Skip to content
Threat Feed
Subscribe
high advisory

DeimosC2 Command and Control Infrastructure

ThreatFox has identified two new command-and-control infrastructure nodes associated with the DeimosC2 framework categorized as botnet controllers.

Triage facts

Revision 1
Evidence
Unknown
Severity
High
Action
Elevated
Sources
2 public sources
Freshness
Revision 1Nov 5, 13:37 UTC
Detection
2 IOCs
Source quality
A1Likely

Abuse.ch has reported two new IP addresses acting as command-and-control (C2) nodes for the DeimosC2 framework. The infrastructure is tagged with 'Deimos' and 'drb-ra' and was first observed on 2026-11-04.

Recommendation

  • Block traffic to the listed IP addresses at the perimeter firewall and egress proxy.
  • Initiate hunting for network connections to these IPs using existing flow logs or firewall telemetry.

Immediate actions

Block C2 IPs at firewall and proxy

SOC 4h

Threat Hunt

Network connections to known DeimosC2 IP addresses

T1071 high high confidence hunt now

Data: Firewall/Proxy logs

Indicators of compromise

2

ip

TypeValue
ip46.4.120.252
ip46.4.120.244