Deimosc2 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/deimosc2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 13:37:11 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDeimosC2 Command and Control Infrastructurehttps://feed.craftedsignal.io/briefs/2026-11-deimosc2-infrastructure/Thu, 05 Nov 2026 13:37:11 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-deimosc2-infrastructure/ThreatFox has identified two new command-and-control infrastructure nodes associated with the DeimosC2 framework categorized as botnet controllers.Abuse.ch has reported two new IP addresses acting as command-and-control (C2) nodes for the DeimosC2 framework. The infrastructure is tagged with 'Deimos' and 'drb-ra' and was first observed on 2026-11-04.

Recommendation

  • Block traffic to the listed IP addresses at the perimeter firewall and egress proxy.
  • Initiate hunting for network connections to these IPs using existing flow logs or firewall telemetry.
]]>highadvisorydeimosc2c2botnetnetwork-security