Bondnet Using Miner Bots as C2

ASEC analysis confirms the Bondnet actor remains active and has been configuring reverse RDP environments on high-performance infected hosts since 2023 by adding privileged accounts, modifying and using FRP proxies, deploying a Cloudflare tunneling client and attempting to run an HFS-based C2; the report documents miner/backdoor activity, related detections, and provides MD5s, URLs, domains, and IP indicators.