Mythic C2 Activity at Internet Scale
Censys tracks 131 hosts exposing Mythic to the public Internet. Learn about the C2 framework and how to defend against it.
Topic
Adversary Infrastructure
49 posts
What the ERMAC Source Leak Says About HookBot
ERMAC and HookBot are two branches of one Android banking trojan sold as a service. They forked from a shared code base and each evolved in the direction its developers took it, but the core they run is close enough that a single constant in the source decides which name the panel shows. […]
DarkSword's Panel Sprawl: How One Body Hash Unravels a Six-Panel, Two-Codebase Operator Cluster
Censys ARC noticed a recent spike in DarkSword hosts and web properties. Here are the IOCs and pivots you need to track the growing threat.
Dynamic IP Blocking with Palo Alto Networks Firewalls and Censys
Learn how to auto-populate Palo Alto Networks EDLs with malicious IPs using Censys Threat Hunting data. Deploy a living block list in under an hour with Python.
Announcing the Threat Hunting MCP Server
Discover the Censys Threat Hunting MCP Server—track adversary infrastructure using natural language AI. Streamline threat detection with conversational, iterative workflows.
Announcing the Investigation Manager: A New Way to Hunt for Adversary Infrastructure
Introducing Investigation Manager: a visual workspace in Censys Threat Hunting Module for tracking adversary infrastructure. Pivot with CensEye, map threats, and streamline investigations.
Using the Censys API for Advanced Threat Hunting
Discover Censys's new value-counts API endpoint for faster adversary infrastructure pivoting. Batch multiple queries in one call—replacing Censeye's limitations with efficient threat hunting.
Internet-scale Proactive Threat Hunting and Detection
Censys Threat Hunting Module is now generally available! Track adversary infrastructure, detect emerging threats, and gain unparalleled Internet intelligence. Explore the new Censys Platform.
Introducing the New Censys Threat Hunting Module: Proactive Defense for Modern Threats
Discover the new Censys Threat Hunting Module — proactively track adversary infrastructure, accelerate investigations, and dismantle threats before they strike. See a demo today!
Tracking AyySSHush: a Newly Discovered ASUS Router Botnet Campaign
Discover AyySSHush, a stealthy ASUS router botnet compromising 4,500+ devices globally. Learn how it abuses firmware features to persist across resets and evade detection.
From Detection to Disruption: Censys Supports Global Government Threat Hunting
Discover how the Censys Threat Hunting Module empowers government teams to detect adversary infrastructure before attacks. Proactive threat intelligence for national security.
Scouting a Threat Actor
Censys uncovers "SCOUT PROJECT," a novel C2 server exploiting CVE-2025-30208, CVE-2025-3248 & CVE-2025-29927. Discover the threat actor's infrastructure, backdoor toolkit, and attack methods.
Speeding up Threat Hunting with Censys
Reduce defender dwell time with Censys Threat Module. Hunt adversary infrastructure faster, enrich threat intel with MITRE & Malpedia, and act before threats mature.
The End of Stale Indicators
Discover how Censys delivers timely, context-rich threat intelligence on adversary infrastructure. Move beyond stale IPs with actionable IOCs, Actor Profiles & more.
Hunting Botnets With CursorAI, GreyNoise, Censys, and Censeye
Discover how Censys uses CursorAI and GreyNoise data to hunt adversary infrastructure like ORB networks. Learn to identify malicious SOCKS proxies in residential networks.
Salt Typhoon Attacks Highlight Need for Advanced Defenses
Chinese Volt Typhoon & Salt Typhoon cyber espionage campaigns expose critical infrastructure weaknesses. Learn how adversary infrastructure threats demand advanced threat hunting.
Lucid Phishing Platform Drives Toll Scam Campaigns
Discover how the Lucid phishing-as-a-service platform powers massive SMS toll scam campaigns using device farms, thousands of domains, and infrastructure traced to China.
Unpacking the BADBOX Botnet with Censys
**Discover how BADBOX botnet infects 190K+ Android devices via supply chain compromise. Learn how Censys tracked C2 infrastructure using SSL certificates and SSH keys.**
Using Censys to Track the Murdoc Botnet Campaign Targeting AVTECH Cameras and Huawei Routers
Murdoc Mirai botnet targets AVTECH cameras & Huawei HG532 routers via known CVEs. See live infection data, C2 servers, and steps to secure exposed devices.
Analysis of Fox Kitten Infrastructure Reveals Unique Host Patterns and Potentially New IOCs
**Discover how Censys analyzed Fox Kitten IOCs from the FBI/CISA advisory, uncovering hidden infrastructure patterns and active threats. Expert research on Iran-based cyber actors.**
Censeye: Gadgets!
