered, including an expired APT name.
Reality