Team Cymru Adds Tags for Neptune Loader, Gremlin Stealer and Unam Panels

Aug 4, 2025 · Original article ↗

Summary

Team Cymru describes fingerprinting Neptune Loader, Gremlin Stealer and Unam Web Panel controllers with service banners, then using Scout tags and NetFlow pivots to identify communicating IPs and potential victims.

Key points

The described method uses IP attributes such as open ports, banners, certificates, TLS handshakes, passive DNS and WHOIS data to fingerprint infrastructure.
Team Cymru created tags for Neptune Loader, Gremlin Stealer and Unam Web Panel controllers based on observed HTTP titles and open ports.
Example fingerprints include Neptune Loader on port 3000 with the title “Neptune - Login,” Gremlin on port 80 with “Gremlin Access,” and Unam on port 80 with “Unam Web Panel - Login.”
Scout users can query the tags and pivot through NetFlow records to find IP addresses that communicated with the identified controllers.
Filtering for the “router” tag may help identify enterprise gateways associated with possible victim networks; this does not confirm malware on an endpoint.
The article lists controller IPs as historical IOCs, noting they were active at the time of analysis and should be validated before operational use.

Article Details

Defense Focus: Fingerprint malware command-and-control infrastructure and use network communications to identify potentially affected victims.
Detection Methods: Fingerprint controller IPs using open ports and HTTP banners or page titles, then create tags for matching infrastructure.
Correlate IP attributes including certificates, TLS handshakes, passive DNS, and WHOIS data.
Use NetFlow behavioral analysis to identify and track operational relay box infrastructure.
Search tagged controller IPs and pivot on communications with those addresses; inspect gateway-tagged IPs to identify possible victim networks.
Data Sources: Open-port data
HTTP banners and page titles
X.509 certificates
TLS handshakes
Passive DNS
WHOIS data
NetFlow records
Rule Types: Tag-based search queries
Communication-peer filters and network-flow pivots
Defensive Actions: Search for the Neptune, Gremlin, and Unam tags to find matching controller IPs.
Query for IPs that communicated with the identified controllers, then pivot to inspect the specific connections.
Use router-tagged IPs as possible enterprise gateways and investigate for endpoints communicating with a controller.
Use the listed IP indicators for enrichment and retrospective threat hunting, and validate them before operational use because they may no longer be active.

Indicators of compromise

Type	Indicator	Context
IPV4	`103[.]251[.]164[.]121`	Listed as an active-at-analysis Unam Web Panel controller indicator.
IPV4	`129[.]151[.]135[.]50`	Listed as an active-at-analysis Unam Web Panel controller indicator.
IPV4	`196[.]251[.]72[.]215`	Listed as an active-at-analysis Neptune Loader controller indicator.
IPV4	`196[.]251[.]72[.]216`	Listed as an active-at-analysis Neptune Loader controller indicator.
IPV4	`196[.]251[.]72[.]217`	Listed as an active-at-analysis Neptune Loader controller indicator.
IPV4	`196[.]251[.]84[.]193`	Listed as an active-at-analysis Unam Web Panel controller indicator.
IPV4	`196[.]251[.]90[.]74`	Listed as an active-at-analysis Unam Web Panel controller indicator.
IPV4	`207[.]244[.]199[.]46`	Listed as an active-at-analysis Gremlin Stealer controller indicator.
IPV4	`217[.]119[.]129[.]92`	Listed as an active-at-analysis Gremlin Stealer controller indicator.
IPV4	`62[.]60[.]248[.]110`	Listed as an active-at-analysis Unam Web Panel controller indicator.