Pikabot Loader Keeps Its Slack-Mimicking C2 Disguise as Infrastructure Shrinks
CTX Threat Intelligence's latest capture on a Pikabot-family loader shows three Contabo/Cogent-hosted C2 servers still answering on URL paths disguised as Slack Web API calls, unchanged across two observation windows. The update adds only two new URLs while six prior URLs and two IPs have dropped away, pointing to infrastructure pruning rather than a new payload or technique.
Three command-and-control servers tied to a Pikabot-family loader are still answering on URL paths built to look like Slack's own Web API — /api/admin.conversations.getConversationPrefs, /api/apps.permissions.users.request, /api/admin.conversations.ekm.listOriginalConnectedChannelInfo — a naming discipline that has now held across two separate observation windows.
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read