Discover Censeye Gadgets – a new plugin system for extending threat intelligence research. Learn how query generator and data labeling gadgets help uncover adversary infrastructure.
Highlights from the New Unleash the Power of Censys Search Handbook
Discover how Censys Search empowers cybersecurity teams with real-time internet intelligence. Download our free guide to track adversary infrastructure and craft powerful queries.
Simplify Threat Investigations: Identify Suspicious Open Directories with Censys Search
Discover suspicious open directories faster with Censys Search's new "suspicious-open-dir" label. Hunt threat actor infrastructure, malware, and C2 servers efficiently.
Stumbling Upon XehookStealer C2 Instances
Discover how Censys Search uncovered XehookStealer's link to Agniane Stealer through C2 fingerprinting, favicon pivoting, and adversary infrastructure analysis.
Back to the Future: How Historical Data Can Enhance Your Cyber Defenses
Discover why historical internet intelligence is essential for threat hunting. Learn how Censys helps security teams track adversary infrastructure, build timelines, and anticipate future cyberattacks.
Boost Your Threat Hunting Skills with These 5 Informative Webinars
Watch 5 on-demand threat hunting webinars featuring Censys Search experts. Learn to track adversary infrastructure, uncover emerging threats, and level up your threat intelligence skills.
7 Resources to Inform Your Next Hunt for Malicious Infrastructure
Discover 7 expert resources for hunting malicious infrastructure using Censys Search. Learn to track C2 networks, phishing sites, and adversary infrastructure with threat intelligence tips.
Continuous Threat Exposure Management (CTEM)
Discover how Continuous Threat Exposure Management (CTEM) transforms threat detection with proactive adversary infrastructure monitoring.
Actionable Threat Intelligence
Discover how actionable threat intelligence reduces cyber risk. Learn about adversary infrastructure, threat detection, and the Censys Platform's role in proactive security.
A Beginner's Guide to Tracking Malware Infrastructure
Learn how to build queries for malware infrastructure hunting. Discover approachable methods to identify threat actor patterns, find IOCs, and track adversary infrastructure using Censys Search.
User Stories: Investigating Cyber Threats with Censys Search
Discover how cybersecurity practitioners use Censys Search to track adversary infrastructure, investigate malware attacks, and fight phishing campaigns. Real user stories inside.
Top Ransomware Attack Vectors: How to Defend Against Them
# SEO Meta Description **Ransomware attacks surged 70% in 2023. Learn top attack vectors, prevention strategies, and how proactive threat intelligence can strengthen your ransomware defense.** *(158 characters)* This meta description works because it: - **Leads with a compelling statistic** (70% surge) to grab attention - **Includes key search terms**: ransomware attacks, attack vectors, prevention strategies, threat intelligence, ransomware defense - **Creates urgency** with the data point about the surge - **Promises actionable value** ("Learn...strategies") - **Stays under 160 characters** for full display in search results
24 Questions to Ask About Your Data in 2024
# SEO-Optimized Meta Description **Option 1 (Best):** Discover 24 critical questions to evaluate your internet intelligence and threat data. Improve adversary infrastructure detection with better internet scan data from Censys Search. **Character count:** 158 **Option 2:** Is your threat intelligence data holding you back? Explore 24 questions to assess your internet intelligence and strengthen your cybersecurity strategy in 2024. **Character count:** 155 --- ## Why This Works: - **Keywords included:** "internet intelligence," "threat intelligence," "adversary infrastructure," "Censys Search," "internet scan data" - **Compelling hook:** The numbered list ("24 questions") creates curiosity and implies actionable, structured content - **Action-oriented language:** "Discover," "Improve," "Evaluate" encourage clicks - **Value proposition clear:** Readers
Working Smarter, Not Harder, with Matched Services
Discover how Censys Search Matched Services helps you quickly identify relevant host services, save time in threat hunting, and streamline your investigations. Unlock faster results!
Stop Predicting. Start Protecting.
