Replying to
@james_inthe_box@infosec.exchange
@james_inthe_box@infosec.exchange Thank you for sharing! The #PureLogs C2 server seems to be on 2.27.62.123:4449
Turns out JoeSandbox has history for that C2 server since at least 2026-04-08.
https://www.joesandbox.com/analysis/search?ioc-public-ip=2.27.62.123
