Unit 42 on X: "2023-02-08 (Wednesday) As follow-up to an #IcedID (#Bokbot) infection, we saw a #CobaltStrike stager hosted at hxxp://167.172.154[.]189/b360802.dll with follow-up Cobalt Strike C2 on 79.132.128[.]191:443 using domain thefirstupd[.]com. IoCs available at https://t.co/zFo4LLfmsh"

Unit 42

@Unit42_Intel

2023-02-08 (Wednesday) As follow-up to an #IcedID (#Bokbot) infection, we saw a #CobaltStrike stager hosted at hxxp://167.172.154[.]189/b360802.dll with follow-up Cobalt Strike C2 on 79.132.128[.]191:443 using domain thefirstupd[.]com. IoCs available at bit.ly/3JTbIKo

3:36 PM · Feb 9, 2023·

17K

Views

45

78

7