SeroRAT command and control infrastructure

ThreatFox has reported a new infrastructure indicator associated with the SeroRAT remote access trojan. The identified indicator is an IP address and port combination (143.20.134.177:224) acting as a botnet command-and-control (C2) node.

Impact

Successful communication with this infrastructure may indicate a compromised host actively communicating with SeroRAT controllers, potentially facilitating unauthorized remote access, data exfiltration, or secondary payload delivery.

Recommendation

• Block the IP address 143.20.134.177 on perimeter network devices and egress firewalls.
• Review historical firewall and proxy logs for any communication with the identified IP address.
• If matches are found, initiate incident response procedures to isolate the affected host and perform memory forensics to identify the SeroRAT persistence mechanism.