Upatre C2 Network Hides in Hungarian and Rural US ISP Space
A 74-kilobyte Windows downloader disguised as a scanned business document beacons to a five-node C2 relay anchored in small regional ISPs rather than commercial hosting. Two enriched nodes sit inside a Hungarian broadband provider and a rural Iowa telephone cooperative; three more carry no threat-intelligence coverage at all. The hosting pattern appears designed to evade the reputation-based blocking that most network defenders rely on.
A Five-Node C2 Relay Built on Borrowed Broadband: How an Upatre Campaign Hides in Regional ISP Space
A 74-kilobyte Windows executable disguised as a scanned business document sits at the centre of a command-and-control network that deliberately avoids the commercial hosting fabric most threat-intelligence feeds are tuned to watch. Both enriched relay nodes in this campaign occupy address space belonging to small, non-commercial internet service providers — one a Hungarian broadband operator in Budapest, the other a rural telephone cooperative in the American Midwest — while three additional C2 endpoints in the same campaign carry no VirusTotal coverage whatsoever. The result is a five-node relay architecture that is, for the most part, analytically opaque, and whose hosting posture appears designed to frustrate the reputation-based blocking that defenders most commonly deploy against downloader infrastructure.
CTX Team first logged the campaign on 26 June 2026, categorising it as a c2-servers cluster at severity 100 and confidence 85, associated with the Upatre downloader family. The threat record tags the targeted industry as food and beverages, with a regional focus on Italy, though the social-engineering lure — a fake scanned document — is generic enough to travel well beyond any single vertical.
The Lure: A Scanned Document That Isn't
The campaign's entry point is a spearphishing attachment [T1566.001] whose filename does most of the social-engineering work before the binary ever executes. The file is catalogued under two names: a bare numeric label, 232.exe, and the operationally significant alternate name scan-copy_of_the_transmitted_instructions.exe. The second name is the one that matters. It mimics the kind of subject line a finance clerk, logistics coordinator, or procurement officer in a food-and-beverage company might receive dozens of times a week — a scanned copy of transmitted instructions, the sort of attachment that arrives from a supplier, a freight forwarder, or an internal compliance team. The filename carries no extension warning beyond .exe, which in a Windows environment with default settings hidden would render as scan-copy_of_the_transmitted_instructions — a document, not a program.
The binary is unsigned. There is no code-signing certificate, no publisher name, no trust anchor of any kind that might prompt a cautious user to pause before clicking [T1204.002]. In a threat landscape where signed-binary abuse has become a dominant evasion technique, the absence of a signature here is less a defensive gap than a deliberate operational choice: Upatre stubs have historically been small, fast-burning delivery vehicles where the cost of obtaining and burning a certificate is not justified by the operational tempo. The lure filename alone is expected to carry the social-engineering load.
The binary itself is a 74-kilobyte PE32 GUI executable for Intel 80386, compiled for 32-bit Windows. Its PE compile timestamp reads 2013-09-01 — a date that predates the file's first VirusTotal submission on 2015-07-03 by approximately 22 months. That gap is analytically ambiguous. It may indicate that the operator deliberately backdated the PE timestamp as an evasion or anti-forensics measure [T1027], a technique the Upatre builder ecosystem has been associated with in public reporting. Alternatively, it may reflect a long-lived builder toolchain that was assembled in 2013 and continued producing samples for years afterward. Neither interpretation can be confirmed, and CTX Team treats this as an inference rather than an established fact.
What the static record does confirm is the binary's structural profile. The .text section carries an entropy of 6.62 — elevated enough to be consistent with a packed or obfuscated stub awaiting runtime unpacking [T1027], though not at the extreme values that would indicate heavy cryptographic packing. The .rdata section sits at 5.39 entropy, .data at 5.89, and .rsrc at 5.11 — a distribution that, taken together with the zero resolved imports in static analysis, suggests the binary's functional code is not visible to a static disassembler in its delivered form. The import count of zero is particularly notable: a legitimate 74-kilobyte Windows GUI application would ordinarily resolve at least a handful of Win32 API calls at load time. The absence of any resolved imports is consistent with a stub that resolves its API table dynamically at runtime, a standard Upatre evasion technique.
