DigitalOcean

Reported Context (8)

Some of the exposed services ran on customer infrastructure at GPU cloud providers, including Voltage Park, Lambda, Northern Data and DigitalOcean. Exposed NVIDIA DCGM Exporters vulnerable to unauthenticated crash flaw
165.227.115.71 AsyncRAT US AS14061 DigitalOcean How to Hunt Malicious Infrastructure Using Scan Data and TLS Certificates
predominantly utilized rented Virtual Private Servers (VPS) from common hosting providers like DigitalOcean and HOSTGLOBAL.PLUS. The overall activity was characterized by high-volume, automated scanning, with WebLogic Honeypot Study Records Rapid Exploitation Attempts Against CVE-2026-21962
Unlike the other servers which use smaller hosting providers, this infrastructure was hosted on DigitalOcean, a mainstream cloud provider. As of December 9, 2025, this server is no longer responding on port 9001, React2Shell Exploited to Gain RCE on Production Next.js App
and 64.227.189.57 are acting as command and control servers for Poseidon. Both are hosted by DigitalOcean under AS14061, with infrastructure located in Germany and India. APT36 Uses Linux Desktop Lures and Poseidon Backdoor in Campaign Targeting India

CVE (7)

Malware (8)

People (3)

Threat Actors (5)

MITRE ATT&CK (18)

Vendors (70)

Products (28)

Tools (10)

Industries (11)

Countries (33)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.