The National Network and Information Security Information Reporting Center has discovered a number of foreign malicious websites and malicious IPs, which are used by foreign hacker organizations to continuously launch cyber attacks against China and other countries. These malicious websites and IPs are closely related to a specific Trojan or Trojan program control terminal. A malicious address is associated with a Nanocore virus family sample, which can be expanded to achieve various malicious functions, such as mining cryptocurrency, ransomware attacks, etc.