IndicatorPublished 13 Jan 2026Updated 14 Jan 2026

ThreatFox IOCs for 2026-01-13

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 70

gallery.lorellaparis.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
weedhack.cyUnknown malware botnet C2 domain (confidence level: 100%)
receiver.cyUnknown malware payload delivery domain (confidence level: 100%)
bimonwz.cyouLumma Stealer payload delivery domain (confidence level: 75%)
inconzy.cyouLumma Stealer payload delivery domain (confidence level: 75%)
swimglii.cyouLumma Stealer payload delivery domain (confidence level: 75%)
schemaqa.cyouLumma Stealer payload delivery domain (confidence level: 75%)
rumordoz.cyouLumma Stealer payload delivery domain (confidence level: 75%)
triniliu.cyouLumma Stealer payload delivery domain (confidence level: 75%)
reveiley.cyouLumma Stealer payload delivery domain (confidence level: 75%)

URLs 38

https://noelgascon.cmu-online.tech/demo_ci3/application/config/Unknown malware payload delivery URL (confidence level: 90%)
https://stransdeport.su/Unknown malware payload delivery URL (confidence level: 90%)
https://receiver.cy/files/jar/moduleUnknown malware payload delivery URL (confidence level: 100%)
https://creditreview.sg/Unknown malware payload delivery URL (confidence level: 90%)
https://exploringthenorth.com/Unknown malware payload delivery URL (confidence level: 90%)
https://alertblitz.com/Unknown malware payload delivery URL (confidence level: 90%)
https://www.postcard-ua.com.ua/Unknown malware payload delivery URL (confidence level: 90%)
https://resodanse-salsa.ch/Unknown malware payload delivery URL (confidence level: 90%)
https://med.erom-e.com/Vidar botnet C2 (confidence level: 100%)
https://med.zeronoiseclassroom.com/Vidar botnet C2 (confidence level: 100%)

IP addresses 18,123

77.110.121.209Unknown malware botnet C2 server (confidence level: 100%)
193.29.187.173Mirai botnet C2 server (confidence level: 80%)
113.46.149.97Unknown malware botnet C2 server (confidence level: 100%)
113.46.149.97Unknown malware botnet C2 server (confidence level: 100%)
113.46.149.97Unknown malware botnet C2 server (confidence level: 100%)
113.46.149.97Unknown malware botnet C2 server (confidence level: 100%)
5.8.18.106Stealc botnet C2 server (confidence level: 100%)
82.29.96.59Nanocore RAT botnet C2 server (confidence level: 100%)
113.46.149.97Unknown malware botnet C2 server (confidence level: 100%)
113.46.149.97Unknown malware botnet C2 server (confidence level: 100%)

Hashes 227

d46ed20fae16538f2f70b752062405d38b3b8504Remcos payload (confidence level: 95%)
392f6b46f45bad21bf7e18de9d62f46651516f7e1b89e2581a1e4e7f71df141bRemcos payload (confidence level: 95%)
8eab9c3ac312c3d690ee04fbb4ea5f18Remcos payload (confidence level: 95%)
82ff5547e054ca0b65e78a8b4cd0cbc8113aa954Nanocore RAT payload (confidence level: 95%)
07b1bebd0c55d38a2371ff40d911cab6cad9941d69c5ffe93679bce07ceb577fNanocore RAT payload (confidence level: 95%)
347c2d3659d1b38ad916da64d15726abNanocore RAT payload (confidence level: 95%)
a31e7829c15a73674c7f2d44492c083a23b88160Coinminer payload (confidence level: 95%)
b707635382df3b04219a8723ebda5db41eb04312c9433acbe097e43309fe49d7Coinminer payload (confidence level: 95%)
2ef28b674df405009de9350343249f61Coinminer payload (confidence level: 95%)
cfa5bc8de22bc1f9b0661cbf5146015238a37a75NjRAT payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-01-13

Impact

For European organizations, the impact of this threat is currently moderate. Since no specific software vulnerabilities or exploits are identified, the primary risk lies in potential malware infections through payload delivery mechanisms and associated network activity. Organizations relying heavily on OSINT tools or those with complex network infrastructures may face increased exposure if these IOCs correspond to targeted campaigns. The threat could lead to unauthorized access, data exfiltration, or disruption if payloads are successfully delivered and executed. However, the absence of known active exploitation and patches suggests that immediate widespread damage is unlikely. The medium severity indicates that while vigilance is necessary, this threat does not currently pose a critical risk to confidentiality, integrity, or availability at a large scale. Nonetheless, failure to detect or respond to these indicators could allow attackers to establish footholds or conduct reconnaissance within networks.

Defensive guidance

European organizations should integrate the provided IOCs into their existing security monitoring and threat detection systems, such as SIEMs and IDS/IPS solutions, to enhance early detection capabilities. Network traffic should be closely monitored for unusual payload delivery patterns or suspicious network activity matching the IOC profiles. Endpoint detection and response (EDR) tools should be updated to recognize behaviors associated with the identified malware. Since no patches are available, emphasis should be placed on proactive threat hunting and anomaly detection. Security teams should also review and tighten network segmentation to limit lateral movement in case of infection. Regular employee awareness training on phishing and social engineering can reduce the risk of initial payload delivery. Collaboration with threat intelligence sharing platforms and participation in information sharing communities can provide timely updates on evolving indicators. Finally, organizations should ensure robust incident response plans are in place to quickly contain and remediate infections if detected.

Community reviews

Loading reviews…