{
  "name": "Inside DanaBot's Infrastructure: In Support of Operation Endgame II",
  "slug": "inside-danabots-infrastructure-in-support-of-operation-endgame-ii",
  "description": "DanaBot, a versatile and persistent threat since 2018, has evolved from a banking trojan to a multi-purpose malware platform. It maintained an average of 150 active C2 servers daily, with 1,000 daily victims across 40+ countries. The malware's stealth and multi-tiered architecture contributed to its success. Operated likely from Russia, DanaBot's infrastructure includes Tier 1, Tier 2, and Tier 3 C2 servers. The botnet's size peaked during high-profile events, with Mexico and the US among the most impacted countries. Despite its longevity, only 25% of its C2 servers had detectable malicious signatures. Operation Endgame II, a collaborative effort between security firms and law enforcement, dealt a significant blow to DanaBot's operations.",
  "published": "2025-05-23T16:49:25+00:00",
  "created_at": "2025-05-23T16:49:25+00:00",
  "modified_at": "2025-05-23T17:07:33+00:00",
  "created_at_opencti": "2025-05-23T16:49:25+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-05-23",
    "banking trojan",
    "c2 infrastructure",
    "danabot",
    "infostealer",
    "malware-as-a-service",
    "stealth tactics"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "98.159.108.138"
      },
      {
        "id": "",
        "name": "98.159.108.137"
      },
      {
        "id": "",
        "name": "95.217.65.166"
      },
      {
        "id": "",
        "name": "94.232.249.215"
      },
      {
        "id": "",
        "name": "94.131.115.254"
      },
      {
        "id": "",
        "name": "94.131.109.182"
      },
      {
        "id": "",
        "name": "92.246.136.182"
      },
      {
        "id": "",
        "name": "91.242.163.44"
      },
      {
        "id": "",
        "name": "91.242.163.37"
      },
      {
        "id": "",
        "name": "91.242.163.235"
      },
      {
        "id": "",
        "name": "89.23.105.6"
      },
      {
        "id": "",
        "name": "89.116.64.46"
      },
      {
        "id": "",
        "name": "86.54.42.5"
      },
      {
        "id": "",
        "name": "85.209.153.112"
      },
      {
        "id": "",
        "name": "82.24.200.28"
      },
      {
        "id": "",
        "name": "85.209.134.250"
      },
      {
        "id": "",
        "name": "77.73.129.134"
      },
      {
        "id": "",
        "name": "81.19.137.119"
      },
      {
        "id": "",
        "name": "77.238.249.183"
      },
      {
        "id": "",
        "name": "5.34.179.197"
      },
      {
        "id": "",
        "name": "5.34.179.193"
      },
      {
        "id": "",
        "name": "47.254.81.3"
      },
      {
        "id": "",
        "name": "47.254.159.244"
      },
      {
        "id": "",
        "name": "47.253.151.139"
      },
      {
        "id": "",
        "name": "45.61.136.204"
      },
      {
        "id": "",
        "name": "45.61.136.240"
      },
      {
        "id": "",
        "name": "45.61.136.125"
      },
      {
        "id": "",
        "name": "45.137.116.57"
      },
      {
        "id": "",
        "name": "31.192.232.25"
      },
      {
        "id": "",
        "name": "45.134.174.235"
      },
      {
        "id": "",
        "name": "23.137.105.90"
      },
      {
        "id": "",
        "name": "23.137.105.251"
      },
      {
        "id": "",
        "name": "23.137.105.250"
      },
      {
        "id": "",
        "name": "23.137.105.249"
      },
      {
        "id": "",
        "name": "207.2.121.127"
      },
      {
        "id": "",
        "name": "196.251.116.36"
      },
      {
        "id": "",
        "name": "195.123.233.68"
      },
      {
        "id": "",
        "name": "194.116.216.91"
      },
      {
        "id": "",
        "name": "193.233.232.101"
      },
      {
        "id": "",
        "name": "185.245.106.72"
      },
      {
        "id": "",
        "name": "185.224.0.250"
      },
      {
        "id": "",
        "name": "185.196.9.52"
      },
      {
        "id": "",
        "name": "185.121.235.211"
      },
      {
        "id": "",
        "name": "185.177.59.56"
      },
      {
        "id": "",
        "name": "179.43.176.43"
      },
      {
        "id": "",
        "name": "179.43.176.42"
      },
      {
        "id": "",
        "name": "178.156.170.132"
      },
      {
        "id": "",
        "name": "162.33.179.34"
      },
      {
        "id": "",
        "name": "157.180.65.252"
      },
      {
        "id": "",
        "name": "157.180.74.97"
      },
      {
        "id": "",
        "name": "144.172.100.208"
      },
      {
        "id": "",
        "name": "156.253.227.5"
      },
      {
        "id": "",
        "name": "139.60.163.90"
      },
      {
        "id": "",
        "name": "135.181.242.179"
      },
      {
        "id": "",
        "name": "107.173.160.166"
      },
      {
        "id": "",
        "name": "135.181.170.163"
      },
      {
        "id": "",
        "name": "5.149.255.208"
      },
      {
        "id": "",
        "name": "46.105.141.51"
      },
      {
        "id": "",
        "name": "45.145.7.97"
      },
      {
        "id": "",
        "name": "23.137.105.248"
      },
      {
        "id": "",
        "name": "199.119.138.187"
      },
      {
        "id": "",
        "name": "185.196.10.20"
      },
      {
        "id": "",
        "name": "185.223.93.118"
      },
      {
        "id": "",
        "name": "179.43.176.41"
      },
      {
        "id": "",
        "name": "172.86.75.229"
      }
    ],
    "malware": [
      {
        "id": "4963ee98-a131-4e18-b64b-e10b62974283",
        "name": "Danabot",
        "slug": "danabot"
      }
    ],
    "intrusion_sets": [
      {
        "id": "bb16c249-f419-4c77-aa8c-0f23e9234b7e",
        "name": "Danabot",
        "slug": "danabot"
      }
    ],
    "attack_patterns": [
      {
        "id": "ee82762a-2958-4901-aade-341277d9b410",
        "name": "T1078.004"
      },
      {
        "id": "16e4fc82-7c0b-4d1a-b784-b804b4df26dc",
        "name": "T1204.001"
      },
      {
        "id": "52b92395-d3d3-4e05-976a-0fccccfce8d2",
        "name": "T1566.002"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "a72ebeae-8e62-4039-8135-e9c611011fdc",
        "name": "T1573"
      },
      {
        "id": "dc410646-9cdd-427b-92e7-179a54f78f90",
        "name": "T1566.001"
      },
      {
        "id": "dc342445-1b78-48b4-aa06-89ed2ad7c28e",
        "name": "T1071"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "d9b45b3b-d093-4016-89e9-48f31ff4d05d",
        "name": "T1566"
      },
      {
        "id": "6c8f8a40-2746-4a37-86bd-81e82afa6e62",
        "name": "T1190"
      },
      {
        "id": "b9eab970-53dd-4977-9a26-c4fe566e422d",
        "name": "T1133"
      },
      {
        "id": "9f11a241-9abc-4c57-95dd-33955ab08826",
        "name": "T1078"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ]
  },
  "external_refs": [
    "https://raw.githubusercontent.com/blacklotuslabs/IOCs/refs/heads/main/DanaBot_IOCs_txt",
    "https://www.team-cymru.com/post/inside-danabots-infrastructure-in-support-of-operation-endgame-ii",
    "https://otx.alienvault.com/pulse/6830c33591b2e16fa30806c3"
  ]
}