Derp.ca
Malware family

Berbew

Profile source: Mallory opens in a new tab

C2 tracking

Seven-day C2 activity

Derp observations, rolling seven-day window

Observed infrastructure

Last seven days

First activity
Jul 20, 2026
Last activity
Jul 20, 2026
Feed role
C2
Host form
0 IP / 23 hostnames

Leading locations

  • RU8
  • US4
  • CA1
  • DE1
  • NL1

Leading providers

  • Domain names registrar REG.RU, Ltd3
  • Cloudflare, Inc.2
  • Akamai Connected Cloud1
  • Beget LLC1
  • Google LLC1
  • JSC Mediasoft ekspert1

Infrastructure traits

  • Hosting 15
  • Anycast 2
  • Vpn 2
  • Proxy 1

Samples

Recent associated samples

a4f21753ee1065a46de79e78c1e05891222431826600f84da24441ebdb399742
Observed Jul 20, 2026Triage
a750577d921abd3deacce46604210317522934b8c895bf8764772e6b5f33483c
Observed Jul 20, 2026Triage
e1ed1238d5e156021e518a2d42cdfa554ef1055f6c26084a2ebc8f33b57dee5c
Observed Jul 20, 2026Triage
e40dddd597fa9288eb9553bfd031ba709eaf267eb8d752c14b525b803702b5da
Observed Jul 20, 2026Triage
eef24a13561ce92da2215b4aa39006991196c498a66e2bba797df225cd5a1358
Observed Jul 20, 2026Triage

Exploited software

Vulnerabilities linked to Berbew

1 CVEs
CVE-2004-0549 Internet Explorer redirected frame security zone validation vulnerability

MITRE ATT&CK

Berbew in ATT&CK

5 distinct techniques

Reporting

Research mentioning Berbew

Jun 9
Cert Cc Product Advisories

Microsoft Internet Explorer does not properly validate source of redirected frame

Functional exploit code is publicly available, and there are reports of incidents involving this vulnerability (Scob, Download.Ject, Toofeer, Berbew).

We appreciate you

Derp wouldn't exist without the work these projects do for the security community. We rely on their data sources to improve the quality and depth of what we publish. Thank you, we're genuinely grateful.

adam:ONE opens in new tab Tria.ge opens in new tab IPinfo opens in new tab urlscan.io opens in new tab eCrime.ch opens in new tab Mallory opens in new tab