Malware family

Guerrilla

Profile source: Mallory

C2 tracking

Seven-day C2 activity

Derp observations, rolling seven-day window

1

Jul 19

Observed infrastructure

Last seven days

First activity: Jul 19, 2026
Last activity: Jul 19, 2026
Feed role: C2
Host form: 0 IP / 1 hostnames

Leading locations

SG1

Leading providers

Alibaba (US) Technology Co., Ltd.1

Infrastructure traits

Hosting 1

Samples

Recent associated samples

8514265546d0df203b0dbf8b6b68d3b699fe6efe2d671638daee94de07b0816b

Observed Jul 19, 2026Triage

Reported operators

Threat actors

1 named in public reporting

Last year, the Lemon Group was found to be engaged in ad fraud — 50 different brands of Android devices were infected with the Guerrilla Trojan.

MITRE ATT&CK

Guerrilla in ATT&CK

1 distinct techniques

Techniques

1 technique

T1542 Pre-OS Boot

We appreciate you

Derp wouldn't exist without the work these projects do for the security community. We rely on their data sources to improve the quality and depth of what we publish. Thank you, we're genuinely grateful.

adam:ONE Tria.ge IPinfo urlscan.io eCrime.ch Mallory