Sequential C2 Panel Paths Expose Seychelles-Registered Bulletproof Hosting Behind Spain Infostealer Campaign
Three new command-and-control IPs tied to a SmokeLoader and Rhadamanthys campaign targeting Spain reveal a dual-cluster hosting arrangement anchored in a Seychelles-registered ASN. Two panel endpoints on Omegatech LTD share an identical path string differing by a single trailing digit, pointing to a single operator running redundant C2 instances from the same builder configuration. The active observation window now extends to at least May 2026.
Three new command-and-control IP addresses have surfaced in the latest observation window of a SmokeLoader and Rhadamanthys infostealer campaign targeting victims in Spain — and the way those addresses were provisioned tells a more precise story than the malware families themselves. Two of the IPs share a single autonomous system number, AS202412, registered to Omegatech LTD, a Seychelles-incorporated entity whose RIPE NCC address block allocations were created within a single month of each…
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read