# DNS Pivoting Reveals Shared Infrastructure Across LokiBot, Bagle, Xworm, and Remcos Campaigns

> Embee Research used passive DNS pivoting via Validin to trace and cluster active C2 infrastructure for LokiBot (sempersim[.]su), a Bagle-worm-linked lookalike-domain cluster impersonating iCloud, and Xworm/Remcos infrastructure discovered through duckdns dynamic-DNS domains and CIDR-range expansion (194.147.140.0/24, ~464 duckdns domains). The analysis surfaces possible infrastructure sharing between LokiBot and Bagle operators and documents threat actors' heavy reliance on dynamic DNS and rapid infrastructure rotation for C2 resilience.

- **Published:** 2026-07-18T00:00:00Z
- **Last reviewed:** 2026-07-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1485
- **ID:** TL-2026-1485
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In a March 2024 research report, Embee Research demonstrated three case studies of passive-DNS-driven infrastructure hunting using the Validin platform, corroborated with VirusTotal and ThreatFox. The first case study pivots on the LokiBot C2 domain sempersim[.]su and associated IP history to identify additional LokiBot infrastructure and confirm activity via VirusTotal detections. The second case study examines a cluster of lookalike domains impersonating iCloud (lcloud.com[.]de, lcloud.com[.]se, www.icloud-find-online[.]me) that resolve to shared IP space also linked to Bagle-worm-associated infrastructure, suggesting the same bulletproof-hosting or infrastructure-broker relationships are reused across malware families that are otherwise unrelated in lineage (a banking/credential-stealer trojan vs. a legacy mass-mailing worm/Trojan-proxy family). The third case study pivots on dynamic DNS: two duckdns.org subdomains (marxrwo9090.duckdns[.]org and febxworm39090.duckdns[.]org) tied to Xworm activity, and elastolut.duckdns[.]org tied to Remcos RAT C2 (11 VirusTotal detections), which the analysts expand via reverse-IP and CIDR-range queries against 194.147.140.0/24 to enumerate roughly 464 additional duckdns-hosted domains registered by the same or affiliated operators. IP pivots (104.237.252.28, 194.295.220.41, 194.147.140.138) show short-lived resolution windows consistent with rapid infrastructure rotation, and the report notes adoption of Cloudflare-fronting as of 2024-03-19 to mask origin infrastructure. Collectively the report is a methodology showcase for hunting malware C2 via passive DNS/certificate pivoting (Validin), reverse-IP clustering, dynamic-DNS abuse detection, and CIDR-range expansion, applied against three live and currently-tracked malware families: LokiBot (credential/banking stealer, MITRE S0447), Xworm (modular .NET RAT with ransomware and DDoS plugins), and Remcos (commercial-turned-criminal RAT with keylogging/webcam/audio surveillance and COM-based UAC bypass persistence). The Bagle worm reference is historical/lineage context: Bagle (aka Beagle/Mitglieder, first observed January 2004) was a mass-mailing worm that dropped Trojan-proxy components and built spam-relay botnets; its continued relevance here is limited to infrastructure/hosting overlap with the iCloud-lookalike cluster rather than active 2024 Bagle-worm code execution.

## MITRE ATT&CK

- T1589.002 Email Addresses
- T1583.001 Domains
- T1583.004 Server
- T1585.001 Social Media Accounts
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.005 Visual Basic
- T1106 Native API
- T1053.005 Scheduled Task
- T1543.003 Windows Service
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1548.002 Bypass User Account Control
- T1055.001 Dynamic-link Library Injection
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1027.002 Software Packing
- T1564.001 Hidden Files and Directories
- T1070.004 File Deletion
- T1112 Modify Registry
- T1036 Masquerading
- T1055.012 Process Hollowing
- T1620 Reflective Code Loading
- T1497.003 Time Based Checks
- T1218.011 Rundll32
- T1555 Credentials from Password Stores
- T1555.003 Credentials from Web Browsers
- T1003 OS Credential Dumping
- T1083 File and Directory Discovery
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1033 System Owner/User Discovery
- T1056.001 Keylogging
- T1113 Screen Capture
- T1123 Audio Capture
- T1125 Video Capture
- T1119 Automated Collection

## Sources

- [Infrastructure Analysis With DNS Pivoting](https://www.embeeresearch.io/infrastructure-analysis-with-dns-pivoting/)
- [LokiBot Malware | CISA Advisory AA20-266A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-266a)
- [Lokibot, Software S0447 | MITRE ATT&CK](https://attack.mitre.org/software/S0447/)
- [LokiBot Malware White Paper](https://www.cisecurity.org/insights/white-papers/lokibot-malware)
- [XWorm v7 RAT: Technical Analysis of Infection Chain, C2 Protocol, and Plugin Architecture](https://gurucul.com/latest-threats/xworm-v7-rat-technical-analysis-of-infection-chain-c2-protocol-and-plugin-architecture/)
- [XWorm Malware: Analysis, Detection, Removal](https://www.huntress.com/threat-library/malware/xworm)
- [The Rise of XWorm RAT: What Cybersecurity Teams Need to Know Now](https://cofense.com/blog/the-rise-of-xworm-rat-what-cybersecurity-teams-need-to-know-now)
- [Dissecting REMCOS RAT: An in-depth analysis of a widespread 2024 malware, Part Four](https://www.elastic.co/security-labs/dissecting-remcos-rat-part-four)
- [Remcos RAT Analysis: How the Windows Remote Access Trojan Operates](https://www.picussecurity.com/resource/blog/remcos-rat-analysis-how-the-windows-remote-access-trojan-operates)
- [ZPHP Campaign Delivering Remcos RAT Impacting SLTTs](https://www.cisecurity.org/insights/blog/zphp-campaign-delivering-remcos-rat-impacting-sltts)
- [Bagle (computer worm)](https://en.wikipedia.org/wiki/Bagle_(computer_worm))
- [The Bagle botnet](https://securelist.com/the-bagle-botnet/36046/)
- [Email-Worm:W32/Bagle](https://www.f-secure.com/v-descs/bagle.shtml)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1485