{"id":229182,"date":"2025-04-28T13:14:44","date_gmt":"2025-04-28T11:14:44","guid":{"rendered":"https:\/\/www.intrinsec.com\/?p=229182"},"modified":"2026-01-09T13:01:40","modified_gmt":"2026-01-09T13:01:40","slug":"ip-cluster-linking-ransomware-activity-and-eye-pyramid-c2","status":"publish","type":"post","link":"https:\/\/www.intrinsec.com\/en\/ip-cluster-linking-ransomware-activity-and-eye-pyramid-c2\/","title":{"rendered":"IP cluster linking ransomware activity and Eye Pyramid C2"},"content":{"rendered":"<div data-elementor-type=\"wp-post\" data-elementor-id=\"229182\" class=\"elementor elementor-229182\" data-elementor-settings=\"{&quot;element_pack_global_tooltip_width&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;element_pack_global_tooltip_width_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;element_pack_global_tooltip_width_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;element_pack_global_tooltip_padding&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true},&quot;element_pack_global_tooltip_padding_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true},&quot;element_pack_global_tooltip_padding_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true},&quot;element_pack_global_tooltip_border_radius&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true},&quot;element_pack_global_tooltip_border_radius_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true},&quot;element_pack_global_tooltip_border_radius_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;top&quot;:&quot;&quot;,&quot;right&quot;:&quot;&quot;,&quot;bottom&quot;:&quot;&quot;,&quot;left&quot;:&quot;&quot;,&quot;isLinked&quot;:true}}\" data-elementor-post-type=\"post\">\n\t\t\t\t<div class=\"elementor-element elementor-element-3b244987 e-flex e-con-boxed e-con e-parent\" data-id=\"3b244987\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-6afc4f18 elementor-widget elementor-widget-text-editor\" data-id=\"6afc4f18\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h4>Key findings<\/h4><p>\u00a0<\/p><ul><li style=\"text-align: justify\">Pivots on infrastructure associated to a<strong> Python backdoor used by RansomHub<\/strong>, as exposed by GuidePoint Security. These pivots enabled us to discover infrastructure close to this one, related to the offensive tool <strong>Eye Pyramid<\/strong>.<\/li><li style=\"text-align: justify\">Explanations on the open-source tool Eye Pyramid and details on the recent IP addresses that started to <strong>expose a banner<\/strong> associated with the tool, since <strong>January 17, 2025<\/strong>. Some of these IP addresses are related to additional payloads such as <strong>Cobalt Strike, Sliver, Rhadamanthys and the Rhysida ransomware<\/strong>. A number of these IP addresses are hosted on known bulletproof hosting providers such as <strong>Limenet, Aeza and Railnet<\/strong>.<\/li><li style=\"text-align: justify\">A JSON file was discovered which enabled us to link these infrastructure and IP addresses used previously by ransomware operations such as <strong>Rhysida, Vice Society and BlackCat<\/strong>. This JSON file was identified as being a default error response of Eye Pyramid servers. It could indicate similarity in the configuration of the servers of these clusters of activity.<\/li><\/ul><h4>\u00a0<\/h4><h4>Introduction<\/h4><p>\u00a0<\/p><p style=\"text-align: justify\">Ransomware operations often leverage offensive tools for post-compromise exploitation and lateral movement into compromised networks. They can rely on legitimate red-teaming tool such as Cobalt Strike, Metasploit or Sliver, but can also develop custom tools. In this manner, GuidePoint security recently gave insight into a Python backdoor used by RansomHub, after initial infections.<\/p><p style=\"text-align: justify\">Our analysis started here, as we discovered an offensive tool by pivoting on the infrastructure associated with the Python backdoor. This offensive tool named \u201cEye Pyramid\u201d leverages Python to deploy other offensive tools and\/or payloads directly in memory. It was open sourced on GitHub in 2022, but we only discovered several IP addresses associated with this tool since mid-January 2025. Some of them are related to other malicious payloads such as Cobalt Strike, Sliver, Rhadamanthys and the ransomware Rhysida.