Researchers Identify Five Additional LegionRelay C2 Servers Tied to Ukraine Campaign

Summary

Team Cymru used shared infrastructure traits from WithSecure and CERT-UA reporting to identify five additional LegionRelay C2 candidates linked to activity targeting Ukrainian organizations.

Key points

CERT-UA reported attacks in March and April 2026 targeting Ukrainian government bodies and especially municipal healthcare institutions, using humanitarian-aid-themed emails with malicious links.
WithSecure reported that the activity, tracked by CERT-UA as UAC-0247, had been active since at least August 2025 and appeared aligned with Russian state interests.
LegionRelay is described as a PowerShell-based RAT that uses REST APIs to communicate.
The researchers fingerprinted the infrastructure by its AS26383 hosting, port 8000, and a distinctive "France Education" banner.
The pivot identified five additional C2 candidates: 91.149.221.118, 91.149.221.123, 166.88.239.54, 194.87.108.12, and 194.87.108.217.
Team Cymru said the additional hosts displayed a LegionRelay C2 login page identical to one observed by WithSecure; defenders were advised to monitor or block the indicators.

Article Details

Attack Vectors: Emails disguised as discussions about humanitarian aid proposals encouraged recipients to click a link.
LegionRelay is a PowerShell-based RAT that communicates with its C2 servers using REST API methods.
Defensive Notes: Consider blocking or alerting on the listed LegionRelay C2 IP addresses.
Use the combination of ASN 26383, port 8000, and the "France Education" open-port banner to hunt for related infrastructure; the article recommends repeating the Scout pivot to identify newly provisioned servers.

Indicators of compromise

Type	Indicator	Context
IPV4	`166[.]88[.]239[.]54`	Identified by Team Cymru as an additional LegionRelay C2 candidate.
IPV4	`194[.]87[.]108[.]110`	Listed as a LegionRelay C2 server by both the GREYVIBE and CERT-UA reports.
IPV4	`194[.]87[.]108[.]12`	Identified by Team Cymru as an additional LegionRelay C2 candidate.
IPV4	`194[.]87[.]108[.]217`	Identified by Team Cymru as an additional LegionRelay C2 candidate.
IPV4	`194[.]87[.]128[.]243`	Listed as a LegionRelay C2 server.
IPV4	`89[.]125[.]189[.]118`	Listed as a LegionRelay C2 server by both the GREYVIBE and CERT-UA reports.
IPV4	`89[.]125[.]189[.]85`	Listed as a LegionRelay C2 server.
IPV4	`91[.]149[.]221[.]118`	Identified by Team Cymru as an additional LegionRelay C2 candidate.
IPV4	`91[.]149[.]221[.]123`	Identified by Team Cymru as an additional LegionRelay C2 candidate.
IPV4	`91[.]149[.]221[.]124`	Listed as a LegionRelay C2 server.
IPV4	`91[.]149[.]221[.]9`	Listed by CERT-UA as a C2 server associated with the activity.
IPV4	`91[.]149[.]253[.]100`	Listed by CERT-UA as a C2 server associated with the activity.