The build provenance record carries imphash f23f0cbf18b0aec3bcd2c88065919207 and vhash 074046655d5551z16z4nz15fz, along with an ssdeep fuzzy hash of 1536:5OlyN2NMbz5IOk1Im0+XjICsi77movUJJUNXHX092AVxMWp:5Nzx8Im0+cCsiPNXHX092AVq4. These values are recorded but cannot be cross-referenced against peer files in this campaign: the two other SHA256 hashes in the indicator set — 8775c18c18ddb6aef11dfe0ffe1b2732be65ed246104025ac62cf39602f1c89f and 71235327ddcfaf91ad7bed4c8d3ceceac4d488003128b540326dd041a13dcc48 — exist as bare hashes, contributing nothing to cross-file clustering. CTX Team flags the primary sample as file-isolated, sharing no imphash, signer, or threat label with any peer in the set.
Detection Posture: Broad Coverage With Significant Gaps
Thirty-four of 56 antivirus engines flag the primary sample as malicious — a detection ratio that sits in the middle tier for a decade-old downloader family with well-documented signatures. The engines that flag it include a broad cross-section of the major commercial platforms. Notably, no sandbox verdict is available for any file in the campaign, which means the dynamic behaviour of the stub — what it unpacks, what it contacts, what it drops — cannot be confirmed. All behavioural claims about the sample's runtime activity are inferred from family classification and static attributes, not from observed execution.
Twenty-two engines return clean verdicts, and the list of non-flagging platforms includes several that are commonly deployed in enterprise environments across Asia and the former Eastern Bloc: Avast, ClamAV, Comodo, Qihoo-360, Rising, Tencent, Jiangmin, Kingsoft, Bkav, and Baidu-International all return no detection. The practical implication is that organisations relying on any of these engines as their primary endpoint control would receive no alert on execution of this binary. For a campaign apparently targeting Italian food-and-beverage companies — a sector with a significant number of mid-sized manufacturers that may run heterogeneous endpoint environments — the coverage gap is operationally relevant.
The community vote record shows zero harmless and zero malicious votes, and the file's reputation score is neutral at zero. The binary was submitted to VirusTotal on exactly one date — 2015-07-03 — from two unique sources, and has not been resubmitted since. That submission profile is consistent with a sample that circulated briefly in a targeted campaign, was captured by two independent submitters on the same day, and then went quiet. It does not suggest the kind of broad, sustained distribution that would generate ongoing resubmissions.
The C2 Relay: Five Nodes, Two Windows, Three Blind Spots
The most analytically distinctive feature of this campaign is not the downloader itself — Upatre is well-documented and broadly detected — but the infrastructure it beacons to [T1071]. The threat record lists five IP addresses as C2 endpoints. Two of them, 87.229.109.250 and 216.51.193.145, carry VirusTotal enrichment data. The other three — 96.46.103.232, 68.70.242.203, and 66.215.30.118 — appear alongside the two enriched nodes but carry no enrichment data. They are analytically invisible from this vantage point.
That asymmetry matters. The two enriched nodes provide enough signal to characterise the hosting posture, but the three unenriched nodes represent the majority of the relay pool and could differ significantly in their infrastructure profile. A defender blocking only the two known-bad IPs would leave three C2 nodes untouched, and those three nodes carry no reputation signal that would trigger automated blocking.
The Hungarian Node: WLA Interservice, AS33947
The first enriched C2 endpoint, 87.229.109.250, sits inside the address block 87.229.109.0/24, assigned to WLA Interservice Kft. under autonomous system 33947. The WHOIS record, queried on 8 June 2026, describes the block as WLA-BROADBAND-FIX-IP — fixed broadband subscriber space — registered to an address at Kocs u. 7., Budapest 1163, Hungary. The block was created in the RIPE NCC registry on 1 April 2010 and last modified on 11 October 2016. It is maintained under DENINET-MNT, a Hungarian network management handle. The route object for 87.229.109.0/24 was created the same day as the inetnum allocation and has not been updated since.
WLA Interservice is a small Hungarian broadband provider, not a commercial hosting company, not a VPS reseller, and not a bulletproof operator. The allocation profile — a fixed-IP broadband block assigned to a single small ISP, unchanged for nearly a decade — is consistent with subscriber-level address space: the kind of IP range that might contain home routers, small-office gateways, or SMB-grade network equipment. The detection posture for this node is 11 out of 91 engines, a low but non-trivial ratio that confirms the address has been flagged in prior threat intelligence feeds, though the majority of scanning engines still return clean.
The Iowa Node: Aureon/Mediapolis, AS5056
The second enriched C2 endpoint, 216.51.193.145, sits in a sub-allocation of the Aureon Network Services block, specifically the range 216.51.193.128/25 assigned to Mediapolis Telephone — a rural telephone cooperative serving Mediapolis, Iowa. The parent allocation, 216.51.128.0 through 216.51.255.255, belongs to Aureon Network Services under AS5056, registered with ARIN. The WHOIS record was queried on 19 June 2026.
