HypeAgent
21 hosts convicted as HypeAgent remote-access trojan controllers: 21 still listed, 0 archived. First seen 2026-08-23.
About
A Windows command-and-control agent first seen in August 2026, delivered by purchase-order and invoice-themed script droppers rather than any published tool, and detected by Microsoft as Trojan:Win64/HypeAgent. Its implants beacon over TLS WebSockets to a fixed "/hype/ws" path, and its servers — concentrated on ports 7443 and 7080 across low-cost hosting — present a reusable certificate template distinctive enough that several scanners track them by fingerprint alone. No author, seller or source has been publicly identified; what is recorded here is a control server, not an infected machine.
Ports
Detection packs
Rules for this hub's 21 still-listed hosts, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.
Hosts
Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.
Listed in error?
These pages are generated by automated scanning. If a listing is wrong, email support@publicmosaic.com or see abuse & takedown. To exclude a network range from scanning, see opt-out.