IndicatorPublished 2 Mar 2026Updated 3 Mar 2026

ThreatFox IOCs for 2026-03-02

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 342

78smp.comUnknown Stealer botnet C2 domain (confidence level: 100%)
satanc2.topMirai botnet C2 domain (confidence level: 50%)
mount-atlas.deStrelaStealer payload delivery domain (confidence level: 100%)
movetorecover.beStrelaStealer payload delivery domain (confidence level: 100%)
mradsafety.comStrelaStealer payload delivery domain (confidence level: 100%)
mrbdl.comStrelaStealer payload delivery domain (confidence level: 100%)
mrpc.pramnos.netStrelaStealer payload delivery domain (confidence level: 100%)
ms-landtechnik.comStrelaStealer payload delivery domain (confidence level: 100%)
msi.marketstockindo.comStrelaStealer payload delivery domain (confidence level: 100%)
msicpl.comStrelaStealer payload delivery domain (confidence level: 100%)

URLs 67

https://74.0.48.25/Vidar botnet C2 (confidence level: 100%)
https://pastebin.com/raw/rq7ymk0wXWorm botnet C2 (confidence level: 50%)
https://telegram.me/m0r5hlVidar botnet C2 (confidence level: 50%)
https://steamcommunity.com/profiles/76561198733506974Vidar botnet C2 (confidence level: 100%)
https://pay.it-bd.com/Vidar botnet C2 (confidence level: 100%)
https://pay.cardiffphysio.com/Vidar botnet C2 (confidence level: 100%)
https://hro.it-bd.com/Vidar botnet C2 (confidence level: 100%)
https://hro.cardiffphysio.com/Vidar botnet C2 (confidence level: 100%)
https://ctl.it-bd.com/Vidar botnet C2 (confidence level: 100%)
https://ctl.cardiffphysio.com/Vidar botnet C2 (confidence level: 100%)

IP addresses 163

137.184.215.213Aisuru botnet C2 server (confidence level: 100%)
156.239.225.187ValleyRAT botnet C2 server (confidence level: 100%)
31.57.216.44Remcos botnet C2 server (confidence level: 100%)
47.239.240.171ValleyRAT botnet C2 server (confidence level: 100%)
180.76.111.89Cobalt Strike botnet C2 server (confidence level: 100%)
1.94.186.19Cobalt Strike botnet C2 server (confidence level: 100%)
150.241.73.11Cobalt Strike botnet C2 server (confidence level: 100%)
59.110.166.104Cobalt Strike botnet C2 server (confidence level: 100%)
192.52.242.73Unknown malware botnet C2 server (confidence level: 75%)
185.121.235.118Amatera botnet C2 server (confidence level: 75%)

Description

ThreatFox IOCs for 2026-03-02

Impact

The potential impact of this threat is currently limited due to the lack of specific exploit details or active campaigns. However, the involvement of payload delivery and network activity categories suggests that if leveraged, this threat could facilitate malware infections, data exfiltration, or network disruptions. Organizations worldwide could face risks of intrusion attempts or malware deployment if threat actors utilize these IOCs effectively. The absence of patches or mitigations means that defensive measures rely heavily on detection and response capabilities. Without concrete indicators, the ability to preemptively block or contain the threat is reduced, potentially increasing exposure. The medium severity rating indicates a moderate risk level, where successful exploitation could impact confidentiality and integrity but is unlikely to cause widespread availability issues or critical system failures at this stage. The threat intelligence is valuable for enhancing situational awareness and refining network monitoring but does not currently represent an immediate, high-impact threat.

Defensive guidance

Given the nature of this threat intelligence update, organizations should focus on enhancing their detection and monitoring capabilities rather than applying specific patches. Practical recommendations include: 1) Integrate ThreatFox and other OSINT feeds into Security Information and Event Management (SIEM) systems to automate IOC ingestion and alerting. 2) Conduct network traffic analysis to identify unusual payload delivery patterns or suspicious network activity consistent with the threat categories. 3) Employ endpoint detection and response (EDR) tools to monitor for anomalous behavior indicative of malware execution. 4) Maintain up-to-date threat hunting procedures to proactively search for signs of compromise related to emerging malware campaigns. 5) Educate security teams on interpreting OSINT data and correlating it with internal telemetry for timely incident response. 6) Collaborate with information sharing communities to receive updated indicators and contextual intelligence. 7) Implement strict network segmentation and access controls to limit potential lateral movement if a payload delivery attempt succeeds. These measures go beyond generic advice by emphasizing integration of OSINT feeds, proactive threat hunting, and operational readiness to detect and respond to evolving malware threats.

Community reviews

Loading reviews…