Mediapolis Telephone is a rural local exchange carrier. Its subscriber base is, by definition, a mix of residential customers and small local businesses in a rural Iowa community. This is not infrastructure that appears in commercial threat-intelligence blocklists with any regularity. The detection ratio for 216.51.193.145 is 1 out of 91 engines — the lowest of any indicator in this entire campaign. A single engine flags it as malicious; ninety return clean. CTX Team flags this node as an outlier on two dimensions: it is the only indicator in the set associated with AS5056 (a unique ASN footprint), and its near-zero detection ratio suggests it was either newly activated as a C2 relay at the time of collection or has simply never accumulated enough reputation signal to trigger automated flagging.
What the Hosting Pattern Suggests
The structural similarity between these two nodes is more significant than their geographic separation. Both sit inside small, non-commercial ISP allocations — a Hungarian fixed-broadband block and a rural American telco sub-allocation — that are not the kind of infrastructure a threat actor would provision deliberately through a hosting provider. The pattern is consistent with the inference that these endpoints represent compromised residential or SMB hosts that have been pressed into relay service rather than purpose-built C2 nodes. This is a hosting posture that carries several operational advantages for the operator.
First, small regional ISPs rarely appear on commercial threat-intelligence blocklists. A network defender relying on IP reputation feeds to block outbound connections would not, in the ordinary course, have a rule for 87.229.109.250 or 216.51.193.145 before this campaign was documented. Second, abuse complaints to small ISPs — particularly a rural Hungarian broadband provider and a rural Iowa telephone cooperative — are less likely to result in rapid takedown than complaints to a major cloud provider or a known bulletproof host. Third, routing C2 through bare IPs with no domain layer leaves no certificate or registration trail, eliminating any certificate-serial or registrar-cohort cross-linking. The infrastructure leaves no shared fingerprint beyond the C2 role itself.
The three unenriched IP addresses — 96.46.103.232, 68.70.242.203, and 66.215.30.118 — may follow the same pattern, or they may represent a different tier of the relay architecture. Without enrichment data, network-block records, or WHOIS for these nodes, that question cannot be answered. Their presence alongside the two enriched nodes is the only signal available, and it establishes that the C2 pool is larger than the two visible endpoints suggest.
The Upatre Family: A Downloader With a Long Operational History
Upatre is a Windows downloader family whose primary function is minimal and deliberate: receive execution, unpack, establish an outbound HTTP connection to a C2 node, retrieve a second-stage payload, and execute it. The family has been in active use since at least 2013, which aligns with the PE compile timestamp on this sample, and has historically served as a delivery vehicle for a range of financially motivated second-stage implants. No actor attribution is available for this campaign; no named threat group is linked.
The inference that this campaign is financially motivated rests on Upatre's historical role as a delivery mechanism for banking trojans and credential-stealing implants, but that inference cannot be confirmed from the available evidence. The second-stage payload — whatever the downloader would retrieve from its C2 pool — was not captured, and no sandbox execution is available to observe the retrieval. The full payload delivery chain remains unconfirmed.
What can be said with confidence is that the sample's structural profile is consistent with Upatre's documented characteristics: a small PE32 stub, unsigned, with a low import count, moderate packing entropy, and a document-themed delivery filename. The 34/56 detection ratio reflects the family's age and the breadth of signatures that major AV vendors have developed for it over more than a decade. The 22 engines that miss it — including several platforms with significant deployment in Asia and Eastern Europe — represent the residual evasion surface that keeps the family operationally viable despite its age.
The two other file SHA256s in the campaign (8775c18c18ddb6aef11dfe0ffe1b2732be65ed246104025ac62cf39602f1c89f and 71235327ddcfaf91ad7bed4c8d3ceceac4d488003128b540326dd041a13dcc48) carry no metadata and cannot be analysed. They may represent additional Upatre samples, delivery documents, or second-stage payloads — there is no basis for any of those characterisations. Two of the three files in this campaign are analytically opaque, which means the full scope of the tooling deployed cannot be assessed.
Italy's Food Sector as Target Surface, and What the Infrastructure Posture Signals
The threat record tags this campaign's targeted industry as food and beverages, with a regional focus on Italy. The food-and-beverage sector in Italy encompasses a large population of mid-sized manufacturers, distributors, and exporters — companies that routinely exchange scanned documents, shipping instructions, and procurement orders with counterparties across Europe and beyond. The lure filename scan-copy_of_the_transmitted_instructions.exe maps directly onto that operational context: it is the kind of attachment that would arrive from a logistics partner, a customs broker, or a regulatory body without raising immediate suspicion.
