{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/threatfox/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["malware","botnet","c2","threatfox","vshell"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eOn November 4, 2026, ThreatFox published 61 new indicators of compromise associated with the VShell malware family (win.vshell). The identified infrastructure includes 16 IP addresses serving as botnet command-and-control (C2) servers and 45 associated payloads identified by various file hashes. These indicators were reported by multiple contributors and represent active malware infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIngest the provided IP addresses into your perimeter blocklists and monitor for outbound connections from internal assets to these addresses.\u003c/li\u003e\n\u003cli\u003eCalculate file hashes for suspicious binaries observed in the environment and compare them against the provided IOC list to detect VShell payload distribution.\u003c/li\u003e\n\u003cli\u003eConduct retrospective threat hunting in proxy and DNS logs for historical communication with the listed C2 infrastructure.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T13:42:57Z","date_published":"2026-11-05T13:42:57Z","id":"https://feed.craftedsignal.io/briefs/2026-11-vshell-indicators/","summary":"ThreatFox identified 61 new indicators of compromise related to the VShell malware family, including multiple malicious payload hashes and active command-and-control IP addresses.","title":"VShell Malware Command and Control Infrastructure","url":"https://feed.craftedsignal.io/briefs/2026-11-vshell-indicators/"}],"language":"en","title":"CraftedSignal Threat Feed - Threatfox","version":"https://jsonfeed.org/version/1.1"}