IndicatorPublished 29 Mar 2026Updated 30 Mar 2026

type osint · ThreatFox IOCs for 2026-03-29

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 382

amoboobs.comWinos payload delivery domain (confidence level: 75%)
trueforceteam.ruUnknown Stealer payload delivery domain (confidence level: 100%)
easytrueforce.shopUnknown Stealer payload delivery domain (confidence level: 100%)
accounts.google.seclogistic.comKimsuky botnet C2 domain (confidence level: 75%)
workspaces.dynv6.netKimsuky botnet C2 domain (confidence level: 75%)
taxhelp6.dynv6.netKimsuky botnet C2 domain (confidence level: 75%)
nid.naver.courter.comKimsuky botnet C2 domain (confidence level: 75%)
communicationfirewall-security.ccCountLoader botnet C2 domain (confidence level: 75%)
favourite-guide.ccCountLoader botnet C2 domain (confidence level: 75%)
geo-foundation.vgCountLoader botnet C2 domain (confidence level: 75%)

URLs 124

http://91.92.243.119/git.ps1Unknown Stealer payload delivery URL (confidence level: 100%)
http://91.92.243.119/stlr/git.exeUnknown Stealer payload delivery URL (confidence level: 100%)
http://91.92.243.119/steam/lemon.exeUnknown Stealer payload delivery URL (confidence level: 100%)
http://91.92.243.119/rat/global.exeUnknown Stealer payload delivery URL (confidence level: 100%)
https://during.bong889.com/Unknown malware payload delivery URL (confidence level: 90%)
https://dev.betway071.com/Unknown malware payload delivery URL (confidence level: 90%)
https://suaracitizen.com/Unknown malware payload delivery URL (confidence level: 90%)
https://question-climatisation.com/Unknown malware payload delivery URL (confidence level: 90%)
http://45.205.2.53:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://movinty.digital/Unknown malware payload delivery URL (confidence level: 90%)

IP addresses 123

24.152.36.243Winos botnet C2 server (confidence level: 75%)
64.89.163.230Stealc botnet C2 server (confidence level: 100%)
91.92.243.119Unknown Stealer payload delivery server (confidence level: 100%)
5.45.74.46Unknown malware botnet C2 server (confidence level: 50%)
24.248.236.7Xtreme RAT botnet C2 server (confidence level: 100%)
45.156.87.17Cobalt Strike payload delivery server (confidence level: 100%)
176.65.139.81Mirai botnet C2 server (confidence level: 80%)
43.251.226.93Cobalt Strike botnet C2 server (confidence level: 100%)
147.45.67.96ACR Stealer botnet C2 server (confidence level: 100%)
178.236.252.123ACR Stealer botnet C2 server (confidence level: 100%)

Hashes 8

fb3e6d6bb2781c8a737c38f4d31beed93a89cc2ff9b8c00e7682f04c72fd9a60Unknown Stealer payload (confidence level: 100%)
ab78edbfdaebc11a34625d71709113cbb3f8e10d4699bc8dbddb966ea2efff03Unknown Stealer payload (confidence level: 100%)
c22d94a2652a4689a73d845e127157de986b72669aabf1c4fefc0f789646895bUnknown Stealer payload (confidence level: 100%)
371d72144e3862bbb3ce66821e47232c8a08eba166f13cade5bfaad1e1a6ab7dUnknown Stealer payload (confidence level: 100%)
563ae5a1263eaa065b1a193870343637cc7650ccf0d8f6ff75f47906f3e85c0fUnknown Stealer payload (confidence level: 100%)
6d140e07afb62c3fe9e60763993f1f0edf3e0c5421e693885b79a5fe5d91f14fUnknown Stealer payload (confidence level: 100%)
6e676252d9b29e1e9caa7b24cad834bc53a41c4d55ed466a9fdebc30a74322b3Unknown Stealer payload (confidence level: 100%)
b7ef4985662625c45955db295d949e04fd0a9fd5c8ce0c6a3bcb68e4a06c16e4Unknown malware payload (confidence level: 90%)

Description

ThreatFox IOCs for 2026-03-29

Impact

The potential impact of this threat is currently limited due to the lack of detailed exploit information and absence of known active attacks. However, as it involves malware and payload delivery, organizations could face risks such as unauthorized access, data exfiltration, or service disruption if the threat evolves or is leveraged in targeted attacks. The medium severity rating suggests that while immediate widespread damage is unlikely, the threat could be a precursor to more significant attacks or part of a broader campaign. Organizations relying on OSINT and network monitoring tools may need to update their detection capabilities to identify related malicious activity. The lack of patches means that if this threat exploits unknown vulnerabilities, organizations must rely on network defenses and monitoring rather than software fixes. Overall, the impact is moderate but could escalate if further details emerge or if attackers develop active exploits based on this intelligence.

Defensive guidance

Given the absence of specific patches or detailed exploit information, mitigation should focus on enhancing detection and response capabilities. Organizations should integrate the latest ThreatFox IOCs into their security information and event management (SIEM) systems and intrusion detection/prevention systems (IDS/IPS) to improve visibility of potential malicious network activity and payload delivery attempts. Regularly updating threat intelligence feeds and correlating them with internal logs can help identify early signs of compromise. Network segmentation and strict access controls can limit the spread of malware if an infection occurs. Employing endpoint detection and response (EDR) solutions with behavioral analysis can detect suspicious payload execution. Security teams should also conduct regular threat hunting exercises using the provided IOCs and monitor for unusual OSINT-related network traffic. User awareness training about phishing and social engineering remains important, as payload delivery often involves user interaction. Finally, maintaining robust backup and recovery procedures ensures resilience against potential malware impacts.

Community reviews

Loading reviews…