The sector is also one where endpoint security maturity varies considerably. Large Italian food-and-beverage conglomerates may run enterprise-grade EDR platforms, but the sector includes a substantial tail of smaller producers and distributors whose security posture is closer to that of a general SMB. For those organisations, a 34/56 detection ratio on a downloader stub may translate to a meaningful probability of successful execution, particularly if their endpoint platform is among the 22 that currently return clean verdicts.
The broader analytical observation, however, is about the C2 hosting posture rather than the target sector. The operator's decision to route C2 traffic through small regional ISP allocations — a Hungarian broadband provider and a rural American telco — rather than through commercial VPS infrastructure or bulletproof hosting represents a deliberate infrastructure strategy. Whether the endpoints at 87.229.109.250 and 216.51.193.145 are compromised subscriber hosts, misconfigured SMB routers, or something else cannot be determined. But the pattern is consistent with an operator who understands that reputation-based blocking is the most common network-layer defence and has structured the relay pool to avoid the address ranges where that defence is most effective.
The three unenriched nodes — 96.46.103.232, 68.70.242.203, and 66.215.30.118 — extend that picture into territory that is currently invisible to automated detection. A campaign whose C2 pool is majority-unenriched, hosted in non-commercial ISP space, and backed by a downloader that evades roughly 40 percent of scanning engines is not a sophisticated operation by the standards of state-sponsored intrusion sets. But it is a campaign calibrated to operate below the detection threshold of organisations that rely primarily on reputation feeds and signature-based endpoint controls — which describes a significant fraction of the Italian food-and-beverage companies this record suggests are in the crosshairs.
An Incomplete Picture, and What It Means for the Threat Landscape
CTX Team rates the overall evidence pack for this campaign at low confidence, with a score of 33 out of 100. That rating reflects the structural thinness of the evidence: one file with a full dossier, two files with zero metadata, no sandbox verdicts, and three C2 IPs with no enrichment data. No shared imphash values, certificate serials, registrar identities, or YARA rule co-fires bind the indicators into a coherent cluster. The primary sample is file-isolated across every available dimension.
That thinness is itself analytically informative. A campaign that surfaces with this profile — a single enriched sample, bare hashes for the rest, unenriched C2 nodes, no domain infrastructure — is either a very early collection snapshot, a deliberately low-volume targeted operation, or both. The submission record for the primary sample (two unique sources, one date, no resubmissions in the decade since) is consistent with a targeted delivery rather than broad spray-and-pray distribution. If the campaign was sent to a small number of Italian food-and-beverage companies in the summer of 2015, the low submission count would follow naturally.
The PE timestamp question — a compile date of 2013-09-01 against a first submission of 2015-07-03 — adds a further layer of ambiguity. If the timestamp is genuine, it suggests a builder toolchain that was operational for at least 22 months before this particular sample was deployed. If it is manipulated, it suggests an operator with enough technical awareness to backdate PE metadata as a forensic countermeasure. Either reading is consistent with a financially motivated operator running Upatre as a delivery vehicle, but neither can be confirmed without sandbox execution data or additional samples from the same builder.
What the evidence does establish clearly is the infrastructure logic. The two enriched C2 nodes sit in address space that is structurally resistant to the most common forms of network-level blocking: small ISP allocations, stable WHOIS records, no prior bulletproof association, and detection ratios of 11/91 and 1/91 respectively. The three unenriched nodes extend the relay pool into territory with zero prior reputation signal. For a downloader family whose job is simply to make one outbound HTTP request and retrieve a payload, that infrastructure posture is sufficient. The operator does not need a sophisticated hosting fabric — they need endpoints that will pass a reputation check long enough to complete the download. The Hungarian broadband block and the Iowa rural-telco sub-allocation appear to have been selected, or compromised, with exactly that requirement in mind.
The broader implication for the threat landscape is a reminder that infrastructure-based detection has a structural blind spot in non-commercial ISP space. Bulletproof hosting and commercial VPS providers have become well-mapped territory for threat-intelligence feeds; the address space of a small Hungarian broadband operator or a rural Iowa telephone cooperative has not. As long as that asymmetry persists, operators running commodity downloaders like Upatre have a viable path to C2 infrastructure that sits below the automated detection horizon — not because the tooling is sophisticated, but because the hosting geography is overlooked.