Pyramid
25 hosts convicted as Pyramid command-and-control servers: 25 still listed, 0 archived. First seen 2026-08-28.
About
An open-source, Python-based C2 framework that deliberately hosts its payloads behind an ordinary-looking HTTP file server, so the listener often resembles benign infrastructure until its content is examined.
Ports
The 8 ports with the most hosts, of 21.
Observed changes
New networks for this family in this archive, last 7 days: AS204957 on 2026-10-26 (1 host).
Estimated moves of this family toward AS16276 on 2026-10-05 (fewer than 10 hosts). These are the scanner’s estimates from passive search data, shown only where this archive also holds a host of this family.
Detection packs
Rules for this hub's 25 still-listed hosts, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.
Hosts
Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.
Listed in error?
These pages are generated by automated scanning. If a listing is wrong, email support@publicmosaic.com or see abuse & takedown. To exclude a network range from scanning, see opt-out.