Jun 14, 2026
C2 Hosts: 12
VShell
VShell is an OST framework written in Go, enabling availability of implants for multiple platforms (Windows, Linux, macOS).
C2 Infrastructure
Hosting/VPS 87%
ISP/Residential 8%
Business 6%
Last 7 days
Jun 13, 2026
C2 Hosts: 5
Jun 12, 2026
C2 Hosts: 7
Jun 11, 2026
C2 Hosts: 3
Jun 10, 2026
C2 Hosts: 13
Jun 9, 2026
C2 Hosts: 9
Jun 8, 2026
C2 Hosts: 4
| Date | C2 Hosts |
|---|---|
| Jun 14, 2026 | 12 |
| Jun 13, 2026 | 5 |
| Jun 12, 2026 | 7 |
| Jun 11, 2026 | 3 |
| Jun 10, 2026 | 13 |
| Jun 9, 2026 | 9 |
| Jun 8, 2026 | 4 |
Further Reading
China-Nexus Nation State Actors Exploit SAP NetWeaver (CVE-2025-31324) to Target Critical Infrastructures opens in a new tab
EclecticIQ analysts assess with high confidence that, in April 2025, China-nexus nation-state APTs (advanced persistent threat) launched high-temp exploitation campaigns against critical infrastruc...
blog.eclecticiq.com
UNC5174’s evolution in China’s ongoing cyber warfare: From SNOWLIGHT to VShell | Sysdig opens in a new tab
After a year under the radar, the Sysdig Threat Research Team identified a new campaign from Chinese state-sponsored threat actor UNC5174.
sysdig.com
Operation DRAGONCLONE: Chinese Telecom Targeted by VELETRIX & VShell Malware opens in a new tab
Uncover 'Operation DRAGONCLONE,' a sophisticated campaign by a China-nexus threat entity targeting China Mobile Tietong Co., Ltd. This deep dive reveals the use of VELETRIX & VShell malware, DLL si...
seqrite.com
Earth Lamia Develops Custom Arsenal to Target Multiple Industries opens in a new tab
Trend™ Research has been tracking an active APT threat actor named Earth Lamia, targeting multiple industries in Brazil, India and Southeast Asia countries at least since 2023. The threat actor pri...
trendmicro.com