IndicatorPublished 13 Mar 2026Updated 14 Mar 2026

type osint · ThreatFox IOCs for 2026-03-13

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 699

p5pywt.ironbay.in.netClearFake payload delivery domain (confidence level: 100%)
spoolfox.invulshuga.in.netClearFake payload delivery domain (confidence level: 100%)
stitchroo.directkorchaga.in.netClearFake payload delivery domain (confidence level: 100%)
ohqr.migratetulle.in.netClearFake payload delivery domain (confidence level: 100%)
scarnetwor.liberalpilka.in.netClearFake payload delivery domain (confidence level: 100%)
mucandagroup.comStrelaStealer payload delivery domain (confidence level: 100%)
vorcoreix1.liberalpilka.in.netClearFake payload delivery domain (confidence level: 100%)
novocrematoriodocaju.com.brStrelaStealer payload delivery domain (confidence level: 100%)
muffinsandmeat.comStrelaStealer payload delivery domain (confidence level: 100%)
vfjpe.liberalpilka.in.netClearFake payload delivery domain (confidence level: 100%)

URLs 96

http://217.69.11.99/q6auyyaaatxzpcw2im8xfg%3d%3dGlassWorm payload delivery URL (confidence level: 100%)
http://217.69.11.99/module/wrtcGlassWorm payload delivery URL (confidence level: 95%)
http://217.69.11.99:4789/socket.io/GlassWorm botnet C2 (confidence level: 100%)
https://pnsoc.com/Unknown malware payload delivery URL (confidence level: 90%)
https://www.amani-limousines.com/Unknown malware payload delivery URL (confidence level: 90%)
https://coffsharbourshowsociety.com.au/Unknown malware payload delivery URL (confidence level: 90%)
https://vitrouksecurity.com/Unknown malware payload delivery URL (confidence level: 90%)
https://pillarcr.com/Unknown malware payload delivery URL (confidence level: 90%)
https://impenco.com/Unknown malware payload delivery URL (confidence level: 90%)
https://hdriverexcursions.com/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 121

217.69.11.99GlassWorm botnet C2 server (confidence level: 100%)
217.69.11.99GlassWorm botnet C2 server (confidence level: 100%)
208.85.20.124GlassWorm botnet C2 server (confidence level: 100%)
216.224.116.143Remcos botnet C2 server (confidence level: 100%)
124.198.131.99Remcos botnet C2 server (confidence level: 100%)
45.74.48.68Remcos botnet C2 server (confidence level: 100%)
171.22.16.187Unknown RAT botnet C2 server (confidence level: 100%)
66.42.57.178Sliver botnet C2 server (confidence level: 100%)
45.32.121.84AdaptixC2 botnet C2 server (confidence level: 100%)
199.101.111.234Meterpreter botnet C2 server (confidence level: 100%)

Hashes 5

b73ce45f837e67b2f81565c63c8601ec0b89360101331f89fc6821e2fb60a7f6XWorm payload (confidence level: 100%)
ecdaa31802b6a8ef94fbc3f16da5068c6f126876af0b9c964a915a556194a1f9XWorm payload (confidence level: 100%)
656991f4dabe0e5d989be730dac86a2cf294b6b538b08d7db7a0a72f0c6c484bXWorm payload (confidence level: 100%)
34e90568af4dcd40f4f04174ec326e2aXWorm payload (confidence level: 100%)
50e412156c1f88ebf22be14490a57fb6Unknown RAT payload (confidence level: 100%)

Description

ThreatFox IOCs for 2026-03-13

Impact

Given the lack of specific exploit details or affected systems, the direct impact of this threat is currently limited. However, the categorization under payload delivery and network activity suggests potential for initial compromise or lateral movement if leveraged by attackers. Organizations worldwide could face risks related to reconnaissance activities that precede more severe attacks. The medium severity rating indicates moderate risk to confidentiality, integrity, and availability, primarily through potential unauthorized access or data exfiltration if payload delivery succeeds. Since no known exploits or patches exist, the threat may represent emerging malware or attack techniques that could evolve. The absence of user interaction or authentication requirements is unclear, but the OSINT focus suggests attackers might use publicly available information to tailor attacks, increasing their effectiveness. Overall, the impact is moderate but could escalate if further technical details or active exploitation emerge.

Defensive guidance

1. Continuously monitor threat intelligence feeds, including ThreatFox and MISP, for updates or new indicators related to this threat. 2. Implement robust network monitoring to detect unusual payload delivery or network activity patterns indicative of reconnaissance or early-stage attacks. 3. Employ endpoint detection and response (EDR) solutions capable of identifying suspicious behaviors associated with malware payloads. 4. Conduct regular OSINT assessments to understand what information about the organization is publicly available and limit exposure. 5. Harden network segmentation to contain potential payload delivery and lateral movement. 6. Train security teams to recognize early signs of reconnaissance and payload delivery tactics. 7. Maintain up-to-date incident response plans that include procedures for handling emerging malware threats without known patches or exploits. 8. Collaborate with information sharing groups to gain insights into evolving threats and mitigation strategies. These steps go beyond generic advice by emphasizing proactive intelligence monitoring, behavioral detection, and organizational information exposure management.

Community reviews

Loading reviews…