IndicatorPublished 8 Jan 2026Updated 9 Jan 2026

ThreatFox IOCs for 2026-01-08

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 104

secure-signal.infoUnknown RAT botnet C2 domain (confidence level: 100%)
buradabmwking.comUnknown Stealer botnet C2 domain (confidence level: 100%)
alphalaval.testingweblink.comHavoc botnet C2 domain (confidence level: 100%)
dadumaster.co.comQuasar RAT botnet C2 domain (confidence level: 75%)
gizmodo.co.comQuasar RAT botnet C2 domain (confidence level: 75%)
form.co.comAsyncRAT botnet C2 domain (confidence level: 75%)
v1.phimmoiz.devAsyncRAT botnet C2 domain (confidence level: 75%)
v1.vlxx.netAsyncRAT botnet C2 domain (confidence level: 75%)
v2.phimmoiz.devAsyncRAT botnet C2 domain (confidence level: 75%)
v2.vlxx.netAsyncRAT botnet C2 domain (confidence level: 75%)

URLs 91

https://138.226.237.117/Vidar botnet C2 (confidence level: 100%)
https://secure-signal.info/Unknown RAT botnet C2 (confidence level: 100%)
https://157.180.44.87/Vidar botnet C2 (confidence level: 100%)
https://138.226.236.90/Vidar botnet C2 (confidence level: 100%)
http://185.113.8.55/nep/Unknown malware botnet C2 (confidence level: 100%)
http://121.41.108.109:10010/swfmCobalt Strike botnet C2 (confidence level: 75%)
http://165.154.224.234:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://pressbookmedia.ro/2353253235325/content/login.htmlUnknown malware payload delivery URL (confidence level: 90%)
https://kingsviewpaving.com/Unknown malware payload delivery URL (confidence level: 90%)
https://grandcentralatelier.org/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 203

138.226.237.117Vidar botnet C2 server (confidence level: 100%)
157.180.44.87Vidar botnet C2 server (confidence level: 100%)
138.226.236.90Vidar botnet C2 server (confidence level: 100%)
195.96.129.177Mirai botnet C2 server (confidence level: 100%)
195.96.129.180Mirai botnet C2 server (confidence level: 100%)
34.134.154.94Unknown malware botnet C2 server (confidence level: 100%)
217.156.66.49Stealc botnet C2 server (confidence level: 100%)
5.182.86.73Stealc botnet C2 server (confidence level: 100%)
185.107.74.132SalatStealer botnet C2 server (confidence level: 100%)
41.216.188.104Cobalt Strike botnet C2 server (confidence level: 100%)

Hashes 186

ccae8271f93bb73783295b82ffc5e12a8a91f90eMimiKatz payload (confidence level: 95%)
27147eb56a4cda7125349c3e2973185ed389b28548a8dc5dde404bb84adebd68MimiKatz payload (confidence level: 95%)
e333839e75109d276c9d9319d7c812beMimiKatz payload (confidence level: 95%)
a7205cf9bb37a1a398ab5297fad18d51f6b3bc0dAsyncRAT payload (confidence level: 95%)
f41c17f9bba9c25464b3055ba41f032a93384306dc1c555f62ef4b83f44fe751AsyncRAT payload (confidence level: 95%)
6858a83678c2e5be6fd9d993efe45653AsyncRAT payload (confidence level: 95%)
803c412331f00427856d98fbc65ea74b299da4ccQuasar RAT payload (confidence level: 95%)
e582a6b95ad02b028a3cef7c8b0989cb9add3bba91008f43d80bde34e2dd22dfQuasar RAT payload (confidence level: 95%)
48108599b537d30e956b58a0d0bcb748Quasar RAT payload (confidence level: 95%)
162d8f78b9c48dc06713cc55e568b6f6e0ffd7d6AsyncRAT payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-01-08

Impact

For European organizations, the impact of this threat is currently limited due to the absence of known active exploits or targeted vulnerabilities. However, the presence of malware-related IOCs related to network activity and payload delivery suggests potential risks of intrusion attempts, data exfiltration, or lateral movement if attackers leverage these indicators effectively. Organizations relying heavily on OSINT tools or with exposed network services may face reconnaissance or exploitation attempts that could lead to compromise if not properly monitored. The medium severity rating reflects a moderate risk level, implying that while immediate damage is unlikely, the threat could evolve or be leveraged in targeted attacks. Disruption to confidentiality, integrity, or availability is possible but not confirmed. European entities with critical infrastructure or sensitive data could be indirectly affected if attackers use these IOCs as part of broader campaigns. The lack of patches or fixes means that defensive measures must focus on detection and response rather than remediation of software flaws. Overall, the threat represents a moderate operational risk requiring vigilance but not immediate alarm.

Defensive guidance

1. Integrate the provided IOCs into existing Security Information and Event Management (SIEM) and threat intelligence platforms to enhance detection capabilities. 2. Increase network traffic monitoring for unusual payload delivery patterns or suspicious connections that align with the threat's network activity profile. 3. Conduct regular OSINT monitoring to identify emerging related threats or updated IOCs from ThreatFox and other reputable sources. 4. Strengthen incident response procedures to quickly investigate and contain any alerts triggered by these IOCs. 5. Implement network segmentation and strict access controls to limit potential lateral movement if an intrusion occurs. 6. Educate security teams on the nature of OSINT-based threats and the importance of proactive threat hunting. 7. Collaborate with industry Information Sharing and Analysis Centers (ISACs) to share findings and receive updated intelligence. 8. Ensure endpoint protection solutions are up to date and capable of detecting payload delivery attempts. 9. Regularly review firewall and intrusion detection/prevention system (IDS/IPS) rules to adapt to emerging network threats. 10. Avoid reliance on patching for this threat, focusing instead on detection, monitoring, and response strategies.

Community reviews

Loading reviews…