This hunt identifies potential VShell implant activity by correlating known IOCs against network and host telemetry to detect unauthorized remote access sessions. Proactively hunting for these indicators allows the SOC to uncover stealthy backdoors that adversaries use to maintain persistent access, ensuring rapid containment before the threat actor escalates privileges or exfiltrates data.
Malware Family: VShell Total IOCs: 20 IOC Types: ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 8[.]218[.]2[.]176:8084 | botnet_cc | 2026-09-13 | 100% |
| ip:port | 175[.]27[.]164[.]199:8084 | botnet_cc | 2026-09-13 | 100% |
| ip:port | 39[.]106[.]181[.]245:8084 | botnet_cc | 2026-09-13 | 100% |
| ip:port | 8[.]134[.]110[.]251:9999 | botnet_cc | 2026-09-13 | 100% |
| ip:port | 154[.]91[.]61[.]125:8074 | botnet_cc | 2026-09-13 | 100% |
| ip:port | 148[.]66[.]17[.]122:60003 | botnet_cc | 2026-09-13 | 100% |
| ip:port | 148[.]66[.]17[.]123:60003 | botnet_cc | 2026-09-13 | 100% |
| ip:port | 148[.]66[.]17[.]125:60003 | botnet_cc | 2026-09-13 | 100% |
| ip:port | 154[.]91[.]61[.]124:8074 | botnet_cc | 2026-09-13 | 100% |
| ip:port | 154[.]91[.]61[.]98:8074 | botnet_cc | 2026-09-13 | 100% |
| ip:port | 47[.]95[.]222[.]141:1234 | botnet_cc | 2026-09-13 | 100% |
| ip:port | 154[.]91[.]62[.]100:8074 | botnet_cc | 2026-09-13 | 100% |
| ip:port | 148[.]66[.]17[.]126:60003 | botnet_cc | 2026-09-13 | 100% |
| ip:port | 42[.]194[.]137[.]92:8084 | botnet_cc | 2026-09-13 | 100% |
| ip:port | 120[.]26[.]120[.]83:8084 | botnet_cc | 2026-09-13 | 100% |
| ip:port | 124[.]221[.]1[.]207:8084 | botnet_cc | 2026-09-13 | 100% |
| ip:port | 154[.]91[.]56[.]111:8074 | botnet_cc | 2026-09-12 | 100% |
| ip:port | 154[.]91[.]56[.]112:8074 | botnet_cc | 2026-09-12 | 100% |
| ip:port | 154[.]91[.]56[.]113:8074 | botnet_cc | 2026-09-12 | 100% |
| ip:port | 154[.]91[.]56[.]116:8074 | botnet_cc | 2026-09-12 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["124.221.1.207", "154.91.56.116", "42.194.137.92", "154.91.61.98", "8.134.110.251", "148.66.17.126", "154.91.56.113", "120.26.120.83", "154.91.62.100", "47.95.222.141", "148.66.17.122", "154.91.61.124", "148.66.17.125", "154.91.61.125", "39.106.181.245", "8.218.2.176", "148.66.17.123", "175.27.164.199", "154.91.56.112", "154.91.56.111"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc
// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["124.221.1.207", "154.91.56.116", "42.194.137.92", "154.91.61.98", "8.134.110.251", "148.66.17.126", "154.91.56.113", "120.26.120.83", "154.91.62.100", "47.95.222.141", "148.66.17.122", "154.91.61.124", "148.66.17.125", "154.91.61.125", "39.106.181.245", "8.218.2.176", "148.66.17.123", "175.27.164.199", "154.91.56.112", "154.91.56.111"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc
| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A network operations engineer uses nmap or a similar scanning tool to verify the status of a newly deployed internal service that coincidentally binds to one of the VShell default ports (e.g., 8080, 8081, or 8082). The scan generates connection attempts or established sessions that match the IOC thresholds.
NetworkOps or SecurityTeam AD security group, or filter out connections where the destination port is in the known list of internal service ports (e.g., 8080-8090) and the source is within the 10.0.0.0/8 range.Scenario: A DevOps team deploys a lightweight internal API gateway or monitoring agent (such as a custom Python Flask app or Node.js service) that uses one of the VShell IOCs (e.g., specific user-agent strings or default path structures like /vshell/) for its health check endpoint. This is a standard practice for internal microservices.
Environment: Internal or AppType: Microservice, or filter out traffic where the User-Agent contains known internal tool identifiers (e.g., internal-health-check, k8s-probe).Scenario: A scheduled PowerShell script or cron job runs a vulnerability assessment tool (like OpenVAS or Nessus) that actively probes for known backdoor signatures, including VShell, across the internal network. The tool intentionally sends test payloads or requests matching the IOCs to confirm detection coverage.
nessus.exe, openvas-scanner, or vuln-scan.ps1, or filter out events where the