The command and control (C&C) server used in this campaign is hosted on an IP address belonging to a Ukrainian Internet service provider (ISP) using MikroTik router with the firmware version 6.34.4 since March 2016. Researchers believe that this router does not belong to the attackers, but it was hacked by them for processing malware’s HTTP requests.

Read full news article on HackRead