WarmCookie Infrastructure Update: Uncovering New C2 Servers and Threats

This report analyzes a new wave of the WarmCookie backdoor, identifying a primary C2 (38.180.91.117) and six additional IPs linked via certificate attributes, HTTP response patterns, and a reused SSH key fingerprint that ties to a cluster of servers; it also notes potential overlap with DarkGate activity and supplies network observables and IoCs for defensive monitoring while withholding full detection queries.