<\/p><p style=\"text-align: justify\">Eye Pyramid was identified in a case disclosed by The DFIR Report in December 2024, which ties this case to a threat actor associated with Fog ransomware. As this tool is effective and can be linked to potential ransomware delivery, as exposed by DFIR Report and in this analysis, it is important to document new infrastructure associated with it and better prepare defenses.<\/p><p>\u00a0<\/p><p style=\"text-align: justify\"><a href=\"\/en\/#_ftnref3\" name=\"_ftn3\"><\/a><a href=\"\/en\/#_ftnref4\" name=\"_ftn4\"><\/a><\/p><h4>Intrinsec&#039;s CTI services<\/h4><p>\u00a0<\/p><p style=\"text-align: justify\">Organizations are facing a rise in the sophistication of threat actors and intrusion sets. To address these evolving threats, it is now necessary to take a proactive approach in the detection and analysis of any element deemed malicious. Such a hands-on approach allows companies to anticipate, or at least react as quickly as possible to the compromises they face.<\/p><p style=\"text-align: justify\">For this report, shared with our clients in January 2025, Intrinsec relied on its Cyber Threat Intelligence service, which provides its customers with high value-added, contextualized and actionable intelligence to understand and contain cyber threats. Our CTI team consolidates data &amp; information gathered from our security monitoring services (SOC, MDR, etc.), our incident response team (CERT-Intrinsec) and custom cyber intelligence generated by our analysts using custom heuristics, honeypots, hunting, reverse-engineering &amp; pivots.<\/p><p style=\"text-align: justify\">Intrinsec also offers various services around Cyber Threat Intelligence:<\/p><ul style=\"text-align: justify\"><li>Risk anticipation: which can be leveraged to continuously adapt the detection &amp; response capabilities of our clients&#039; existing tools (EDR, XDR, SIEM, \u2026) through:<ul><li style=\"list-style-type: none\"><ul><li><strong>an operational feed of IOCs based on our exclusive activities.<\/strong><\/li><li><strong>threat intel notes &amp; reports, TIP-compliant.<\/strong><\/li><\/ul><\/li><\/ul><\/li><li>Digital risk monitoring:<ul><li style=\"list-style-type: none\"><ul><li><strong>data leak detection &amp; remediation<\/strong><\/li><li><strong>external asset security monitoring (EASM)<\/strong><\/li><li><strong>brand protection<\/strong><\/li><\/ul><\/li><\/ul><\/li><\/ul><p style=\"text-align: justify\">For more information, go to <a href=\"http:\/\/www.intrinsec.com\/en\/cyber-threat-intelligence\/\">intrinsec.com\/en\/cyber-threat-intelligence\/<\/a>.<\/p><p style=\"text-align: justify\">Follow us on <a href=\"https:\/\/www.linkedin.com\/company\/intrinsec\/\">LinkedIn<\/a> and <a href=\"https:\/\/twitter.com\/Intrinsec\">X<\/a><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-964fe84 e-flex e-con-boxed e-con e-parent\" data-id=\"964fe84\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-1c80e81 elementor-widget elementor-widget-button\" data-id=\"1c80e81\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"button.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-button-wrapper\">\n\t\t\t\t\t<a class=\"elementor-button elementor-button-link elementor-size-sm\" href=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/10\/TLP-CLEAR-IP-cluster-linking-ransomware-activity-and-Eye-Pyramid-C2-EN.pdf\">\n\t\t\t\t\t\t<span class=\"elementor-button-content-wrapper\">\n\t\t\t\t\t\t\t\t\t<span class=\"elementor-button-text\">Download the full report content<\/span>\n\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/a>\n\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>","protected":false},"excerpt":{"rendered":"<p>Key findings \u00a0 Pivots on infrastructure associated to a Python backdoor used by RansomHub, as [&hellip;]<\/p>\n","protected":false},"author":43,"featured_media":229508,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9,11],"tags":[62],"class_list":["post-229182","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-threat-intelligence","category-threat-intelligence-report","tag-cyber-threat-intelligence-en"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v28.0 (Yoast SEO v28.1) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>IP cluster linking ransomware activity and Eye Pyramid C2 - INTRINSEC<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.intrinsec.com\/en\/ip-cluster-linking-ransomware-activity-and-eye-pyramid-c2\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"IP cluster linking ransomware activity and Eye Pyramid C2\" \/>\n<meta property=\"og:description\" content=\"Key findings \u00a0 Pivots on infrastructure associated to a Python backdoor used by RansomHub, as [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.intrinsec.com\/en\/ip-cluster-linking-ransomware-activity-and-eye-pyramid-c2\/\" \/>\n<meta property=\"og:site_name\" content=\"INTRINSEC\" \/>\n<meta property=\"article:published_time\" content=\"2025-04-28T11:14:44+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-01-09T13:01:40+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/04\/Template-banner-webesite-4.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"600\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Ruben Madar\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@Intrinsec\" \/>\n<meta name=\"twitter:site\" content=\"@Intrinsec\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ruben Madar\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/ip-cluster-linking-ransomware-activity-and-eye-pyramid-c2\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/ip-cluster-linking-ransomware-activity-and-eye-pyramid-c2\\\/\"},\"author\":{\"name\":\"Ruben Madar\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/8656db17eff6a4f9a372f5dd5bd08853\"},\"headline\":\"IP cluster linking ransomware activity and Eye Pyramid C2\",\"datePublished\":\"2025-04-28T11:14:44+00:00\",\"dateModified\":\"2026-01-09T13:01:40+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/ip-cluster-linking-ransomware-activity-and-eye-pyramid-c2\\\/\"},\"wordCount\":577,\"publisher\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/ip-cluster-linking-ransomware-activity-and-eye-pyramid-c2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/Template-banner-webesite-4.png\",\"keywords\":[\"Cyber Threat Intelligence\"],\"articleSection\":[\"Cyber Threat Intelligence\",\"Threat Intelligence Report\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/ip-cluster-linking-ransomware-activity-and-eye-pyramid-c2\\\/\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/ip-cluster-linking-ransomware-activity-and-eye-pyramid-c2\\\/\",\"name\":\"IP cluster linking ransomware activity and Eye Pyramid C2 - INTRINSEC\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/ip-cluster-linking-ransomware-activity-and-eye-pyramid-c2\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/ip-cluster-linking-ransomware-activity-and-eye-pyramid-c2\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/Template-banner-webesite-4.png\",\"datePublished\":\"2025-04-28T11:14:44+00:00\",\"dateModified\":\"2026-01-09T13:01:40+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/ip-cluster-linking-ransomware-activity-and-eye-pyramid-c2\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.intrinsec.com\\\/ip-cluster-linking-ransomware-activity-and-eye-pyramid-c2\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/ip-cluster-linking-ransomware-activity-and-eye-pyramid-c2\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/Template-banner-webesite-4.png\",\"contentUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/Template-banner-webesite-4.png\",\"width\":1200,\"height\":600,\"caption\":\"IP cluster linking ransomware activity and Eye Pyramid C2\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/ip-cluster-linking-ransomware-activity-and-eye-pyramid-c2\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.intrinsec.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"IP cluster linking ransomware activity and Eye Pyramid C2\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#website\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/\",\"name\":\"INTRINSEC\",\"description\":\"Notre m\u00e9tier , Prot\u00e9ger le v\u00f4tre\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.intrinsec.