# Malware Infrastructure Reuse Tracked via Passive DNS Pivoting (LokiBot, Bagle, Xworm, Remcos)

> Embee Research walks through Validin passive DNS pivoting that links domains and IPs across LokiBot, Bagle Worm, Xworm and Remcos infrastructure. Observed tradecraft includes iCloud lookalike domains, duckdns dynamic DNS, shared ASN/CIDR ranges and Cloudflare fronting. No threat actor attribution is stated.

- **Published:** 2026-10-30T06:07:33Z
- **Last reviewed:** 2026-10-30T06:07:33Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4803
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4803.png
- **ID:** TL-2026-4803
- **Severity:** LOW
- **Category:** MALWARE
- **Status:** TRACKING
- **Detections:** 9 (1 shown free below) · **IOCs:** 19 (3 shown free below)

## Description

Embee Research (published 2024-03-28) demonstrates two passive-DNS case studies using Validin, with VirusTotal and ThreatFox as supporting data sources. The article is a defender tradecraft walkthrough, not a campaign report: it names no threat actor, no CVE and no victims.

Case 1 (LokiBot): the starting indicator is the domain sempersim.su, reported on ThreatFox as LokiBot. Passive DNS shows the domain has resolved to multiple IP addresses since 2022, which the author describes as the operators regularly changing infrastructure. A recent resolution, 104.237.252.28, also hosts lcloud.com.de, which spells iCloud with a leading lowercase L, and www.icloud-find-online.me. Both impersonate Apple services. A further lookalike, lcloud.com.se, uses the same misspelling and has 15 historical IP resolutions between 2019 and 2023. Files communicating with it were associated with the Bagle worm. www.icloud-find-online.me began using Cloudflare on 2024-03-19, which changes its ASN and masks the origin host.

Case 2 (Xworm / Remcos): the starting indicator is marxrwo9090.duckdns.org, reported on ThreatFox, resolving to 194.147.140.138. 25 domains on that IP use dynamic DNS services, including febxworm39090.duckdns.org, which is explicitly labelled Xworm. Expanding to the enclosing 194.147.140.0/24 range returned 1,468 domains in the ASN, 464 of them duckdns subdomains with suspicious naming and very recent activity. One of these, elastolut.duckdns.org (11 VirusTotal detections), was tied to Remcos C2 connections in communicating samples.

Defensive takeaways: pivot domain to IP history, IP to co-hosted domains, domain to lookalike variants, and IP to CIDR/ASN neighbours. Dynamic DNS subdomain clusters on a single /24 and homoglyph variants of major brands are high-value hunting and blocking signals. The source also lists an IP written as 194.295.220.41. It is not a valid IPv4 address (an octet exceeds 255), so it is excluded from the IOC list as unverified. BeaconBeagle lookups for 194.147.140.138 and 104.237.252.28 returned no record (HTTP 404), so no C2 correlation could be recorded.

## MITRE ATT&CK

- T1583.001 Domains
- T1588.001 Malware
- T1568 Dynamic Resolution
- T1665 Hide Infrastructure
- T1684.001 Impersonation
- T1036.005 Match Legitimate Resource Name or Location

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**iCloud Homoglyph (lcloud) and LokiBot-Linked Domain Resolution - Sysmon DNS (SPL)** (`TL-2026-4803-SPL-001`)

Flags endpoint DNS lookups for lcloud.* homoglyph iCloud lookalikes (lcloud.com.de, lcloud.com.se), icloud-find-online.me and sempersim.su (LokiBot per ThreatFox), all tied to 104.237.252.28 and Bagle-associated infrastructure in TL-2026-4803. Behaviour-first: any lcloud.<tld> lookup is caught even if new variants are registered. The rule is built for the lure and initial-contact stage, since the threat has no exploit.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1583.001, T1656, T1036.005
- **Data sources:** sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DnsEvents, dns_query
- **Severity:** medium
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22 earliest=-24h
```Sysmon DNS query: iCloud homoglyph (lcloud) lookalikes plus TL-2026-4803 LokiBot and Bagle infrastructure```
| eval qn=lower(rtrim(QueryName, "."))
| where match(qn, "(^|[.])(lcloud[.][a-z.]{2,}|icloud-find-online[.]me|sempersim[.]su)$")
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as processes values(QueryResults) as resolved_ips by Computer, User, qn
| convert ctime(first_seen) ctime(last_seen)
````

