Vidar - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/vidar/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 13:42:52 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgVidar Stealer: New command-and-control infrastructurehttps://feed.craftedsignal.io/briefs/2026-11-vidar-ioc/Thu, 05 Nov 2026 13:42:52 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-vidar-ioc/ThreatFox identified 162 new indicators associated with the Vidar information stealer, primarily consisting of active command-and-control domains and IP addresses.On November 4, 2026, ThreatFox reported 162 new indicators of compromise (IOCs) associated with the Vidar information stealer. The updated intelligence includes 156 indicators categorized as botnet command-and-control (C2) infrastructure and 6 malicious payload samples. The infrastructure consists of 98 URLs, 51 domains, and 7 IP:port combinations.

Impact

Vidar is an information-stealing malware designed to exfiltrate sensitive data, including browser credentials, cryptocurrency wallets, and system configuration information, to attacker-controlled infrastructure.

Recommendation

  • Block the listed C2 domains and IP addresses at the organizational DNS resolver and firewall.
  • Implement file integrity monitoring or EDR blocks for the identified SHA-256 file hashes to prevent payload execution.
  • Prioritize threat hunting for network connections to the provided IP addresses and domain infrastructure.
]]>highadvisoryvidarmalwarestealerc2botnet