IndicatorPublished 17 Feb 2026Updated 18 Feb 2026

ThreatFox IOCs for 2026-02-17

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 149

sfkjsdhfsdfsdhsken.cfdStealc botnet C2 domain (confidence level: 100%)
regancontrols.comEtherRAT botnet C2 domain (confidence level: 75%)
hayesmed.comEtherRAT botnet C2 domain (confidence level: 75%)
goldenapple.runtime-error-handler.couponsClearFake payload delivery domain (confidence level: 100%)
wildriver.runtime-error-handler.couponsClearFake payload delivery domain (confidence level: 100%)
smartcloud.sandbox-proxy-diagnostic.couponsClearFake payload delivery domain (confidence level: 100%)
redstone.sandbox-proxy-diagnostic.couponsClearFake payload delivery domain (confidence level: 100%)
freshbreeze.sandbox-proxy-diagnostic.couponsClearFake payload delivery domain (confidence level: 100%)
darkriver.swiftmotion.couponsClearFake payload delivery domain (confidence level: 100%)
fastsky.swiftmotion.couponsClearFake payload delivery domain (confidence level: 100%)

URLs 19

https://193.222.99.212/Unknown malware payload delivery URL (confidence level: 90%)
https://littlep.top/apiLumma Stealer botnet C2 (confidence level: 100%)
http://192.168.158.128:80/jquery-3.3.2.slim.min.jsCobalt Strike botnet C2 (confidence level: 75%)
https://pnl.gadgetwalabd.com/Vidar botnet C2 (confidence level: 100%)
https://pnl.alpinematters.com/Vidar botnet C2 (confidence level: 100%)
https://89.167.61.22/Vidar botnet C2 (confidence level: 100%)
https://172.86.126.99/Vidar botnet C2 (confidence level: 100%)
https://188.245.84.214/Vidar botnet C2 (confidence level: 100%)
https://46.225.141.150/Vidar botnet C2 (confidence level: 100%)
https://188.245.95.148/Vidar botnet C2 (confidence level: 100%)

IP addresses 117

16.78.248.241XWorm botnet C2 server (confidence level: 100%)
152.89.162.5Remcos botnet C2 server (confidence level: 100%)
138.199.59.4Remcos botnet C2 server (confidence level: 100%)
172.94.9.74Remcos botnet C2 server (confidence level: 100%)
107.152.32.98XWorm botnet C2 server (confidence level: 100%)
95.148.150.125XWorm botnet C2 server (confidence level: 100%)
34.92.40.186Cobalt Strike botnet C2 server (confidence level: 100%)
107.189.22.184Remcos botnet C2 server (confidence level: 100%)
172.111.162.252Remcos botnet C2 server (confidence level: 100%)
164.90.161.126Unknown malware botnet C2 server (confidence level: 100%)

Hashes 234

c517be80bc72c211e3e696b16b2f3364319e8994Formbook payload (confidence level: 95%)
79dcb6bdf84fdae64873b6fe27c9d52bf30cb4d7c545b13035cfdbe4adb12182Formbook payload (confidence level: 95%)
4cf79e655c7be81f8c58d261671fa917Formbook payload (confidence level: 95%)
509751ad0b44d4a81c60bca99836f12ef1f8d5c1SalatStealer payload (confidence level: 95%)
95c7967cfe51c64656f07e14b5ea3c59ddc0ce36d02e38cd57ce415a82238928SalatStealer payload (confidence level: 95%)
6fde7a2040b6bfa3a8f84a00539aa2caSalatStealer payload (confidence level: 95%)
a58bb4ab71ad8c475287fbfe09fa2d7195995705SalatStealer payload (confidence level: 95%)
b7cfd798fe6c5c8ccd5fa0b7953025dcf264a91e963cf08f38f3d676d1c9fa26SalatStealer payload (confidence level: 95%)
46402595842b76a4814bab429473e088SalatStealer payload (confidence level: 95%)
dc8fce3cb5247744f68908a11b04813c55c42589SalatStealer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2026-02-17

Impact

The potential impact on European organizations is currently limited due to the lack of specific exploit details or active campaigns. However, the presence of payload delivery and network activity categories suggests that the threat actors may be preparing or conducting reconnaissance or initial infection stages. If leveraged, such malware could compromise confidentiality, integrity, or availability depending on the payload delivered. European organizations that rely heavily on networked infrastructure and have complex supply chains could be at risk if these IOCs correspond to emerging threats. The medium severity rating reflects moderate concern but no immediate widespread impact. Organizations lacking advanced threat intelligence capabilities might miss early warnings, potentially increasing their exposure. The absence of patches or known exploits indicates that mitigation relies on detection and prevention rather than remediation of a vulnerability. Overall, the impact is more strategic and preparatory, emphasizing the importance of proactive monitoring and intelligence sharing.

Defensive guidance

1. Integrate ThreatFox and similar OSINT feeds into existing Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to enable automated detection of related IOCs. 2. Conduct regular network traffic analysis focusing on unusual payload delivery attempts or anomalous network activity patterns that could indicate early-stage malware deployment. 3. Enhance employee awareness and training on phishing and social engineering tactics that often precede payload delivery. 4. Implement strict network segmentation and least privilege access controls to limit lateral movement if initial compromise occurs. 5. Maintain up-to-date threat hunting procedures that incorporate emerging IOCs from OSINT sources to identify potential stealthy intrusions. 6. Collaborate with national and European cybersecurity centers to share intelligence and receive timely alerts on evolving threats. 7. Regularly review and update incident response plans to include scenarios involving unknown or emerging malware indicated by OSINT feeds. These steps go beyond generic advice by emphasizing integration of threat intelligence, proactive network monitoring, and inter-organizational collaboration.

Community reviews

Loading reviews…