IndicatorPublished 7 Jan 2026Updated 8 Jan 2026

ThreatFox IOCs for 2026-01-07

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 76

dinozozo.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
pippyheydguide.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
connectmanager.networkUnknown RAT botnet C2 domain (confidence level: 100%)
plugins-manager.networkUnknown RAT botnet C2 domain (confidence level: 100%)
avumanager.networkUnknown RAT botnet C2 domain (confidence level: 100%)
msservice.networkUnknown RAT botnet C2 domain (confidence level: 100%)
avserivce.networkUnknown RAT botnet C2 domain (confidence level: 100%)
msmanager.networkUnknown RAT botnet C2 domain (confidence level: 100%)
stoyo-59509.portmap.hostQuasar RAT botnet C2 domain (confidence level: 100%)
clausdoom.esUnknown Stealer botnet C2 domain (confidence level: 100%)

URLs 50

https://exodus-io.io/exodus.exeUnknown RAT payload delivery URL (confidence level: 100%)
https://3.132.202.210/Unknown malware payload delivery URL (confidence level: 90%)
https://3.132.51.96/Unknown malware payload delivery URL (confidence level: 90%)
https://dinozozo.com/menu.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://pippyheydguide.com/redirect/profile-script.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://pippyheydguide.com/redirect/middleware-service.phpNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://pippyheydguide.com/redirect/middleware-effect.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
http://193.111.208.238/authNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://lpiaretes.com/authNetSupportManager RAT payload delivery URL (confidence level: 100%)
http://161.248.113.155:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)

IP addresses 160

172.81.133.92Cobalt Strike botnet C2 server (confidence level: 100%)
191.107.87.178Remcos botnet C2 server (confidence level: 100%)
192.159.99.232Remcos botnet C2 server (confidence level: 100%)
124.198.132.87Remcos botnet C2 server (confidence level: 100%)
185.208.159.121Venom RAT botnet C2 server (confidence level: 100%)
137.220.227.82MimiKatz botnet C2 server (confidence level: 100%)
154.219.123.95AdaptixC2 botnet C2 server (confidence level: 100%)
3.95.166.250Meterpreter botnet C2 server (confidence level: 100%)
199.101.111.33Meterpreter botnet C2 server (confidence level: 100%)
199.101.111.174Meterpreter botnet C2 server (confidence level: 100%)

Hashes 282

201cf5a7bebcaafb56d99cbda6f3d124Akira payload (confidence level: 100%)
b67f12caf85101a89b7a8e6ba7a04c69Akira payload (confidence level: 100%)
7aec91415fc7be9c53683695421b0663Akira payload (confidence level: 100%)
3d1d128ad09c4e1619ef9777cffed905Akira payload (confidence level: 100%)
a5775938fb23a1c405585b0248558323Akira payload (confidence level: 100%)
acac6acd95609352277af8c92a470f81Akira payload (confidence level: 100%)
dd0c0a97b2a17f1313051aa9cd52457dAkira payload (confidence level: 100%)
507b183ad9ef4b09e954bc7ed76f7560Akira payload (confidence level: 100%)
196e28b26eb0b8cf0ebd5e19a65780dcAkira payload (confidence level: 100%)
db103b8f2eb1e1884492626dda6a3561Akira payload (confidence level: 100%)

Description

ThreatFox IOCs for 2026-01-07

Impact

For European organizations, the impact of this threat is currently moderate. Since no specific vulnerabilities or exploits are identified, the primary risk lies in potential payload delivery and network activity that could lead to unauthorized access, data exfiltration, or disruption if the malware is successfully deployed. Organizations relying heavily on OSINT tools or those with extensive network exposure may face increased risk of targeted reconnaissance or payload delivery attempts. The lack of known exploits in the wild reduces the immediacy of the threat, but the presence of IOCs indicates that threat actors may be preparing or conducting low-level operations. Potential impacts include compromised confidentiality through data leakage, integrity issues if payloads modify data or systems, and availability concerns if network activity leads to denial-of-service conditions. European entities in critical infrastructure, finance, and government sectors should be particularly attentive due to their strategic importance and attractiveness to threat actors leveraging OSINT techniques.

Defensive guidance

European organizations should integrate the provided IOCs from the ThreatFox feed into their security monitoring and detection systems to enhance visibility of potential malicious activity. Network traffic should be closely monitored for unusual payload delivery attempts or suspicious connections, especially those correlating with OSINT-derived indicators. Employ advanced threat hunting techniques focusing on network anomalies and payload signatures associated with the shared IOCs. Regularly update threat intelligence feeds and ensure security teams are trained to interpret and act on OSINT-related threats. Implement network segmentation and strict access controls to limit the impact of any successful payload delivery. Conduct phishing awareness and social engineering training to reduce the risk of initial compromise. Since no patches are available, emphasize proactive detection and incident response readiness. Collaborate with European CERTs and information sharing groups to stay informed about evolving threat landscapes related to OSINT and malware delivery.

Community reviews

Loading reviews…