Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
13 IOCs
Threat Research/ancient Botnet at Main · Ksi Digital/threat Research
Threat Actors
Malware Families
Excerpt
https://github.com/ksi-digital/threat-research/tree/main/ancient-botnet threat-research/ancient-botnet at main · ksi-digital/threat-research By chrishubert Archived: 2026-10-07 02:01:23 UTC "Ancient": a Linux IoT botnet with a custom ANCT C2 protocol KSI Digital threat research | first published 2026-10-05 We captured a botnet family that calls itself "ancient" in our SSH/Telnet honeypot. Between 2026-10-04 and 2026-10-05 we observed its delivery chain, three iterations of…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →13 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| christophe@ksi-digital.com | High | Score 67/100 | First seen | |
| Domain | kla.sh | High | Score 86/100 | First seen |
| IP | 77.239.124.121 | High | Score 68/100 | First seen |
| Domain | ancient.sh | High | Score 67/100 | First seen |
| URL | http://89.163.157.131:8080/persist.sh | High | Score 86/100 | First seen |
| Domain | persist.sh | High | Score 86/100 | First seen |
| IP | 94.154.43.196 | High | Score 68/100 | First seen |
| URL | 89.163.157.131:35342/tcp | High | Score 67/100 | First seen |
| Domain | telnet_persist_payload.sh | High | Score 67/100 | First seen |
| IP | 94.154.43.138 | High | Score 78/100 | First seen |
| IP | 176.65.139.196 | High | Score 86/100 | First seen |
| Domain | zyrec2.duckdns.org | High | Score 86/100 | First seen |
| IP | 89.163.157.131 | High | Score 86/100 | First seen |
IOC Relationship Graph
Building graph…