TF-1812187
high
📛 Threat Title
Vidar: URL that is used for botnet Command&control (C&C) https://gnn.fatherchrismas.com/
Description
Indicator that identifies a botnet command&control server (C&C). IOC type: URL that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-05-14 13:30:12 UTC. Reporter: crep1x. Tags: Vidar.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
url
https://gnn.fatherchrismas.com/
UrlVoid 5 / 35
IOC database
- Type
- url
- Value
https://gnn.fatherchrismas.com/- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- URL that is used for botnet Command&control (C&C) attributed to Vidar
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile Threatfox IOCs/Threats
-
ThreatFox IOC page
Threatfox IOCs/Threats
Indicator that identifies a botnet command&control server (C&C). IOC type: URL that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-05-14 13:30:12 UTC. Reporter: crep1x. Tags: Vidar.
Remediations (10)
-
web:cybersecuritynews.com
It targets personal data, web browser data, cryptocurrency wallets, financial data, sensitive files, communication applications, and more. Sold on the dark web and underground forums, Vidar Stealer leverages social media platforms as part of its command-and-control (C2) infrastructure, making it a formidable threat in the cybersecurity landscape.
-
web:cyble.com
The Vidar malware family, which was first identified in 2018, is capable of stealing sensitive data from the victim's PC. This includes banking information, saved passwords, IP addresses, browser history, login credentials, and crypto-wallets, which can then be transferred to the TAs Command and Control ( C&C ).
-
web:usa.kaspersky.com
The Vidar stealer is a technical malware used to infect devices and steal information. Here's how it works and how to take preventative measures.
-
web:www.censys.com
Vidar Operational Details Vidar uses common network communication methods, and once in place, it will connect to a Telegram server to fetch the URL of the Command and Control (C2) server. In the following two screenshots, you will see examples of this C2 distribution method via Telegram or, if that fails, a backup Steam account.
-
web:www.checkpoint.com
Vidar is an infostealer malware that can also be used to deliver additional forms of malware. Some of the ways that an organization can protect against this malware threat include the following: Employee Training: Vidar is commonly distributed via phishing emails or fake downloads of legitimate software, which actually deliver the malware.
-
web:www.cyfirma.com
Key Findings Vidar is an information-stealing malware that targets a wide range of data. It is being sold as a malware-as-a-service on the dark web and underground forums. It comes with customizable functionality. The malware hides the core malicious code in an obfuscated form and decodes after analyzing the environment for debugger/analysis tools.
-
web:www.darktrace.com
In the latter half of 2022, Darktrace observed a rise in Vidar Stealer infections across its client base. These infections consisted in a predictable series of network behaviors, including usage of certain social media platforms for the retrieval of Command and Control (C2) information and usage of certain URI patterns in C2 communications. In the blog post, we will provide details of the ...
-
web:www.hhs.gov
Vidar frequently uses social media as part of its command and control (C2) infrastructure. The IP address of the C2 infrastructure will be embedded in a user profile on platforms like Mastodon, Telegram, etc. The malware can access this profile, contact the indicated IP address, and download configuration files, instructions, and other malware.
-
web:www.malwarebytes.com
We found fake "verify you are human" pages on hacked WordPress sites that trick Windows users into installing the Vidar infostealer.
-
web:www.pointwild.com
Initial Infection Vector for Vidar (2026) The initial infection vector for Vidar infostealer in 2026 has significantly evolved from traditional exploit-based delivery to highly user-driven and social engineering-based execution chains.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.