83.142.209[.]203IP address
Reported by 1 independent source · first reported by Trend Micro Research · last reported
Last reported 6 months ago
What the reports say
1 report, newest first · the exact sentence from each-
TeamPCP’s Telnyx Attack Marks a Shift in Tactics Beyond LiteLLM“The Windows execution path downloads hangup.wav from 83.142.209[.]203:8080, extracts a PE executable via the XOR steganography technique, and installs it as msbuild.exe in %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ to establish boot persistence.”
Indicators reported together
named in the same reports- models.litellm[.]cloudin 1 report
- checkmarx[.]zonein 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.