IndicatorPublished 22 Jan 2026Updated 23 Jan 2026

ThreatFox IOCs for 2026-01-22

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 121

ddy.alipico.comVidar botnet C2 domain (confidence level: 100%)
blushwb.cyouLumma Stealer botnet C2 domain (confidence level: 50%)
discret.cyouLumma Stealer botnet C2 domain (confidence level: 50%)
trichoi.cyouLumma Stealer botnet C2 domain (confidence level: 50%)
unchewq.cyouLumma Stealer botnet C2 domain (confidence level: 50%)
easyrce.eu.orgCobalt Strike botnet C2 domain (confidence level: 75%)
xyt.cpolar.topCobalt Strike botnet C2 domain (confidence level: 75%)
homecenter.co.comQuasar RAT botnet C2 domain (confidence level: 75%)
ppinacon.za.comQuasar RAT botnet C2 domain (confidence level: 75%)
lacemeup-64707.portmap.hostXWorm botnet C2 domain (confidence level: 100%)

URLs 92

https://mail.nmreitgroup.com/Unknown malware payload delivery URL (confidence level: 90%)
https://mail.wetooktheplunge.com/Unknown malware payload delivery URL (confidence level: 90%)
https://kastechnologies.net/Unknown malware payload delivery URL (confidence level: 90%)
https://mail.lacasadeltexu.com/Unknown malware payload delivery URL (confidence level: 90%)
https://mail.mamahdannirwana.com/Unknown malware payload delivery URL (confidence level: 90%)
https://lafabri-k.com/Unknown malware payload delivery URL (confidence level: 90%)
https://astrologiahindu.com.br/Unknown malware payload delivery URL (confidence level: 90%)
https://mail.e1staffingandrecruiting.com/Unknown malware payload delivery URL (confidence level: 90%)
https://jadd.draftus.net/Unknown malware payload delivery URL (confidence level: 90%)
https://interstate.myinvestment.properties/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 210

91.215.85.42Unknown malware botnet C2 server (confidence level: 100%)
5.196.243.97Unknown malware botnet C2 server (confidence level: 100%)
193.26.115.189Remcos botnet C2 server (confidence level: 100%)
130.12.182.224Remcos botnet C2 server (confidence level: 100%)
124.198.131.156Remcos botnet C2 server (confidence level: 100%)
176.65.151.217Remcos botnet C2 server (confidence level: 100%)
34.64.98.201pupy botnet C2 server (confidence level: 100%)
82.153.138.218Sliver botnet C2 server (confidence level: 100%)
13.244.65.215Meterpreter botnet C2 server (confidence level: 100%)
18.183.226.125Meterpreter botnet C2 server (confidence level: 100%)

Hashes 163

191ee35d59e9a5931693a774419205bd3055408f449328a4d129ea2a4e61c19cRedLine Stealer payload (confidence level: 50%)
f32c61ebde695d06cd1764c58f209d60Nitrogen Ransomware payload (confidence level: 100%)
d5aa41e1c40dd5fea93db920292829baNitrogen Ransomware payload (confidence level: 100%)
e2117bc07b94af5db09d1e8139b9774aNitrogen Ransomware payload (confidence level: 100%)
a90c3969bcd05e191205da92fd43c88fNitrogen Ransomware payload (confidence level: 100%)
67bc6e3b82515dffeb04328c7f8a1322Nitrogen Ransomware payload (confidence level: 100%)
97c636d3ec31cd21e118284c4c92e5bbNitrogen Ransomware payload (confidence level: 100%)
ad61b949f2c3d8a8936305da847f2ab6Nitrogen Ransomware payload (confidence level: 100%)
150a0d59b5c6e86985b3315e1aaa103eNitrogen Ransomware payload (confidence level: 100%)
1b637a43abca552acaee11c01913db18Nitrogen Ransomware payload (confidence level: 100%)

Description

ThreatFox IOCs for 2026-01-22

Impact

For European organizations, the impact of this threat depends largely on the relevance and applicability of the IOCs to their environments. If the malware payloads or network activity patterns correspond to tools used by threat actors targeting European sectors, there could be risks of data exfiltration, system compromise, or lateral movement within networks. The medium severity indicates that while the threat is not currently critical, it could facilitate further attacks if leveraged effectively. Industries with high-value data or critical infrastructure, such as finance, manufacturing, and government, may face increased risk. The lack of known exploits in the wild reduces immediate urgency but does not eliminate the possibility of future exploitation. Continuous monitoring and integration of these IOCs into detection systems can help mitigate potential impacts. Failure to do so could result in delayed detection of malware infections or network intrusions.

Defensive guidance

European organizations should incorporate the provided IOCs from ThreatFox into their Security Information and Event Management (SIEM) systems and endpoint detection and response (EDR) tools to enhance detection capabilities. Network traffic should be monitored for anomalous patterns consistent with payload delivery or suspicious network activity. Organizations should conduct regular threat hunting exercises using updated OSINT feeds to identify early signs of compromise. Since no patches are available, emphasis should be placed on proactive detection and containment strategies, including network segmentation and strict access controls to limit lateral movement. Employee awareness programs should reinforce cautious handling of suspicious emails or downloads that could serve as initial infection vectors. Collaboration with national Computer Security Incident Response Teams (CSIRTs) and information sharing platforms can improve situational awareness. Finally, organizations should maintain up-to-date backups and incident response plans to minimize operational disruption in case of infection.

Community reviews

Loading reviews…