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#organization\",\"name\":\"INTRINSEC\",\"alternateName\":\"ISEC\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/libellule.png\",\"contentUrl\":\"https:\\\/\\\/www.intrinsec.com\\\/wp-content\\\/uploads\\\/2025\\\/02\\\/libellule.png\",\"width\":1322,\"height\":1322,\"caption\":\"INTRINSEC\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/Intrinsec\",\"https:\\\/\\\/fr.linkedin.com\\\/company\\\/intrinsec\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UC0trUZAHNZOUbxYnNdecM4A\"],\"description\":\"soci\u00e9t\u00e9 de consulting, pure player cybers\u00e9curit\u00e9 fran\u00e7ais et europ\u00e9en depuis plus de 30ans, sp\u00e9cialiste dans la s\u00e9curit\u00e9 offensive & audit (pentest\\\/red team), GRC, et services IMSS comme le SOC, CTI et CERT Intrinsec est qualifi\u00e9 PASSI Elev\u00e9, PRIS Elev\u00e9 et PACS par l'ANSSI\",\"email\":\"contact@intrinsec.com\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.intrinsec.com\\\/#\\\/schema\\\/person\\\/8656db17eff6a4f9a372f5dd5bd08853\",\"name\":\"Ruben Madar\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4f72adfecdb89368517e8adc50565d7a1d7bd1baebbd3a730c5f01a81c23914a?s=96&d=retro&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4f72adfecdb89368517e8adc50565d7a1d7bd1baebbd3a730c5f01a81c23914a?s=96&d=retro&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4f72adfecdb89368517e8adc50565d7a1d7bd1baebbd3a730c5f01a81c23914a?s=96&d=retro&r=g\",\"caption\":\"Ruben Madar\"},\"url\":\"https:\\\/\\\/www.intrinsec.com\\\/en\\\/author\\\/ruben-madar\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"IP cluster linking ransomware activity and Eye Pyramid C2 - INTRINSEC","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.intrinsec.com\/en\/ip-cluster-linking-ransomware-activity-and-eye-pyramid-c2\/","og_locale":"en_US","og_type":"article","og_title":"IP cluster linking ransomware activity and Eye Pyramid C2","og_description":"Key findings \u00a0 Pivots on infrastructure associated to a Python backdoor used by RansomHub, as [&hellip;]","og_url":"https:\/\/www.intrinsec.com\/en\/ip-cluster-linking-ransomware-activity-and-eye-pyramid-c2\/","og_site_name":"INTRINSEC","article_published_time":"2025-04-28T11:14:44+00:00","article_modified_time":"2026-01-09T13:01:40+00:00","og_image":[{"width":1200,"height":600,"url":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/04\/Template-banner-webesite-4.png","type":"image\/png"}],"author":"Ruben Madar","twitter_card":"summary_large_image","twitter_creator":"@Intrinsec","twitter_site":"@Intrinsec","twitter_misc":{"Written by":"Ruben Madar","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.intrinsec.com\/ip-cluster-linking-ransomware-activity-and-eye-pyramid-c2\/#article","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/ip-cluster-linking-ransomware-activity-and-eye-pyramid-c2\/"},"author":{"name":"Ruben Madar","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/8656db17eff6a4f9a372f5dd5bd08853"},"headline":"IP cluster linking ransomware activity and Eye Pyramid C2","datePublished":"2025-04-28T11:14:44+00:00","dateModified":"2026-01-09T13:01:40+00:00","mainEntityOfPage":{"@id":"https:\/\/www.intrinsec.com\/ip-cluster-linking-ransomware-activity-and-eye-pyramid-c2\/"},"wordCount":577,"publisher":{"@id":"https:\/\/www.intrinsec.com\/#organization"},"image":{"@id":"https:\/\/www.intrinsec.com\/ip-cluster-linking-ransomware-activity-and-eye-pyramid-c2\/#primaryimage"},"thumbnailUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/04\/Template-banner-webesite-4.png","keywords":["Cyber Threat Intelligence"],"articleSection":["Cyber Threat Intelligence","Threat Intelligence Report"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.intrinsec.com\/ip-cluster-linking-ransomware-activity-and-eye-pyramid-c2\/","url":"https:\/\/www.intrinsec.com\/ip-cluster-linking-ransomware-activity-and-eye-pyramid-c2\/","name":"IP cluster linking ransomware activity and Eye Pyramid C2 - INTRINSEC","isPartOf":{"@id":"https:\/\/www.intrinsec.