medium
advisory
Jackskid botnet command-and-control infrastructure
ThreatFox has identified 8 new C2 server indicators associated with the Jackskid botnet, a Mirai-based variant utilized for DDoS attacks.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 5, 13:29 UTC
- Detection
- 8 IOCs
- Source quality
- A1Very likely
ThreatFox reported 8 new indicators of compromise for the Jackskid (elf.jackskid) botnet. The indicators consist of IP addresses communicating over port 443, suggesting an attempt to masquerade command-and-control traffic as standard HTTPS. Jackskid is a known variant of the Mirai malware family used primarily for distributed denial-of-service (DDoS) operations.
Recommendation
- Block the identified C2 IP addresses at the perimeter firewall and egress proxy.
- Implement network monitoring to detect outbound connections from internal assets to these specific IP addresses on port 443.
- Review historical logs for any existing connections to the provided IOCs to identify potentially compromised internal endpoints.
Immediate actions
Block the 8 listed C2 IP addresses on all internet-facing firewalls and proxy devices.
SOC
24h
Threat Hunt
Identify outbound connections from internal Linux infrastructure to the listed IP addresses on port 443.
T1071.001
high
high confidence
hunt now
Data: NetFlow logs, Firewall traffic logs
Indicators of compromise
8
ip
| Type | Value |
|---|---|
| ip | 96.62.250.142 |
| ip | 172.233.14.200 |
| ip | 172.233.47.155 |
| ip | 172.233.1.13 |
| ip | 109.110.170.72 |
| ip | 168.144.176.164 |
| ip | 188.166.233.203 |
| ip | 170.64.153.147 |