used in the past with other FinSpy payloads. Most recently one of these C2 servers was used together with CVE2017-8759 in the attacks reported by FireEye in September 2017. These IPs and other previous samples tie closely