Last seven days
- First activity
- Jul 19, 2026
- Last activity
- Jul 21, 2026
- Feed role
- C2 / Distribution
- Host form
- 40 IP / 4 hostnames
C2 tracking
Seven-day C2 activity
Derp observations, rolling seven-day window
5 Jul 19
17 Jul 20
Observed infrastructure
Leading locations
- DE16
- HK8
- US7
- LU5
- NL4
- GB2
- ES1
- TR1
Leading providers
- FEMO IT SOLUTIONS LIMITED9
- Ghosty Networks LLC5
- Omegatech LTD5
- CTG Server Limited4
- Cloudflare, Inc.3
- DigitalOcean, LLC3
Infrastructure traits
- Hosting 44
- Anycast 3
- Vpn 2
- Proxy 1
Samples
Recent associated samples
27dc2e511f4da03bc10b975156996133c8654defc24d40b829ff7d955be4e2ce Observed Jul 21, 2026Triage
2e74827318235a497133219963a2205cd8d7779a195ec67d740d825599210932 Observed Jul 21, 2026Triage
5594d4a2153e25d5de0de21bc958e1d11a341679ea2fec2123567fa3547c7847 Observed Jul 21, 2026Triage
7ef34bf0c59089432586e8847b5a8d7439a28ed3aca3254fab49ef13723be65e Observed Jul 21, 2026Triage
c4617e465670873ca7de2d8898e8c349d8189b86561fc5b8996c4d8bab251801 Observed Jul 21, 2026Triage
22043550f41ba8a519b216a45469c176430c47090ab8617b9a2c17cf0a8233bb Observed Jul 21, 2026Triage
221ab9f4e7d907a996b1f7d247c8322129ab579a48b7d203f66928d6592982d8 Observed Jul 21, 2026Triage
4e5cc8cb98584335400d00f0a0803c3e0202761f3fbe50bcab3858a80df255e1 Observed Jul 21, 2026Triage
65ba3988d38f83b9ee1f31cafa5bd37dc6b72279f5618aac94d71a904efa0cac Observed Jul 21, 2026Triage
6f2efd9f2e0bb0ead617431f562cc0762ea3d7e9a1cbef0f5d8a1a8817ea305d Observed Jul 21, 2026Triage
MITRE ATT&CK
SVCStealer in ATT&CK
11 distinct techniquesTechniques
11 techniquesReporting
Research mentioning SVCStealer
Jun 24
Ibm
StealC you later: Proofpoint and IBM X-Force support Operation Endgame disruptions | IBM
Here is a non-exhaustive list of the malware families we observed being delivered as payloads: ... • SVCStealer ...
Jun 23
Proofpoint
StealC You Later: Proofpoint and IBM X-Force Support Operation Endgame Disruptions | Proofpoint US
Here is a non-exhaustive list of the malware families we observed being delivered as payloads: ... StealC ... SVCStealer TinyNuke Vidar XMRig XTinyLoader zgRAT
Jun 3
Rexorvc0
Diamotrix | RexorVc0
Diamotrix has been observed in campaigns alongside various stealers and loaders, sharing infrastructure and infection chains with malware such as SVCStealer, Lumma, and Rhadamanthys.
