Loading story…
Check Point Research reported that the Ramnit malware was used as a loader in a large botnet campaign that infected roughly 100,000 systems in two months and ultimately delivered Ngioweb to more than 139,000 computers. The operation, dubbed the "Black" botnet, repeatedly downloaded Ngioweb from Ramnit command-and-control infrastructure at 185.44.75.109, then used the secondary malware to create a two-stage command-and-control architecture for back-connect and relay proxy services.
Researchers said the malware was designed to build a large, multi-purpose proxy network capable of reaching remote and internal resources while masking attacker activity by chaining traffic through compromised hosts. Ngioweb maintained persistence through Startup folders, Run registry keys, and scheduled tasks, and used process hollowing into msiexec.exe along with layered encryption, API and string obfuscation, and sandbox-evasion logic that served fake configuration data in analyst environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
By early July 2018, researchers estimated that more than 139,000 computers had been infected with Ngioweb through the Ramnit Black botnet infrastructure. The malware provided back-connect and relay proxy capabilities through a two-stage command-and-control architecture.
Over the two months spanning May to July 2018, Ramnit ran a large campaign dubbed the Black botnet that infected more than 100,000 systems. The campaign primarily used infected machines as malicious proxy servers and distributed Ngioweb via Ramnit's getexec command.
Check Point reported that the identified Ramnit command-and-control server at 185.44.75.109 had been active since 6 March 2018. This server was used in the Black botnet campaign to deliver Ngioweb to infected hosts.
The first samples of the Ngioweb proxy malware were seen in the second half of 2017. Check Point later identified Ngioweb as the secondary payload distributed by Ramnit in the Black botnet campaign.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented **Ramnit** as a Zeus-like banking trojan, worm, and file infector that was distributed through the **Blackhole exploit kit** and equipped with rootkit capabilities, spam-sending functions, and aggressive persistence. Analysis of multiple samples showed the malware dropping several components, installing a fake **"Mi cor soft Windows Service"**, injecting into `svchost.exe`, and in some cases infecting executable and HTML files by appending malicious code. One sample was tied more closely to botnet and spam activity, while another emphasized file infection, a combination that made reliable cleanup difficult and led researchers to recommend full system rebuilds rather than partial remediation. The reporting also showed that Ramnit used resilient command-and-control methods, including communications over port `443` with a custom encoded protocol rather than SSL and large fallback domain lists to find active servers. Separate reverse engineering of the malware's **domain generation algorithm (DGA)** found that Ramnit generated variable-length `.com` domains using a simple linear congruential generator and multiple observed 32-bit seeds, including `0xEF214BBF`, `0x28488EEA`, `0x4BFCBC6A`, and `0x79159C10`. Investigators linked parts of the infrastructure to pharma spam operations, noted overlap with previously documented Ramnit C2 servers, and reported that while one command server had been sinkholed, other infrastructure remained active.
Aug 15, 2026
Researchers reported that **Water Barghest** has industrialized the compromise of internet-exposed IoT and router devices, using public scan data such as **Shodan**, long-lived datacenter infrastructure, known vulnerabilities, and at least one **zero-day** to deploy the **Ngioweb** malware and convert victims into rentable proxy nodes. Trend Micro said the group can move from initial exploitation to listing a device on a proxy marketplace in about **10 minutes**, while LevelBlue linked the botnet’s monetization to the **Nsocks** service, which advertised nearly **30,000** global IPs at low daily prices. Observed targets have included **Cisco IOS XE** devices, **EdgeRouter** systems, **Zyxel** routers, **Linear eMerge** devices, and even **Neato** vacuum cleaners, with many infected hosts belonging to residential ISP users. The activity extends a botnet lineage that researchers traced from a **Win32.Ngioweb** proxy botnet seen in 2018, to Linux infections on **WordPress** servers in 2019, and then to broad IoT targeting from 2020 onward. Earlier analysis by Netlab 360 found Linux.Ngioweb used a two-tier C2 design, **DGA** fallback domains, anti-analysis features, and encrypted Stage-2 communications, while newer reporting said the operators have kept the malware largely stable but expanded their exploit arsenal, altered C2 request paths, and added **TXT-record authenticity checks** to hinder sinkholing. Researchers assessed that a substantial share of one proxy marketplace’s exit nodes were compromised devices running Ngioweb, underscoring how mature criminal operators are turning vulnerable IoT systems into persistent anonymization infrastructure for sale or reuse.
Aug 15, 2026
Researchers detailed how the **Seamless** drive-by download campaign delivered the **Ramnit** banking trojan after filtering victims by time zone and geolocation, then redirecting selected targets to a **RIG Exploit Kit** landing page. The malware used a custom command-and-control protocol over TCP port `443` that mimicked secure traffic but was **not HTTPS**, with RC4-encrypted data chunks reportedly decodable using a stable key observed in the analyzed environment. The analysis found that Ramnit registered infected hosts by sending two MD5 values to its command server before retrieving region-specific modules and web-inject configurations. Japan-focused infections received localized credit-card-themed web injects, while downloaded components supported antivirus interference, cookie theft, browser injection, and browser communication hooks; U.S.-targeted infections used a similar module set but could also fetch tools such as an FTP grabber and **AZORult**.
Aug 15, 2026