Black Basta BackConnect TitanPlus Registry C2 Storage

Daniel Jeremiah@daniyyell

•updated Jun 2, 2026•0•0•3

This rule detects the creation or modification of registry keys under 'HKCU\SOFTWARE\TitanPlus' or 'HKLM\SOFTWARE\TitanPlus' that contain specific IP addresses (38.180.25, 45.8.157, or 5.181.3) in their details. This activity is associated with Black Basta and Cactus ransomware for storing BackConnect C2 IP addresses.