Botnet C2 tied to an unidentified #malware family trying to hide as FortiGate device 😜 🌐 Domai...

Summary

An unidentified malware family is operating a botnet command and control (C2) infrastructure that attempts to evade detection by masquerading as a legitimate FortiGate device. The C2 domain, az2030port.duckdns.org, is associated with the IP address 178.16.55.28, which is registered to Omegatech LTD in the Netherlands. The SSL certificate used for the C2 connection also impersonates Fortinet Ltd.

Indicators of Compromise

• domain — az2030port.duckdns.org
• ip — 178.16.55.28
• hash_sha256 — f410091216543216543216543216543216543216543216543216543216543216

Entities