XWorm Campaign Adds Bulletproof C2 Node on Freshly Registered Hosting
A third command-and-control node tied to Freakhosting Ltd — a provider whose RIPE block was allocated in October 2025 — has been added to an active XWorm RAT campaign. The new IP carried only 3 of 91 engine detections at activation, and is paired with a dynamic-DNS hostname that survives IP rotation. The move extends a multi-ASN C2 fabric built around fresh providers, near-zero detection histories, and dynamic hostname layering.
A new command-and-control node anchored to Freakhosting Ltd — a hosting provider whose RIPE block was allocated only on 2025-10-21 and whose organisation was registered as recently as 2026-01-22 — has been added to an ongoing XWorm RAT campaign that CTX Team has been tracking across multiple snapshots. The IP, 143.20.134.59, sits in the 143.20.134.0/24 network on ASN 215703 and carried just 3 of 91 engine detections at the time of analysis, meaning it was effectively invisible to the…
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read