New VShell Botnet Command-and-Control Server Identified on Cloud Infrastructure

High-confidence IOC linked to active botnet operations using exposed IP and port

Threat intelligence monitoring has identified a new command-and-control (C2) endpoint associated with the VShell malware family. The infrastructure operates on a public cloud-hosted IP address and listens on a non-standard port, a common tactic used to evade basic network filtering.

The indicator has been classified with high confidence, indicating strong evidence of malicious use.

Technical Details

The identified IOC consists of an IP and port combination actively used for botnet command-and-control activity. Although the underlying infrastructure itself does not appear compromised, threat actors are abusing legitimate cloud resources to host malicious services.

Key technical observations include:

• Use of public cloud hosting to blend with normal traffic
• Non-standard port usage to bypass simple firewall rules
• Association with VShell malware, commonly used for remote access and persistence

About VShell Malware

VShell is a lightweight remote access tool frequently used by attackers after initial compromise. Once deployed, it allows threat actors to:

• Execute remote commands
• Manage infected hosts
• Deploy additional payloads
• Maintain persistent access

Because of its small footprint and flexibility, VShell often appears in targeted intrusions and botnet operations.

Potential Impact

If endpoints communicate with this C2 server, attackers may:

• Issue remote commands to compromised systems
• Exfiltrate sensitive data
• Deploy follow-on malware
• Enlist systems into broader botnet activity

As a result, organizations may face data exposure, service disruption, or reputational damage.

Recommended Defensive Actions

Organizations should take immediate steps to reduce risk:

• Block outbound connections to the identified IP and port
• Review firewall, proxy, and EDR logs for related activity
• Scan endpoints for VShell artifacts and suspicious processes
• Monitor for anomalous outbound network behavior
• Strengthen controls around cloud-based traffic

Early detection significantly reduces the risk of long-term persistence.

Why This Matters

Attackers increasingly rely on cloud-hosted infrastructure to operate command-and-control servers. As a result, botnet traffic can appear legitimate and evade traditional perimeter defenses.

This IOC highlights the importance of threat intelligence-driven monitoring and proactive outbound traffic inspection.