Threatfox - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/threatfox/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 13:42:57 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgVShell Malware Command and Control Infrastructurehttps://feed.craftedsignal.io/briefs/2026-11-vshell-indicators/Thu, 05 Nov 2026 13:42:57 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-vshell-indicators/ThreatFox identified 61 new indicators of compromise related to the VShell malware family, including multiple malicious payload hashes and active command-and-control IP addresses.On November 4, 2026, ThreatFox published 61 new indicators of compromise associated with the VShell malware family (win.vshell). The identified infrastructure includes 16 IP addresses serving as botnet command-and-control (C2) servers and 45 associated payloads identified by various file hashes. These indicators were reported by multiple contributors and represent active malware infrastructure.

Recommendation

  • Ingest the provided IP addresses into your perimeter blocklists and monitor for outbound connections from internal assets to these addresses.
  • Calculate file hashes for suspicious binaries observed in the environment and compare them against the provided IOC list to detect VShell payload distribution.
  • Conduct retrospective threat hunting in proxy and DNS logs for historical communication with the listed C2 infrastructure.
]]>mediumadvisorymalwarebotnetc2threatfoxvshell