Active Malware Campaigns and C2 Infrastructure
ThreatFox identified 82 new indicators of compromise on 2026-11-04 associated with multiple malware families, including ClickFix, Mythic, IPIPGO, and FunRat, involved in payload delivery and C2 activity.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 5, 13:33 UTC
- Detection
- 4 IOCs
- Source quality
- A1Very likely
ThreatFox reported 82 new malware indicators observed on 2026-11-04, spanning multiple threat types including botnet command-and-control (C2) and payload delivery infrastructure. Observed malware families and tags include ClickFix, Mythic, IPIPGO (Jaguar), ZigClipper, Viper, and FunRat. These indicators signify active campaigns utilizing various hosting services and dedicated C2 infrastructure.
Recommendation
- Block the identified malicious domains, URLs, and IP addresses listed in the IOC table at the network perimeter and web proxy level.
- Implement egress filtering to restrict unauthorized connections to non-standard ports (e.g., 7443, 8443, 12000, 21001) used by observed botnet C2 infrastructure.
- Hunt for internal hosts attempting to communicate with the listed C2 infrastructure, prioritizing traffic tagged with 'ClickFix' or 'IPIPGO'.
- Monitor for outbound connections to '*.workers.dev' subdomains, which were observed being utilized for FunRat C2 communication.
Immediate actions
Ingest and block the IOC list at perimeter firewalls and web proxies.
Threat Hunt
Identify endpoints initiating network connections to untrusted subdomains on workers.dev or non-standard high-range ports.
Data: network_connection logs, proxy logs
Indicators of compromise
3
domain
1
url
| Type | Value |
|---|---|
| url | https://docsign.blog/ |
| domain | cfwww.cfd |
| domain | dy-applog.net |
| domain | relay-3f9c71.kartohaantoha36-6a9.workers.dev |