hxxp://209.99.186[.]235:8443/api/agent/full?arch=amd64URL
Reported by 1 independent source · first reported by Datadog Security Labs · last reported
Last reported 2 months ago
What the reports say
1 report, newest first · the exact sentence from each-
N4D Mesh Controller: New infrastructure, a UPX-packed agent labeled "go-titan," and how to hunt for it“…giving the loader unrestricted network access, we retrieved the exact observed URL from a separate disposable VM: hxxp://209.99.186[.]235:8443/api/agent/full?arch=amd64 returned a 7,321,596-byte UPX-packed ELF (fc4109f5dd1d30b65dd60e57dc639ac1d313bfa5241e36e61fbc4aabc1cda482).”
Indicators reported together
named in the same reports- cdnorigin[.]netin 1 report
- 209.99.186[.]73in 1 report
- fc4109f5dd1d30b6…4aabc1cda482in 1 report
- 3435cc9d4a255bfb…c55bc89b814din 1 report
- ab435e3e24cfb3a3…bc1c551b2c29in 1 report
- 77fe750d6b94b32e…dc22967b1302in 1 report
- 0d5f67b6d35e609e…bab7e48cc1dein 1 report
- 209.99.186[.]235in 1 report
- c422621ef824b627…f9d9dd435174in 1 report
- 94ae566e27b17669…dd081fd3cc9cin 1 report
- agent[.]pidin 1 report
- vt.http.method[.]postin 1 report
- d4483b7a943faeec…132f179b8e78in 1 report
- 749e8835bb407336…4f28f1bea708in 1 report
- 79e44b8523ee1e37…fdd8f825e763in 1 report
Copy these 15 indicators · defanged
Also named with it: CVE-2026-39987, CVE-2026-26220, CVE-2023-48022, CVE-2026-27944, CVE-2026-33032
Thanks — we review every report.