Derp.ca
Malware family

Berbew

Profile source: Mallory opens in a new tab

C2 tracking

Seven-day C2 activity

Derp observations, rolling seven-day window

Observed infrastructure

Last seven days

First activity
Jul 17, 2026
Last activity
Jul 17, 2026
Feed role
C2
Host form
0 IP / 23 hostnames

Leading locations

  • RU8
  • US4
  • CA1
  • DE1
  • NL1

Leading providers

  • Domain names registrar REG.RU, Ltd3
  • Cloudflare, Inc.2
  • Akamai Connected Cloud1
  • Beget LLC1
  • Google LLC1
  • JSC Mediasoft ekspert1

Infrastructure traits

  • Hosting 15
  • Anycast 2
  • Vpn 2
  • Proxy 1

Samples

Recent associated samples

3b54652058563a247c8879258edc4aad752f366ec7b46aa7937e98911b1987cf
Observed Jul 17, 2026Triage
45a21d6a4827c8c15f56a83df73613724ceceec280bc0243785ea7fc63acff12
Observed Jul 17, 2026Triage
4f4d94edf1c744fc10a1d92baa4a2519ccae509b6c457c6c677e59fecb142736
Observed Jul 17, 2026Triage
9a0be507d8471efa4a80838bd688377d466daf6b955ced9dd7f7fe2c779d4071
Observed Jul 17, 2026Triage
da3db9418f4d23480dc83aca3587539a68380f3fc9e5cd86671b9d9cd24b008c
Observed Jul 17, 2026Triage

Exploited software

Vulnerabilities linked to Berbew

1 CVEs
CVE-2004-0549 Internet Explorer redirected frame security zone validation vulnerability

MITRE ATT&CK

Berbew in ATT&CK

5 distinct techniques

Reporting

Research mentioning Berbew

Jun 9
Cert Cc Product Advisories

Microsoft Internet Explorer does not properly validate source of redirected frame

Functional exploit code is publicly available, and there are reports of incidents involving this vulnerability (Scob, Download.Ject, Toofeer, Berbew).

We appreciate you

Derp wouldn't exist without the work these projects do for the security community. We rely on their data sources to improve the quality and depth of what we publish. Thank you, we're genuinely grateful.

adam:ONE opens in new tab Tria.ge opens in new tab IPinfo opens in new tab urlscan.io opens in new tab eCrime.ch opens in new tab Mallory opens in new tab