← All actors Recent activity

BOTEAM

BOTEAM · black owl · brockendoor · hoody hyena · lifting zmiy · zeronetkit

Indicators
13
Source reports
6
Activity span
not dated
Newest indicator
unknown
Upstream change
2026-02-05

Overview 13 indicators

No published description. This group is tracked by Maltrail from vendor reporting but is not named in MITRE ATT&CK, so there is no curated profile to show.

domain10BOTEAM-domain.txt
ipv42BOTEAM.json
url1BOTEAM.json

Principal sources 6 reports

Ranked by how many of this actor's indicators each report brought in.

Timeline 13 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

  1. 2 domainthis year

    x.com/t3ft3lb/status/2019430700685181250 · securelist.ru/bo-team-upgrades-brockendoor-and-zerone… · github.com/t3ft3lb/2026-100DaysofYARA/blob/main/da… · virustotal.com/gui/file/10d0114dba15bf9b19b7ef5f03fbbe… · virustotal.com/gui/file/a41e7083e6c53c02dc2e92dcfd830f… · virustotal.com/gui/file/aeef89818b2212a0b7154eaad28183…

    tributarieshand.online
    yandecx.site

  2. or earlier 8 domain, 2 ipv4, 1 urlthis year

    x.com/t3ft3lb/status/2019430700685181250 · securelist.ru/bo-team-upgrades-brockendoor-and-zerone… · github.com/t3ft3lb/2026-100DaysofYARA/blob/main/da… · virustotal.com/gui/file/10d0114dba15bf9b19b7ef5f03fbbe… · virustotal.com/gui/file/a41e7083e6c53c02dc2e92dcfd830f… · virustotal.com/gui/file/aeef89818b2212a0b7154eaad28183…

    domaineasybussy.space
    domainicecoldwind.online
    domaininvuln.xyz
    domainlizzardsnails.online
    domainmgutu-vf.ru
    domainrailradman.site
    domainurbantvpn.online
    domainwholewell.online
    ipv4213.165.60.118:22
    ipv4213.165.60.118:22:443
    urlhttp://213.165.60.118

Further reading 6