A security researcher at Censys recently uncovered a Russian command-and-control (C2) network containing at least one (1) network host tied to the United States. Researcher Matt Lembright conducted scans of known Russian hosts and found two (2) nodes containing malicious tools Rapid7, Metasploit, Deimos C2, and PoshC2 on only one (1) host. Digging further into indicators and suspicious hosts, Lembright noted connections to MedusaLocker and Karma ransomware variants from previously attributed email address, IP address, and TOR hosts. Furthermore, there were additional vectors highlighting connections to Russian Bitcoin indicators, presumed to be used as the form of payment post-exploitation. While these are all indications of a prepped ransomware attack on a target, the hosts are only being utilized as a front since malicious attacks from out-of-country endpoints will most often be blocked by security systems. By utilizing a United States attributed host, there is greater chance of a successful cyberattack. Deeper analysis by the Federal Bureau of Investigation showed historical malicious activity on the questioned host, attributing to attacks on a hospital and library within the last year. With threat actor attack plans being compromised, this will likely deter actors from exploiting their target for a short time but will likely utilize new methodologies in their next attack attempt. CTIX will continue to monitor any additional updates from this situation and provide additional updates accordingly.