Overlord
140 hosts convicted as Overlord command-and-control servers: 139 still listed, 1 archived. First seen 2026-08-25.
About
An open-source command-and-control framework that pairs a TypeScript server and web panel with cross-platform Go implants, extensible through plugins. It was first published on GitHub in March 2026 under the handle "vxaboveground"; that repository has since disappeared, and in August 2026 the project was republished openly under another account. In June 2026 Proofpoint reported that a group it assesses as very likely North Korea-aligned, tracked as UNK_DeadDrop, had phished developers through malicious code repositories and deployed it, with modules of its own, to steal cryptocurrency. What is listed here is the control server its implants connect to, not a machine running one. The scanner identifies the web panel the server ships with. Most of these addresses answered on 5173, the server's default port. Anyone can stand one up: a listing identifies an Overlord server, not who runs it or why, and ties no host to that group.
Ports
The 8 ports with the most hosts, of 9.
Observed changes
Estimated moves of this family toward AS8560 on 2026-10-06 (fewer than 10 hosts); toward AS14061 on 2026-10-06 (fewer than 10 hosts); toward AS16276 on 2026-10-06 (fewer than 10 hosts); toward AS20473 on 2026-10-06 (fewer than 10 hosts). These are the scanner’s estimates from passive search data, shown only where this archive also holds a host of this family. Showing the 4 newest of 9.
Detection packs
Rules for this hub's 139 still-listed hosts, across all 2 pages of the list, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.
Hosts · page 2 of 2
Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.
Listed in error?
These pages are generated by automated scanning. If a listing is wrong, email support@publicmosaic.com or see abuse & takedown. To exclude a network range from scanning, see opt-out.