### Microsoft KQL

```kql
DnsEvents
| where TimeGenerated > ago(24h)
| where Name matches regex @"(?i)(^|[.])(lcloud[.][a-z.]{2,}|icloud-find-online[.]me|sempersim[.]su)[.]?$"
| project TimeGenerated, Computer, ClientIP, Name, IPAddresses
```

### Sigma

```yaml
title: iCloud Lookalike and LokiBot-Linked Domain Resolution (TL-2026-4803)
id: 3f6c1b52-8a47-4e0d-9c21-5d7a0b1e4a01
status: experimental
description: Detects DNS queries for lcloud homoglyph iCloud lookalike domains and TL-2026-4803 infrastructure (sempersim.su, icloud-find-online.me).
references:
  - https://www.embeeresearch.io/infrastructure-analysis-with-dns-pivoting/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/10/30
tags:
  - attack.resource-development
  - attack.t1583.001
  - attack.defense-evasion
  - attack.t1656
  - attack.t1036.005
logsource:
  category: dns_query
  product: windows
detection:
  selection_ioc:
    QueryName|endswith:
      - 'lcloud.com.de'
      - 'lcloud.com.se'
      - 'icloud-find-online.me'
      - 'sempersim.su'
  selection_homoglyph:
    QueryName|re: '(^|[.])lcloud[.][a-z.]{2,}$'
  condition: 1 of selection_*
falsepositives:
  - Security researchers or DNS filtering products resolving known-bad domains
  - Unrelated legitimate domains that begin with the label lcloud
level: medium
```

**Known false positives:**

- Threat-intel or sandbox hosts that deliberately resolve the listed IOC domains
- Legitimate domains beginning with the label lcloud (for example a small vendor named Lcloud)

**Tuning notes:** Exclude sinkhole or analyst hosts by Computer. If the lcloud wildcard is noisy, allowlist known-good lcloud domains and keep the exact IOC list. Add new homoglyph variants (for example 1cloud, icIoud) as they are found. Requires Sysmon EventCode 22 collection.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- iCloud Homoglyph (lcloud) and LokiBot-Linked Domain Resolution - Sentinel DNS (KQL) (locked: unlock with TL Creds)
- Non-Browser Process Connecting to [indicator] (Xworm / Remcos C2) - Defender (KQL) (locked: unlock with TL Creds)
- Connections to LokiBot Host, Xworm/Remcos /24 and Community-Related IPs - Defender (KQL) (locked: unlock with TL Creds)
- iCloud Lookalike and LokiBot-Linked Domain Resolution - Sigma dns_query (locked: unlock with TL Creds)
- Non-Browser Process Resolving [indicator] (Xworm / Remcos C2) - Sigma dns_query (locked: unlock with TL Creds)
- Connections to LokiBot Host, Xworm/Remcos /24 and Community-Related IPs - Sigma network_connection (locked: unlock with TL Creds)
- Non-Browser Process Resolving [indicator] (Xworm / Remcos C2) - Sysmon DNS (SPL) (locked: unlock with TL Creds)
- Connections to LokiBot Host, Xworm/Remcos /24 and Community-Related IPs - Sysmon Network (SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 19)

Defanged, TLP:CLEAR.

- IP address: `104.237.252[.]28`
- Domain: `sempersim[.]su`
- IP address: `194.147.140[.]138`

Full set of 19 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Introduction To Malware Infrastructure Analysis With Passive DNS (Embee Research)](https://www.embeeresearch.io/infrastructure-analysis-with-dns-pivoting/)
- [ThreatFox IOC database (abuse.ch)](https://threatfox.abuse.ch/)
- [VirusTotal](https://www.virustotal.com/)
- [Validin passive DNS platform](https://www.validin.com/)
- [Censys: automated hunting (infrastructure pivoting)](https://censys.com/blog/automated-hunting)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4803