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.intrinsec.com\/ip-cluster-linking-ransomware-activity-and-eye-pyramid-c2\/#primaryimage"},"image":{"@id":"https:\/\/www.intrinsec.com\/ip-cluster-linking-ransomware-activity-and-eye-pyramid-c2\/#primaryimage"},"thumbnailUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/04\/Template-banner-webesite-4.png","datePublished":"2025-04-28T11:14:44+00:00","dateModified":"2026-01-09T13:01:40+00:00","breadcrumb":{"@id":"https:\/\/www.intrinsec.com\/ip-cluster-linking-ransomware-activity-and-eye-pyramid-c2\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.intrinsec.com\/ip-cluster-linking-ransomware-activity-and-eye-pyramid-c2\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.intrinsec.com\/ip-cluster-linking-ransomware-activity-and-eye-pyramid-c2\/#primaryimage","url":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/04\/Template-banner-webesite-4.png","contentUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/04\/Template-banner-webesite-4.png","width":1200,"height":600,"caption":"IP cluster linking ransomware activity and Eye Pyramid C2"},{"@type":"BreadcrumbList","@id":"https:\/\/www.intrinsec.com\/ip-cluster-linking-ransomware-activity-and-eye-pyramid-c2\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.intrinsec.com\/"},{"@type":"ListItem","position":2,"name":"IP cluster linking ransomware activity and Eye Pyramid C2"}]},{"@type":"WebSite","@id":"https:\/\/www.intrinsec.com\/#website","url":"https:\/\/www.intrinsec.com\/","name":"INTRINSEC","description":"Our job is to protect yours.","publisher":{"@id":"https:\/\/www.intrinsec.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.intrinsec.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.intrinsec.com\/#organization","name":"INTRINSEC","alternateName":"ISEC","url":"https:\/\/www.intrinsec.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.intrinsec.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/02\/libellule.png","contentUrl":"https:\/\/www.intrinsec.com\/wp-content\/uploads\/2025\/02\/libellule.png","width":1322,"height":1322,"caption":"INTRINSEC"},"image":{"@id":"https:\/\/www.intrinsec.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/Intrinsec","https:\/\/fr.linkedin.com\/company\/intrinsec","https:\/\/www.youtube.com\/channel\/UC0trUZAHNZOUbxYnNdecM4A"],"description":"Intrinsec, a consulting firm and pure-play French and European cybersecurity provider for over 30 years, specializes in offensive security and auditing (penetration testing\/red teams), GRC, and IMSS services such as SOC, CTI, and CERT. Intrinsec is qualified at PASSI High, PRIS High, and PACS levels by ANSSI.","email":"contact@intrinsec.com"},{"@type":"Person","@id":"https:\/\/www.intrinsec.com\/#\/schema\/person\/8656db17eff6a4f9a372f5dd5bd08853","name":"Ruben Madar","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/4f72adfecdb89368517e8adc50565d7a1d7bd1baebbd3a730c5f01a81c23914a?s=96&d=retro&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/4f72adfecdb89368517e8adc50565d7a1d7bd1baebbd3a730c5f01a81c23914a?s=96&d=retro&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4f72adfecdb89368517e8adc50565d7a1d7bd1baebbd3a730c5f01a81c23914a?s=96&d=retro&r=g","caption":"Ruben Madar"},"url":"https:\/\/www.intrinsec.com\/en\/author\/ruben-madar\/"}]}},"_links":{"self":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/229182","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/users\/43"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/comments?post=229182"}],"version-history":[{"count":8,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/229182\/revisions"}],"predecessor-version":[{"id":231186,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/posts\/229182\/revisions\/231186"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/media\/229508"}],"wp:attachment":[{"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/media?parent=229182"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/categories?post=229182"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intrinsec.com\/en\/wp-json\/wp\/v2\/tags?post=229182"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}