Russian Ransomware C2 Network Discovered in Censys Data

Censys identified multiple hosts—mostly in Russia and one in Ohio—hosting offensive tooling (Metasploit, Deimos C2, PoshC2) and malware kits that include ransomware-related components and credential theft/C2 tools (Cobalt Strike, Mimikatz). Historical certificate and file evidence links at least one kit to MedusaLocker and Bitcoin nodes likely used for ransom payments, leading Censys to assess these hosts as part of a ransomware C2 network.