WARDENStealer Campaign Infrastructure Update
New command-and-control infrastructure and payload hashes for WARDENStealer information-stealing malware were identified on November 4, 2026.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 5, 13:43 UTC
- Detection
- 23 IOCs
- Source quality
- A1Likely
ThreatFox identified 23 new indicators of compromise related to the WARDENStealer information stealer. The indicators include 21 command-and-control (C2) URLs and two malicious binary payloads. This activity was reported by community contributors and reflects current infrastructure used by the operator.
Impact
WARDENStealer is designed to exfiltrate sensitive data from infected systems. Observed impact is limited to the identification of active C2 domains and binary hashes used in ongoing campaigns.
Recommendation
- Block the identified C2 URLs at the organizational web proxy or DNS resolver.
- Implement file integrity monitoring and endpoint detection to alert on the execution of the provided SHA-256 hashes.
- Scan historical telemetry for outbound connections to the listed C2 domains.
Immediate actions
Block all listed C2 URLs on network egress points.
Threat Hunt
Identify endpoints attempting to reach the listed C2 domains.
Data: DNS request logs, Proxy access logs
Indicators of compromise
2
hash_sha256
21
url
| Type | Value |
|---|---|
| url | https://stapbystep.rest/ |
| url | https://pi-suxa56.mom/ |
| url | https://hilgapotaki.com/ |
| url | https://yoobyjus.com/ |
| url | https://dataportlymy.guru/ |
| url | https://veltrika.qpon/ |
| url | https://popochka.cc/ |
| url | https://vexaltrion.rest/ |
| url | https://pidoras-12.rest/ |
| url | https://scouybydyh.com/ |
| url | https://magomyyry.com/ |
| url | https://pluginstopsyka.com/ |
| url | https://polariscolap.rest/ |
| url | https://vuiniqu.rest/ |
| url | https://delopaten.rest/ |
| url | https://zyntravio.rest/ |
| url | https://eptabiboko.com/ |
| url | https://randfom2323.com/ |
| hash_sha256 | 173a09636a91e303c6466a26ab0d84e156886d28d648f37b6ef9f1656af6471e |
| hash_sha256 | 7b0a6911dae45311ebed9f4397af4b129b2c893f87e8166c85d7a85db7298af4 |
| url | https://rabbids-youtube.cc/ |
| url | https://contupasserworld.guru/ |
| url | https://beawlopman.guru/ |