IndicatorPublished 26 Mar 2026Updated 27 Mar 2026

type osint · ThreatFox IOCs for 2026-03-26

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 342

events.wealth-london.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
bulletproofdomai2n.comUnknown Stealer botnet C2 domain (confidence level: 100%)
moondev.digitalClearFake payload delivery domain (confidence level: 100%)
ces.yeyr.lolHook botnet C2 domain (confidence level: 100%)
triage-test.evilpony.winHavoc botnet C2 domain (confidence level: 100%)
svc4static.blueoak.in.netClearFake payload delivery domain (confidence level: 100%)
ext1meta.darkbay.in.netClearFake payload delivery domain (confidence level: 100%)
ext2proc.darkbay.in.netClearFake payload delivery domain (confidence level: 100%)
ext3gate.darkbay.in.netClearFake payload delivery domain (confidence level: 100%)
ext4sync.darkbay.in.netClearFake payload delivery domain (confidence level: 100%)

URLs 35

https://urotypos.com/dd/tmpSmartApeSG payload delivery URL (confidence level: 100%)
https://se.tsukivpn.ru:443/Cobalt Strike botnet C2 (confidence level: 50%)
https://chinasite.com.br/msi_180922.pngXpertRAT payload delivery URL (confidence level: 75%)
https://tiger.kesug.com/img_053646.pngXpertRAT payload delivery URL (confidence level: 75%)
https://159.89.20.198Vidar botnet C2 (confidence level: 75%)
https://46.224.162.148/Vidar botnet C2 (confidence level: 100%)
https://204.168.190.65/Vidar botnet C2 (confidence level: 100%)
https://31.57.201.151/Vidar botnet C2 (confidence level: 100%)
https://isf.syslicense.net/Vidar botnet C2 (confidence level: 100%)
https://isf.ssffaa4.xyz/Vidar botnet C2 (confidence level: 100%)

IP addresses 141

104.131.55.144Aisuru botnet C2 server (confidence level: 100%)
138.197.75.250Aisuru botnet C2 server (confidence level: 100%)
159.65.32.78Aisuru botnet C2 server (confidence level: 100%)
159.203.46.99Aisuru botnet C2 server (confidence level: 100%)
143.110.214.167Aisuru botnet C2 server (confidence level: 100%)
143.110.212.191Aisuru botnet C2 server (confidence level: 100%)
143.198.35.193Aisuru botnet C2 server (confidence level: 100%)
159.203.40.220Aisuru botnet C2 server (confidence level: 100%)
178.128.226.244Aisuru botnet C2 server (confidence level: 100%)
143.198.35.11Aisuru botnet C2 server (confidence level: 100%)

Hashes 7

b2204e8635b84670d8f18932db005dece6c5846e5cb012cf40888727bbe678c8Cobalt Strike payload (confidence level: 50%)
737a630bff6234403fe00d74991338a2f730632766cd29477f0d4ad763c22efdCobalt Strike payload (confidence level: 50%)
da55783ca9c4098e5ea47e33507bd38ae9851b6617b574d1fa294a6205cb143eCobalt Strike payload (confidence level: 50%)
a78b29252a7954b588392b952b970da7ddb760cec7320ac4e8a50f79a8cf8f9bCobalt Strike payload (confidence level: 50%)
978a54a42629e0d19ef41bd5db7e560d618e1fdcc8e77c14694642840dfad8a2Cobalt Strike payload (confidence level: 50%)
84802194859b530dcb8e374b7970912f6a27ff5e97f2bec509e59b2dffcc6146NodeRAT payload (confidence level: 100%)
8f0cc4291878220e680bf0b6891f70ede20f49e5d5164d1db0765da71c658ae3Venom RAT payload (confidence level: 100%)

Description

ThreatFox IOCs for 2026-03-26

Impact

The potential impact of this threat intelligence feed is primarily in enhancing detection capabilities rather than indicating an immediate risk of compromise. Organizations worldwide can leverage these IOCs to improve their network monitoring and threat hunting processes, potentially identifying malicious activities earlier. Since there are no known exploits or affected products, the direct risk to confidentiality, integrity, or availability is low at this time. However, failure to incorporate such intelligence could delay detection of emerging threats, increasing the risk of successful payload delivery and subsequent malware infections. The impact is thus indirect but important for maintaining a proactive security posture. Organizations that do not utilize threat intelligence feeds may face higher risks from undetected malware activities. The medium severity reflects the value of this intelligence in preventing future incidents rather than responding to an active exploit.

Defensive guidance

To effectively utilize this threat intelligence, organizations should integrate the ThreatFox IOCs into their existing security information and event management (SIEM) systems and intrusion detection/prevention systems (IDS/IPS). Regularly updating threat intelligence feeds and correlating IOC data with network logs can enhance early detection of suspicious network activities and payload delivery attempts. Security teams should conduct proactive threat hunting exercises using these indicators to identify potential compromises. Additionally, maintaining robust endpoint protection, network segmentation, and strict access controls will reduce the risk of malware propagation if payload delivery attempts are detected. Organizations should also ensure that their incident response plans incorporate procedures for analyzing and acting upon OSINT-derived threat intelligence. Training security analysts to interpret and operationalize such intelligence is critical. Since no patches are available, emphasis should be on detection and response capabilities rather than remediation of vulnerabilities.

Community reviews

Loading reviews…