IndicatorPublished 15 Mar 2026Updated 16 Mar 2026

type osint · ThreatFox IOCs for 2026-03-15

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 428

ai-process-guide.cfdClearFake payload delivery domain (confidence level: 100%)
florixeo.usClearFake payload delivery domain (confidence level: 50%)
open-space-1.silberpfad.in.netClearFake payload delivery domain (confidence level: 100%)
steel-base-7.grandevision.in.netClearFake payload delivery domain (confidence level: 100%)
nanaonsol.lolUnknown malware payload delivery domain (confidence level: 100%)
sat-uplink-5.grandevision.in.netClearFake payload delivery domain (confidence level: 100%)
infra-web-01.metallocielo.in.netClearFake payload delivery domain (confidence level: 100%)
api-app.uppercrafteroom.comFAKEUPDATES payload delivery domain (confidence level: 100%)
main-point-1.metallocielo.in.netClearFake payload delivery domain (confidence level: 100%)
cdn-static-v5.petitnuage.in.netClearFake payload delivery domain (confidence level: 100%)

URLs 128

https://virtual-cdncloud.sbs/api/index.phpUnknown malware payload delivery URL (confidence level: 100%)
http://185.242.245.69:5000/dforecast/p2/e70d098aace7414caa01272494f1c947IClickFix payload delivery URL (confidence level: 90%)
https://wellnessmedcare.org/buch/favorites/document.doc.lnkBEARDSHELL payload delivery URL (confidence level: 100%)
https://freefoodaid.com/ankara/favorites/document.doc.lnkBEARDSHELL payload delivery URL (confidence level: 100%)
http://158.94.211.208/oboxw2026.txtXWorm payload delivery URL (confidence level: 95%)
http://tve-mail.com/forum/index.phpAmadey botnet C2 (confidence level: 100%)
http://sibcomputer.ruAmadey botnet C2 (confidence level: 100%)
http://webcdns.com:2083/static-directory/lt.mp3Cobalt Strike botnet C2 (confidence level: 75%)
http://ndocfpass.dns.army/Kimsuky botnet C2 (confidence level: 50%)
http://ndocabpass.dynv6.net/Kimsuky botnet C2 (confidence level: 50%)

IP addresses 100

185.242.245.69IClickFix payload delivery server (confidence level: 90%)
193.187.148.169BEARDSHELL payload delivery server (confidence level: 50%)
23.227.202.14BEARDSHELL payload delivery server (confidence level: 100%)
72.62.185.31BEARDSHELL payload delivery server (confidence level: 100%)
159.253.120.2BEARDSHELL payload delivery server (confidence level: 100%)
156.234.205.157Cobalt Strike botnet C2 server (confidence level: 100%)
172.111.139.201Remcos botnet C2 server (confidence level: 100%)
107.175.148.79Remcos botnet C2 server (confidence level: 100%)
34.235.124.31Sliver botnet C2 server (confidence level: 100%)
137.184.38.192AsyncRAT botnet C2 server (confidence level: 100%)

Hashes 26

77cfee64e0634bf8e0ccac9264f9915c1122619b86e3c18236224c4006ecf52fIClickFix payload (confidence level: 90%)
4b78364cb434ab7380a20b48f79ebcfb8f1a0e90488887f8c890d9a696c903bdIClickFix payload (confidence level: 90%)
1456fa7b402fe0fcc4997d62a6216e5656530068b7cb3534cfe5cdf841ee61ecIClickFix payload (confidence level: 90%)
ed130e3df72984c816fe23f9f61f0ae01478840d1227015df4e44685523abbd9ClearFake payload (confidence level: 85%)
f6c1d093b76a18ffbe8fcafd2e29402a2c9ddf51a1ee80ce218059a10b79edabClearFake payload (confidence level: 85%)
06d8a0195397fbc996eca2f8480dd180300628bbbc192e69145686b9e4f409a9ClearFake payload (confidence level: 85%)
c8fe0393370dd2bd98e3bd9c9f24574df794eab70e21c964bb2c2e9b7e460a2dGhost RAT payload (confidence level: 75%)
e82aa52c376912a39be0403aceb9281e5d6a39b39bab48af0e43e2cebdd1c6f2Ghost RAT payload (confidence level: 75%)
7303323e80e09def96d34e21b6df3d975cd1f5d01d56fb1dab15e3b29e0685e5ValleyRAT payload (confidence level: 75%)
7c4bbb982d99092ee208ef3f21e8a07b09cb3b10b19c2d5a26ee8c2a3d6e4a1dValleyRAT payload (confidence level: 75%)

Description

ThreatFox IOCs for 2026-03-15

Impact

The primary impact of this threat intelligence release is on the detection and response capabilities of organizations rather than direct exploitation or system compromise. By integrating these IOCs into security monitoring tools such as SIEMs, IDS/IPS, and endpoint detection platforms, organizations can improve their ability to identify and block malware-related activities early. Failure to incorporate such intelligence may result in delayed detection of malware payload delivery attempts or network intrusions. Since no active exploits or patches are noted, the immediate risk to confidentiality, integrity, or availability is low to medium. However, the broad distribution of the indicators suggests that multiple organizations globally could encounter related malicious activity. The impact is thus more strategic, enhancing situational awareness and preparedness rather than indicating an urgent operational threat. Organizations lacking mature threat intelligence processes may be at a disadvantage in detecting these threats promptly.

Defensive guidance

1. Integrate the provided IOCs into existing security monitoring and detection systems, including SIEM, IDS/IPS, endpoint protection, and firewall rules. 2. Regularly update threat intelligence feeds and ensure automated ingestion of OSINT sources like ThreatFox to maintain current detection capabilities. 3. Conduct threat hunting exercises using these IOCs to identify any latent or ongoing malicious activity within the network. 4. Enhance network segmentation and monitoring of outbound traffic to detect unusual payload delivery attempts. 5. Train security operations teams to recognize patterns associated with the types of malware and network activity indicated by these IOCs. 6. Collaborate with industry information sharing groups to validate and enrich the intelligence data. 7. Maintain robust incident response plans to quickly contain and remediate infections if detected. 8. Since no patches are available, focus on detection and containment rather than remediation of a vulnerability. 9. Review and harden email and web gateway defenses to reduce the risk of payload delivery. 10. Monitor for updates from ThreatFox and other intelligence sources for any changes in threat status or new indicators.

Community reviews

Loading reviews…