MalwarePublished 23 May 2025Updated 22 Jun 2025

Inside DanaBot's Infrastructure: In Support of Operation Endgame II

Source AlienVault OTX General

Description

DanaBot, a versatile and persistent threat since 2018, has evolved from a banking trojan to a multi-purpose malware platform. It maintained an average of 150 active C2 servers daily, with 1,000 daily victims across 40+ countries. The malware's stealth and multi-tiered architecture contributed to its success. Operated likely from Russia, DanaBot's infrastructure includes Tier 1, Tier 2, and Tier 3 C2 servers. The botnet's size peaked during high-profile events, with Mexico and the US among the most impacted countries. Despite its longevity, only 25% of its C2 servers had detectable malicious signatures. Operation Endgame II, a collaborative effort between security firms and law enforcement, dealt a significant blow to DanaBot's operations.

Impact

For European organizations, DanaBot poses a significant risk primarily through its capabilities as an infostealer and banking trojan. The malware’s ability to stealthily infiltrate networks and maintain persistence can lead to substantial data breaches, financial theft, and operational disruption. Given its modular nature, DanaBot can be tailored to target specific industries or organizations, potentially compromising sensitive financial data, intellectual property, or personal information. The multi-tiered C2 infrastructure complicates takedown efforts and allows the malware to maintain control even if some servers are neutralized. European financial institutions, critical infrastructure providers, and enterprises with international operations are particularly at risk. The malware’s use of phishing and exploitation of valid credentials increases the likelihood of successful initial compromise, especially in environments with insufficient user awareness or weak credential management. The stealth tactics employed reduce the chances of early detection, potentially allowing prolonged unauthorized access and data exfiltration. Additionally, the geopolitical context, including tensions involving Russia, may increase the likelihood of targeted attacks against European entities perceived as strategic or high-value targets.

Defensive guidance

1. Implement advanced email filtering and phishing detection solutions to reduce the risk of initial infection via spear-phishing campaigns (T1566.001, T1566.002). 2. Enforce strict credential hygiene policies, including multi-factor authentication (MFA) for all remote and privileged access to mitigate risks from credential theft and reuse (T1078, T1078.004). 3. Deploy network segmentation and strict access controls to limit lateral movement within networks, particularly focusing on restricting SMB and remote desktop protocol (RDP) usage (T1021.005). 4. Utilize endpoint detection and response (EDR) tools capable of identifying stealthy malware behaviors, such as unusual process injections, command-line execution patterns (T1059), and anomalous network traffic to known or suspected C2 servers (T1071, T1090). 5. Regularly update and audit firewall and intrusion detection/prevention systems (IDS/IPS) to detect and block communications with known DanaBot C2 infrastructure, leveraging threat intelligence feeds including the provided IOCs. 6. Conduct continuous user training focused on recognizing social engineering and phishing attempts, emphasizing the risks of executing unsolicited attachments or links (T1204). 7. Establish incident response plans that include rapid containment and eradication procedures for malware infections, with particular attention to multi-tiered C2 infrastructures. 8. Collaborate with national cybersecurity agencies and industry information sharing groups to stay informed on emerging DanaBot activity and participate in coordinated defense efforts.

Indicators of compromise

IP addresses 65

172.86.75.229
179.43.176.41
185.223.93.118
185.196.10.20
199.119.138.187
23.137.105.248
45.145.7.97
46.105.141.51
5.149.255.208
107.173.160.166

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 22 Jun 2025, 19:35 UTC

MITRE ATT&CK techniques20 from threat tags

Technical details

Indicators of compromise

IP addresses 65

Community reviews

Related threats