The Pitfalls of Predicting Cybersecurity Trends The start of the New Year often brings with it predictions about what’s in store for the year ahead. In cybersecurity, this often means predicting future threats and security trends. However, the fast-paced nature of cyber attacks and increasing sophistication of threat actors means making predictions that are actually […]
Tracking Vidar Infrastructure with Censys
Stealers are trojans that collect credentials, notable files, and tokens from an infected computer and upload the data back to attacker-controlled infrastructure. Today, we will discuss one of the more advanced stealers: Vidar. Vidar is a piece of malware originating from the Arkei Stealer but uses new methods to find and direct traffic to […]
Unleash the Power of Censys Search: Exploring More with Historical Data
Welcome back to Part III of our “Unleash the Power of Censys Search” series! In this series, we take a closer look at different ways Censys Search users can make the most of their engagement with the tool. In Part I, we provided tips for how to get started running queries in Censys Search. In […]
Unleash the Power of Censys Search: A Look at Censys Search in Action
In Part I of our “Unleash the Power of Censys Search” blog series, you read that enterprises, governments, and researchers can access our industry-leading internet intelligence by using the Censys Search tool. (If you haven’t had a chance to check out the blog, give it a read! Within you’ll find tips for how to […]
Unleash the Power of Censys Search: A Quick Guide to Queries
April 2026 Update: Censys has come a long way: an entire platform complete with pivoting, dashboards, rapid response queries by Censys ARC, investigation tools, and MCP support. Access sample queries within the free platform, and happy hunting! Whether you’re brand new to Censys Search and are looking for tips to get started, or are […]
Mission Critical Intelligence: Why This Government Agency Partners with Censys to Understand the Threat Landscape
When ZMap, the world’s first global, open-source internet scanner, was released in 2012, it immediately attracted tens of thousands of users from leading government agencies who conducted critical searches to understand the emerging digital threat landscape. Today, Censys’ proprietary Internet Map is the most comprehensive, up-to-date collection of global internet infrastructure enriched with critical context […]
Revolutionize Network Reconnaissance with AI-Powered CensysGPT: Simplify Queries & Enhance Security
At Censys we pride ourselves on being innovators and encourage creativity, experimentation and collaboration amongst our team. During our 2023 Hackathon, we challenged our engineering team to develop ideas for new solutions that would improve our customer experience and make our product more accessible. Our integrations team rose to the challenge with an exciting […]
4 Cybersecurity Webinars Worth Your Watch
Haven’t had a chance to tune in to some of our recent webinars? Catch up on what you’ve missed with these on-demand recordings! You can stream the recordings at any time from the links below. Profiles in Threat Hunting: Finding Threats by Observing Behaviors Presenters: Censys Senior Security Researcher Emily Austin; Censys Director of Federal […]
Potential Chinese Influence on African IT Infrastructure
Between 10-21 February 2023, Censys discovered over 46,000 commercial devices associated with four U.S. blacklisted Chinese tech manufacturers in Kenya, Zambia, South Africa, and Mauritius. Huawei, ZTE, Hikvision, and Dahua were blacklisted by the U.S. government in November of 2022 and the importation or sale of their equipment was banned in the U.S. […]
Why This European Government Agency Uses Attack Surface Management
Attack surface management (ASM) is becoming an integral, value-add strategy for cybersecurity teams across industries, including those in government. Our own partnerships with government agencies around the world highlight how ASM complements government threat hunting and response efforts. Teams use ASM tools like the Censys Attack Surface Management Platform to gain greater visibility into […]
Follow-up on Russian “Host F”
(As reported in “Russian Ransomware C2 Network Discovered in Censys Data”) Executive summary In late January 2023 Censys analysts reviewed Host F (95.213.145.99), which was previously identified in Censys reporting as a Russia-based, probably malicious host running a Command and Control (C2) ransomware kit with callbacks to an associated Bitcoin wallet. Upon return to the […]
6 Steps Threat Profilers Can Follow to Uncover Ransomware (and Other Nefarious Activity)
Ransomware attacks have dominated headlines in recent years, as attackers take aim at an increasing variety of targets, from school districts to critical infrastructure networks. Ransomware accounted for 25% of all breaches in 2022, according to the Verizon Data Breach Investigations Report, and in early 2022, CISA reported that it had observed incidents of ransomware […]
Fresh Search Query "Recipes" (+ Actual Food Recipes) to Start Your 2023
Running an internet search query can be a lot like cooking a meal. Hang with us here … If you think about it, both cooking and querying rely on stepwise orders of operation – both follow “recipes,” if you will. For example, if you’re looking to uncover hacked web hosts, you’ll follow a series of […]
Why Did a Cybersecurity Company Choose Censys Data Over Competitors?
We know that fresh, accurate, and timely data is the key ingredient to any cybersecurity intel effort. Security teams can have all the tools and manpower in the world, but without access to the right data (the kind of data that also reduces false positives and minimizes noise) security efforts will ultimately fall short. […]
Here's How Citizen Lab Used Censys to Expose a Spyware Vendor
The Challenge: Spyware from Candiru was used to impersonate sites from well-known advocacy organizations to target activists and human rights workers. Citizen Lab, a research institute at the University of Toronto, used Censys data to understand impersonated sites, passing the details forward to Microsoft Threat Intelligence Center (MSTIC) to find exploits. What Citizen Lab achieved […]