Threat Intel Dossiers | Ahmed Elessaway (xElessaway)

Threat Cluster 182[.]92[.]78[.]7:8888

Webshell-enabled command execution, internal-network discovery through a local SOCKS proxy, database and host reconnaissance, screen and environment collection, dynamic Java payload loading, and tunneling or payload staging.

active

Threat Cluster 217[.]216[.]79[.]49

Exposed staging, C2 and beacon artifact hosting, tunneling or proxy support, credential and system collection, web-facing exploitation testing, and possible post-compromise operator workspace management.

active

Threat Cluster 150[.]241[.]65[.]250

Multi-architecture Linux and IoT malware staging, payload delivery, operator workspace exposure, and possible botnet recruitment.

tracking

Threat Cluster 93[.]152[.]223[.]39

Targeted reconnaissance, access brokerage, and exploitation of public-facing application services to stage persistent Adaptix/Cobalt Strike C2 beacons and harvest credentials.

tracking

Threat Cluster 47[.]109[.]196[.]181

Dual-vector threat staging operation distributing Android accessibility spyware and remote access trojans (harvesting victim screen telemetry, keystrokes, and accessibility events) alongside weaponized Linux local privilege escalation exploits (Dirty COW / efull) and PHP upload webshells.

tracking

Threat Cluster 37[.]49[.]230[.]40

Automated distributed ingress staging and multi-architecture malware delivery designed for Linux server and IoT botnet recruitment, infrastructure expansion, and remote execution.

tracking

Threat Cluster 2[.]27[.]63[.]244

Targeted corporate perimeter infiltration utilizing cloud dead-drop resolvers (GitHub / Google Sheets API), in-memory payload execution, and defensive security telemetry evasion.