𝙽𝙴𝚃𝚁𝙴𝚂𝙴𝙲 on Mythryl: “New #AtlasRAT loader checks in with "BFuck" and the C2 protocol…”

New #AtlasRAT loader checks in with "BFuck" and the C2 protocol switched to using TLS 📡 23.226.57.50:443 📡 38.76.177.46:443 📡 43.99.101.175:443 📡 45.142.152.180:443 📡 116.204.169.70:443 📡 150.158.50.175:443 📡 156.234.7.48:443 📡 192.252.180.45:443 netresec.com?b=26A6cc8

netresec.comDetecting AtlasRAT C2Around May 2026 Atlas RAT began using a new variant of its command-and-control (C2) protocol. Earlier versions started with a distinctive byte sequence: 53 46 75 63 6b 00 00 00 In ASCII, that is SFuck...

12/10/26, 2:52 pm1 repost2 likes

Post