IndicatorPublished 25 Feb 2026Updated 26 Feb 2026

ThreatFox IOCs for 2026-02-25

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 103

misangamoon.blogStrelaStealer payload delivery domain (confidence level: 100%)
missalromano.com.brStrelaStealer payload delivery domain (confidence level: 100%)
missioninaction.deStrelaStealer payload delivery domain (confidence level: 100%)
mistwaresolutions.comStrelaStealer payload delivery domain (confidence level: 100%)
miusictherapy.comStrelaStealer payload delivery domain (confidence level: 100%)
mjcabocustomsolutions.comStrelaStealer payload delivery domain (confidence level: 100%)
mkankw.comStrelaStealer payload delivery domain (confidence level: 100%)
br7us6.sa.comAsyncRAT botnet C2 domain (confidence level: 100%)
dvv.uk.comAsyncRAT botnet C2 domain (confidence level: 100%)
82vna.it.comAsyncRAT botnet C2 domain (confidence level: 100%)

URLs 34

https://www.gieable.shop/Unknown malware payload delivery URL (confidence level: 90%)
http://83.142.209.9/ohshit.shUnknown malware payload delivery URL (confidence level: 75%)
http://143.92.60.13:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://wtf.it-bd.com/Vidar botnet C2 (confidence level: 100%)
https://wtf.cardiffphysio.com/Vidar botnet C2 (confidence level: 100%)
https://hlk.it-bd.com/Vidar botnet C2 (confidence level: 100%)
https://hlk.cardiffphysio.com/Vidar botnet C2 (confidence level: 100%)
http://213.176.73.129/api/nte3yjdjnwu1njyznju2yta1n2y=SmartLoader botnet C2 (confidence level: 75%)
https://213.159.79.103/c619c3a3bc843eb0.phpStealc botnet C2 (confidence level: 50%)
https://65.21.200.30/1b8295a7e0284b08.phpStealc botnet C2 (confidence level: 50%)

IP addresses 344

124.198.132.120Remcos botnet C2 server (confidence level: 100%)
191.107.91.72Remcos botnet C2 server (confidence level: 100%)
51.75.62.52Sliver botnet C2 server (confidence level: 100%)
206.206.127.178SectopRAT botnet C2 server (confidence level: 100%)
54.82.61.154Unknown malware botnet C2 server (confidence level: 100%)
172.94.9.106Bashlite botnet C2 server (confidence level: 100%)
38.132.122.134AdaptixC2 botnet C2 server (confidence level: 100%)
52.27.144.112Meterpreter botnet C2 server (confidence level: 100%)
54.67.27.207Meterpreter botnet C2 server (confidence level: 100%)
54.67.27.207Meterpreter botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2026-02-25

Impact

Given the limited information and absence of known exploits or targeted affected versions, the immediate impact of this threat is likely low to medium. Organizations worldwide may face increased risk of malware infections through network-based payload delivery if these IOCs correspond to emerging malware campaigns. The threat could lead to unauthorized access, data exfiltration, or disruption if exploited, but no direct evidence suggests widespread active exploitation at this time. The medium severity rating reflects potential risks to confidentiality, integrity, and availability, particularly if the malware payloads evolve or are integrated into broader attack campaigns. The lack of patches or mitigation guidance means organizations must rely on detection and prevention strategies rather than remediation. The impact is more pronounced for entities with extensive network exposure or those lacking robust threat intelligence integration. Overall, while not immediately critical, the threat warrants attention to prevent escalation and to enhance early detection capabilities.

Defensive guidance

Organizations should integrate the latest ThreatFox IOCs into their security information and event management (SIEM) systems and endpoint detection and response (EDR) tools to enhance detection capabilities. Network monitoring should be intensified to identify unusual payload delivery activities, especially those matching the provided IOCs once available. Employ strict network segmentation and enforce least privilege access to limit potential malware spread. Regularly update and tune intrusion detection/prevention systems (IDS/IPS) to recognize emerging malware signatures. Conduct threat hunting exercises focused on network activity anomalies and payload delivery patterns. Since no patches are available, emphasize proactive defense measures such as user awareness training to recognize phishing or social engineering attempts that could deliver malware. Collaborate with threat intelligence sharing communities to receive timely updates and contextual information. Finally, maintain robust backup and recovery procedures to mitigate potential ransomware or destructive payload impacts.

Community reviews

Loading reviews…