Threat reportMalwareTL-2026-4803
Malware Infrastructure Reuse Tracked via Passive DNS Pivoting (LokiBot, Bagle, Xworm, Remcos)
Embee Research walks through Validin passive DNS pivoting that links domains and IPs across LokiBot, Bagle Worm, Xworm and Remcos infrastructure. Observed tradecraft includes iCloud lookalike domains, duckdns dynamic DNS, shared ASN/CIDR ranges and Cloudflare fronting. No threat actor attribution is stated. First disclosed .
Key facts for LokiBot Xworm Remcos DNS pivots
| Identifiers | TL-2026-4803 |
|---|---|
| Severity | LOW |
| First disclosed | |
| Exploitation status | No known exploitation |
| Malware | Bagle, LokiBot, Remcos, XWorm |
| Tools | Loki Bot, Remcos, ThreatFox, Validin, VirusTotal |
| MITRE ATT&CK techniques | T1036.005 Match Legitimate Resource Name or Location, T1568 Dynamic Resolution, T1583.001 Domains, T1588.001 Malware, T1665 Hide Infrastructure, T1684.001 Impersonation |
| Motivation | UNKNOWN |
| Detection rules | 9 (1 shown free) |
| Sources | 5 cited sources |
Detection coverage for LokiBot Xworm Remcos DNS pivots
As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4803 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: iCloud Homoglyph (lcloud) and LokiBot-Linked Domain Resolution - Sysmon DNS (SPL)
Flags endpoint DNS lookups for lcloud.* homoglyph iCloud lookalikes (lcloud.com.de, lcloud.com.se), icloud-find-online.me and sempersim.su (LokiBot per ThreatFox), all tied to 104.237.252.28 and Bagle-associated infrastructure in TL-2026-4803. Behaviour-first: any lcloud.<tld> lookup is caught even if new variants are registered. The rule is built for the lure and initial-contact stage, since the threat has no exploit.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1583.001, T1656, T1036.005
- Data sources: sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DnsEvents, dns_query
- Severity: medium
- Confidence: high
Splunk SPL
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22 earliest=-24h
```Sysmon DNS query: iCloud homoglyph (lcloud) lookalikes plus TL-2026-4803 LokiBot and Bagle infrastructure```
| eval qn=lower(rtrim(QueryName, "."))
| where match(qn, "(^|[.])(lcloud[.][a-z.]{2,}|icloud-find-online[.]me|sempersim[.]su)$")
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as processes values(QueryResults) as resolved_ips by Computer, User, qn
| convert ctime(first_seen) ctime(last_seen)Microsoft KQL
DnsEvents
| where TimeGenerated > ago(24h)
| where Name matches regex @"(?i)(^|[.])(lcloud[.][a-z.]{2,}|icloud-find-online[.]me|sempersim[.]su)[.]?$"
| project TimeGenerated, Computer, ClientIP, Name, IPAddressesSigma
title: iCloud Lookalike and LokiBot-Linked Domain Resolution (TL-2026-4803)
id: 3f6c1b52-8a47-4e0d-9c21-5d7a0b1e4a01
status: experimental
description: Detects DNS queries for lcloud homoglyph iCloud lookalike domains and TL-2026-4803 infrastructure (sempersim.su, icloud-find-online.me).
references:
- https://www.embeeresearch.io/infrastructure-analysis-with-dns-pivoting/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/10/30
tags:
- attack.resource-development
- attack.t1583.001
- attack.defense-evasion
- attack.t1656
- attack.t1036.005
logsource:
category: dns_query
product: windows
detection:
selection_ioc:
QueryName|endswith:
- 'lcloud.com.de'
- 'lcloud.com.se'
- 'icloud-find-online.me'
- 'sempersim.su'
selection_homoglyph:
QueryName|re: '(^|[.])lcloud[.][a-z.]{2,}$'
condition: 1 of selection_*
falsepositives:
- Security researchers or DNS filtering products resolving known-bad domains
- Unrelated legitimate domains that begin with the label lcloud
level: mediumKnown false positives:
- Threat-intel or sandbox hosts that deliberately resolve the listed IOC domains
- Legitimate domains beginning with the label lcloud (for example a small vendor named Lcloud)
Tuning notes: Exclude sinkhole or analyst hosts by Computer. If the lcloud wildcard is noisy, allowlist known-good lcloud domains and keep the exact IOC list. Add new homoglyph variants (for example 1cloud, icIoud) as they are found. Requires Sysmon EventCode 22 collection.
- iCloud Homoglyph (lcloud) and LokiBot-Linked Domain Resolution - Sentinel DNS (KQL) · unlock with TL Creds
- Non-Browser Process Connecting to [indicator] (Xworm / Remcos C2) - Defender (KQL) · unlock with TL Creds
- Connections to LokiBot Host, Xworm/Remcos /24 and Community-Related IPs - Defender (KQL) · unlock with TL Creds
- iCloud Lookalike and LokiBot-Linked Domain Resolution - Sigma dns_query · unlock with TL Creds
- Non-Browser Process Resolving [indicator] (Xworm / Remcos C2) - Sigma dns_query · unlock with TL Creds
- Connections to LokiBot Host, Xworm/Remcos /24 and Community-Related IPs - Sigma network_connection · unlock with TL Creds
- Non-Browser Process Resolving [indicator] (Xworm / Remcos C2) - Sysmon DNS (SPL) · unlock with TL Creds
- Connections to LokiBot Host, Xworm/Remcos /24 and Community-Related IPs - Sysmon Network (SPL) · unlock with TL Creds
Indicators of compromise for LokiBot Xworm Remcos DNS pivots
As of 2026-10-30, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-4803.
