May 30, 2026
C2 Hosts: 4
DarkComet
Also known as: Breut, Fynloski, klovbot
DarkComet is one of the most famous RATs, developed by Jean-Pierre Lesueur in 2008. After being used in the Syrian civil war in 2011, Lesuer decided to stop developing the trojan. Indeed, DarkComet is able to enable control over a compromised system through use of a simple graphic user interface. Experts think that this user friendliness is the key of its mass success.
Linked Threat Actors
APT33Lazarus GroupOperation C-Major
C2 Infrastructure
Hosting/VPS 73%
ISP/Residential 20%
Unknown 7%
Last 7 days
May 29, 2026
C2 Hosts: 5
May 28, 2026
C2 Hosts: 7
May 24, 2026
C2 Hosts: 3
May 23, 2026
C2 Hosts: 3
| Date | C2 Hosts |
|---|---|
| May 30, 2026 | 4 |
| May 29, 2026 | 5 |
| May 28, 2026 | 7 |
| May 24, 2026 | 3 |
| May 23, 2026 | 3 |
Further Reading
Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.
Although heavily focused on the Middle East, Elfin (aka APT33) has also targeted a range of organizations in the U.S. including a number of major corporations.
symantec-blogs.broadcom.com
ModifiedElephant APT and a Decade of Fabricating Evidence
A previously unreported threat actor has been targeting civil society for over a decade. Read about how it operates and its relationships to other threats.
sentinelone.com
Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.
Although heavily focused on the Middle East, Elfin (aka APT33) has also targeted a range of organizations in the U.S. including a number of major corporations.
symantec.com
How Cybercriminals Abuse Cloud Tunneling Services | Trend Micro (US)
Our research examines how cloud tunneling services work and how organizations can thwart threats that abuse them.
trendmicro.com