TF-1868459
high
📛 Threat Title
Vidar: URL that is used for botnet Command&control (C&C) https://bib.y8slot.net/
Description
Indicator that identifies a botnet command&control server (C&C). IOC type: URL that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-08-04 18:15:08 UTC. Last seen: 2026-08-04 21:26:06 UTC. Reporter: crep1x. Tags: Vidar.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
url
https://bib.y8slot.net/
IOC database
- Type
- url
- Value
https://bib.y8slot.net/- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- URL that is used for botnet Command&control (C&C) attributed to Vidar
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a botnet command&control server (C&C). IOC type: URL that is used for botnet Command&control (C&C). Attributed malware: Vidar. Confidence: 100. First seen: 2026-08-04 18:15:08 UTC. Reporter: crep1x. Tags: Vidar.
Remediations (10)
-
web:cyberpress.org
Vidar infection chain (Source: LeveBlue) Vidar Malware Campaign Targets Login Credentials The attack begins when a user executes a compromised version of Microsoft Toolkit, a popular but unauthorized software activation utility.
-
web:cybersecuritynews.com
Once running on the victim's machine, Vidar uses a Dead Drop Resolver to locate its command-and-control server. Rather than hardcoding a C2 address, the malware hides the real server location inside public Steam profiles and Telegram channels, giving attackers the ability to rotate infrastructure quickly without updating the malware itself.
-
web:usa.kaspersky.com
The Vidar stealer is a technical malware used to infect devices and steal information. Here's how it works and how to take preventative measures.
-
web:www.bsi.bund.de
Malware: Vidar Malware Type: Stealer Affected Operating Systems: Windows Affected Device Types: PCs, laptops etc. Impact: high What is Vidar ? Vidar is a Windows infostealer that was first observed in late 2018. It can harvest a wide range of sensitive data from browsers, cryptocurrency wallets and other accounts. Additionally, Vidar is often used to download additional malware, such as ...
-
web:www.darktrace.com
In the latter half of 2022, Darktrace observed a rise in Vidar Stealer infections across its client base. These infections consisted in a predictable series of network behaviors, including usage of certain social media platforms for the retrieval of Command and Control (C2) information and usage of certain URI patterns in C2 communications.
-
web:www.huntress.com
Vidar malware is an information-stealing trojan that targets sensitive data, such as login credentials and cryptocurrency wallets. It works by deploying a payload to infected systems, collecting data, and transmitting it to command and control servers controlled by attackers.
-
web:www.levelblue.com
While it is widely used for benign automation, threat actors frequently abuse AutoIt to create compiled scripts that can execute malicious code, load encrypted payloads, and evade traditional security detection. Because AutoIt executables resemble normal applications, they are often used as stealthy loaders in multi-stage attacks.
-
web:www.malwarebytes.com
We found fake "verify you are human" pages on hacked WordPress sites that trick Windows users into installing the Vidar infostealer.
-
web:www.pointwild.com
Initial Infection Vector for Vidar (2026) The initial infection vector for Vidar infostealer in 2026 has significantly evolved from traditional exploit-based delivery to highly user-driven and social engineering-based execution chains.
-
web:www.spamhaus.org
About the Data The Spamhaus Botnet Controller List (BCL) is a specialized, advisory "drop all traffic" list. It consists of IP addresses that are actively used by cybercriminals to control malware-infected computers (bots). This is a high-confidence list, with false positives being extremely rare, to block as much high-risk, malicious traffic as possible.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.