malware family

Unam

19 hosts convicted as Unam command-and-control servers: 19 still listed, 0 archived. First seen 2026-08-31.

feed checked TLP:CLEAR
hosts 19 19 still listed
listings 20
networks 13
first seen 2026-08-31

About

The web panel of an open-source cryptomining toolkit. UnamWebPanel is the console published alongside SilentCryptoMiner, an XMRig-based Windows miner built to run hidden on machines whose owners did not install it; the panel exists to watch and manage a fleet of them, and Kaspersky documented a 2025 campaign that put that miner on more than two thousand machines in Russia — its own telemetry, so the true figure may be higher. A listed address served that panel's login page. What is listed is the operator's console, never a machine mining for it.

Ports

:8011:4435:31761:78911:111801:135641

Observed changes

New networks for this family in this archive, last 7 days: AS9009 on 2026-10-26 (1 host); AS214351 on 2026-10-26 (1 host); AS213316 on 2026-10-26 (1 host).

Detection packs

Rules for this hub's 19 still-listed hosts, updated with the archive. Withdrawn hosts can stay in these files for up to five minutes. Each listener gets one Suricata rule on its address and port, with the same rule ID in every file: load one set, or let suricata-update merge them. A newer file replaces an older one. YARA rules match file hashes only.

Hosts

Newest first by first seen, so later pages shift as hosts are added. Archived hosts are included and marked.