Attackers leveraging Dark Utilities "C2aaS" platform in malware campaigns
Summary: Cisco Talos reports that the Dark Utilities command-and-control platform, established in early 2022, offers Windows, Linux and Python payloads plus DDoS and Monero mining modules for 9.99 euros, and had enrolled roughly 3,000 users at the time of writing. The platform is hosted on the clear internet and Tor, uses Discord for user authentication, hosts payloads on IPFS gateways, and Talos attributes it to a persona called inplex-sys who advertised it in the Lapsus$ Group Telegram channel.
Key Takeaway: At 9.99 euros per subscription and about 3,000 enrolled users, the operators have taken in roughly 30,000 euros for a service that hands any buyer a working C2 channel, a DDoS interface and a Monero miner without writing their own malware.
Read the original at Cisco Talos ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026