Sample indicators (3 of 19)
- IP address:
104.237.252[.]28 - Domain:
sempersim[.]su - IP address:
194.147.140[.]138
Defanged, TLP:CLEAR. Full set of 19 indicators: unlock with TL Creds.
How LokiBot Xworm Remcos DNS pivots works
Embee Research (published 2024-03-28) demonstrates two passive-DNS case studies using Validin, with VirusTotal and ThreatFox as supporting data sources. The article is a defender tradecraft walkthrough, not a campaign report: it names no threat actor, no CVE and no victims.
Case 1 (LokiBot): the starting indicator is the domain sempersim.su, reported on ThreatFox as LokiBot. Passive DNS shows the domain has resolved to multiple IP addresses since 2022, which the author describes as the operators regularly changing infrastructure. A recent resolution, 104.237.252.28, also hosts lcloud.com.de, which spells iCloud with a leading lowercase L, and www.icloud-find-online.me. Both impersonate Apple services. A further lookalike, lcloud.com.se, uses the same misspelling and has 15 historical IP resolutions between 2019 and 2023. Files communicating with it were associated with the Bagle worm. www.icloud-find-online.me began using Cloudflare on 2024-03-19, which changes its ASN and masks the origin host.
Case 2 (Xworm / Remcos): the starting indicator is marxrwo9090.duckdns.org, reported on ThreatFox, resolving to 194.147.140.138. 25 domains on that IP use dynamic DNS services, including febxworm39090.duckdns.org, which is explicitly labelled Xworm. Expanding to the enclosing 194.147.140.0/24 range returned 1,468 domains in the ASN, 464 of them duckdns subdomains with suspicious naming and very recent activity. One of these, elastolut.duckdns.org (11 VirusTotal detections), was tied to Remcos C2 connections in communicating samples.
Defensive takeaways: pivot domain to IP history, IP to co-hosted domains, domain to lookalike variants, and IP to CIDR/ASN neighbours. Dynamic DNS subdomain clusters on a single /24 and homoglyph variants of major brands are high-value hunting and blocking signals. The source also lists an IP written as 194.295.220.41. It is not a valid IPv4 address (an octet exceeds 255), so it is excluded from the IOC list as unverified. BeaconBeagle lookups for 194.147.140.138 and 104.237.252.28 returned no record (HTTP 404), so no C2 correlation could be recorded.
MITRE ATT&CK techniques by tactic:
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1684.001 Impersonation
Command and Control
T1568 Dynamic Resolution; T1665 Hide Infrastructure
Resource Development
Remediation for LokiBot Xworm Remcos DNS pivots
Immediate actions
- Block or sinkhole the listed domains and IPs (sempersim.su, lcloud.com.de, lcloud.com.se, www.icloud-find-online.me, marxrwo9090.duckdns.org, febxworm39090.duckdns.org, elastolut.duckdns.org, 104.237.252.28, 194.147.140.138)
- Hunt DNS and proxy logs for hosts that resolved or contacted the listed indicators and triage any matches for LokiBot, Xworm or Remcos infections
Workarounds
- Use DNS filtering/RPZ to block newly observed or lookalike domains until reviewed
Longer-term hardening
- Alert on or restrict dynamic DNS domains such as duckdns.org where there is no business need
- Add homoglyph and typosquat detection for brand domains (for example lcloud vs icloud)
- Adopt passive DNS pivoting (domain to IP, IP to co-hosted domains, CIDR/ASN expansion) as a routine infrastructure-hunting workflow
Timeline of LokiBot Xworm Remcos DNS pivots
- Earliest passive DNS resolutions for locked-ioc-9 (15 IPs across 2019-2023) reviewed by the author; year-level precision only
- locked-ioc-10 (locked-ioc-15 per locked-ioc-14) begins showing multiple IP resolutions since 2022; exact date not stated
- Approximate (year-level precision, 2023): last of the 15 historical IP resolutions for locked-ioc-9 (locked-ioc-18 worm-associated), after which the article's current-activity analysis shifts to locked-ioc-7
- Approximate (mid-March 2024, exact day not stated): the article's analysis window includes recent activity on locked-ioc-7 (locked-ioc-10, locked-ioc-8, locked-ioc-1) and on duckdns subdomains in locked-ioc-5, including Remcos-linked locked-ioc-4
- locked-ioc-1 begins using locked-ioc-12, changing its ASN and masking the origin
- Embee Research publishes the passive DNS infrastructure analysis walkthrough
Sources cited for LokiBot Xworm Remcos DNS pivots
- Introduction To Malware Infrastructure Analysis With Passive DNS (Embee Research) embeeresearch.io · Research · 2024-03-28
- ThreatFox IOC database (abuse.ch) threatfox.abuse.ch · Research
- VirusTotal virustotal.com · Research
- Validin passive DNS platform validin.com · Vendor report
- Censys: automated hunting (infrastructure pivoting) censys.com · Blog
Previous and next in malware
Drafted by the Threadlinqs research pipeline from 5 sources; published ; last updated —.
