Malicious C2 for a Wiper via Microsoft lookalike domains

Luís Marques@remotecodeexecution

•updated Jul 6, 2026•1•0•6

Detects the use of Microsoft lookalike domains for command and control (C2) communication in the context of wiper malware. Attackers may register domains that closely resemble legitimate Microsoft domains to evade detection and facilitate malicious activities, such as data exfiltration or remote control of compromised systems.