Last seven days
- First activity
- Aug 12, 2026
- Last activity
- Aug 12, 2026
- Feed role
- C2
- Host form
- 2 IP / 0 hostnames
C2 tracking
Seven-day C2 activity
Derp observations, rolling seven-day window
2 Aug 12
Observed infrastructure
Leading locations
- DE1
- FR1
Leading providers
- Contabo GmbH1
- Google LLC1
Infrastructure traits
- Hosting 2
Samples
Recent associated samples
Reported operators
Threat actors
2 named in public reportingExploited software
Vulnerabilities linked to Alien
5 CVEs CVE-2021-38003 V8 TheHole exception-handling bug leading to Chrome renderer RCE CVE-2021-38000 Insufficient validation of untrusted input in Chrome for Android Intents CVE-2021-37973 Use-after-free in Google Chrome Portals sandbox escape CVE-2021-1048 Use-After-Free in Android Kernel eventpoll CVE-2021-37976 Information leak in Google Chrome memory_instrumentation
MITRE ATT&CK
Alien in ATT&CK
28 distinct techniquesTechniques
28 techniques T1505.003 Web Shell T1033 System Owner/User Discovery T1620 Reflective Code Loading T1059 Command and Scripting Interpreter T1057 Process Discovery T1090 Proxy T1090.001 Internal Proxy T1078 Valid Accounts T1021 Remote Services T1027 Obfuscated Files or Information T1021.004 SSH T1190 Exploit Public-Facing Application T1570 Lateral Tool Transfer T1555 Credentials from Password Stores T1132 Data Encoding T1105 Ingress Tool Transfer T1203 Exploitation for Client Execution T1059.006 Python T1649 Steal or Forge Authentication Certificates T1123 Audio Capture T1083 File and Directory Discovery T1548 Abuse Elevation Control Mechanism T1068 Exploitation for Privilege Escalation T1005 Data from Local System T1055 Process Injection T1564 Hide Artifacts T1082 System Information Discovery T1574.006 Dynamic Linker Hijacking
