Last seven days
- First activity
- Aug 14, 2026
- Last activity
- Aug 14, 2026
- Feed role
- C2
- Host form
- 0 IP / 3 hostnames
C2 tracking
Seven-day C2 activity
Derp observations, rolling seven-day window
3 Aug 14
Observed infrastructure
Leading locations
- FI2
- DE1
Leading providers
- Hetzner Online GmbH2
- Hostinger International Limited1
Infrastructure traits
- Hosting 3
- Anycast 1
Reported operators
Threat actors
1 named in public reportingOur initial analysis of malware disclosed in the BadCyber blog hinted at the involvement of the 'Lazarus' threat actor... The filename srservice.chm is consistent with the method in which a known Lazarus toolkit module constructs CHM and HLP file names... It's worth noting that both parts of the shellcode load the APIs similarly to all other tools from the Lazarus toolset.
MITRE ATT&CK
