Inside DanaBot's Infrastructure: In Support of Operation Endgame II
Essential information
- Published
- 23/05/2025 18:49
- Modified
- 23/05/2025 19:07
- Tags
- 2025-05-23 banking trojan c2 infrastructure danabot infostealer malware-as-a-service stealth tactics
- Related entities
- 65 observables, 1 intrusion sets (apt), 13 techniques (mitre), 1 malware
Description
DanaBot, a versatile and persistent threat since 2018, has evolved from a banking trojan to a multi-purpose malware platform. It maintained an average of 150 active C2 servers daily, with 1,000 daily victims across 40+ countries. The malware's stealth and multi-tiered architecture contributed to its success. Operated likely from Russia, DanaBot's infrastructure includes Tier 1, Tier 2, and Tier 3 C2 servers. The botnet's size peaked during high-profile events, with Mexico and the US among the most impacted countries. Despite its longevity, only 25% of its C2 servers had detectable malicious signatures. Operation Endgame II, a collaborative effort between security firms and law enforcement, dealt a significant blow to DanaBot's operations.