Decade-Old Locky-Lineage Loader Rides New Four-Nation C2 Panel Grid
Eight bare-IP servers spread across four unrelated hosting networks in Russia, Estonia and France all serve the identical '/main.php' panel path, tied to a 2016-compiled loader still active in late 2024. No shared certificate, registrar or ASN links the hosts — only the copied panel URI reveals a single deployed C2 codebase.
A command-and-control backbone built from eight bare-IP endpoints spread across four unrelated hosting networks in Russia, Estonia and France — every single one answering on the identical /main.php path — has surfaced attached to a loader that first appeared on file-scanning services back in 2016. The infrastructure is the story here: none of the four autonomous systems recur elsewhere in the indicator set, no certificate or registrar links any of the eight domains that sit behind them, and yet…
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read