medium
advisory
Remus Botnet: New command and control infrastructure
ThreatFox identified four new URL indicators associated with the Remus malware family used for command and control communication.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 5, 13:39 UTC
- Detection
- 4 IOCs
- Source quality
- B2Likely
ThreatFox has reported four new URLs associated with the Remus malware family, observed on November 4, 2026. These indicators are identified as botnet command and control (C2) servers.
Recommendation
- Block traffic to the listed URLs at the perimeter firewall and web proxy.
- Monitor network logs for outbound connections to the specified hostnames and ports.
- Investigate hosts that have successfully established connections to these C2 endpoints for potential compromise.
Immediate actions
Block the four identified C2 URLs at the network perimeter
SOC
4h
Threat Hunt
Identify endpoints initiating outbound network traffic to the provided domain and port list
T1071.001
high
high confidence
hunt now
Data: Network connection logs, Proxy logs, DNS query logs
Indicators of compromise
4
url
| Type | Value |
|---|---|
| url | http://phetsre.shop:3452/files |
| url | http://fgashub.shop:9932/files |
| url | http://kkgemstone.com:5747 |
| url | http://flreaow.click:6527/teams |