Sliver C2 infrastructure discovery

A new Sliver command-and-control (C2) server has been identified at 93.152.221.150 on port 31337. Sliver is a cross-platform adversary emulation and penetration testing framework commonly leveraged by threat actors for beaconing, lateral movement, and modular payload deployment.

Impact

Presence of this indicator suggests active C2 infrastructure capable of executing post-exploitation tasks, maintaining persistence, and facilitating data exfiltration within compromised environments.

Recommendation

• Block inbound and outbound traffic to 93.152.221.150:31337 at the network perimeter.
• Review historical logs for connections to this IP address to identify potential prior compromise.