Adversary Operations
The threat landscape, right now.
Live-curated OSINT from CISA KEV, URLhaus, Feodo Tracker and ThreatFox — enriched, deduplicated and ready for hunting.
KEV Vulns
40
Sorted by date
Malware URLs
30
URLhaus feed
Botnet C2s
1
Feodo Tracker
Recent IOCs
80
ThreatFox live
Latest exploited vulnerabilities
40/40 LIVE| CVE | Product | Added | Ransomware |
|---|---|---|---|
| CVE-2008-4128 Cisco IOS Cross-Site Request Forgery Vulnerability | Cisco IOS | 2026-07-13 | Unknown |
| CVE-2026-56291 Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability | Balbooa Forms | 2026-07-10 | Unknown |
| CVE-2026-48939 iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability | iCagenda iCagenda | 2026-07-10 | Unknown |
| CVE-2026-48908 JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability | JoomShaper SP Page Builder | 2026-07-07 | Unknown |
| CVE-2026-55255 Langflow Authorization Bypass Through User-Controlled Key Vulnerability | Langflow Langflow | 2026-07-07 | Unknown |
| CVE-2026-56290 Joomlack Page Builder Improper Access Control Vulnerability | Joomlack Page Builder | 2026-07-07 | Unknown |
| CVE-2026-48282 Adobe ColdFusion Path Traversal Vulnerability | Adobe ColdFusion | 2026-07-07 | Unknown |
| CVE-2026-45659 Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability | Microsoft SharePoint Server | 2026-07-01 | Unknown |
| CVE-2026-48558 SimpleHelp Authentication Bypass Vulnerability | SimpleHelp SimpleHelp | 2026-06-29 | Unknown |
| CVE-2026-12569 PTC Windchill and FlexPLM Improper Input Validation Vulnerability | PTC Windchill and FlexPLM | 2026-06-25 | Unknown |
| CVE-2026-20230 Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability | Cisco Unified Communications Manager | 2026-06-25 | Unknown |
| CVE-2025-67038 Lantronix EDS5000 Code Injection Vulnerability | Lantronix EDS5000 | 2026-06-23 | Unknown |
| CVE-2026-34910 Ubiquiti UniFi OS Improper Input Validation Vulnerability | Ubiquiti UniFi OS | 2026-06-23 | Unknown |
| CVE-2026-34909 Ubiquiti UniFi OS Path Traversal Vulnerability | Ubiquiti UniFi OS | 2026-06-23 | Unknown |
| CVE-2026-34908 Ubiquiti UniFi OS Improper Access Control Vulnerability | Ubiquiti UniFi OS | 2026-06-23 | Unknown |
| CVE-2026-20253 Splunk Enterprise Missing Authentication for Critical Function Vulnerability | Splunk Enterprise | 2026-06-18 | Unknown |
| CVE-2026-48907 Widget Factory Joomla Content Editor Improper Access Control Vulnerability | Widget Factory Joomla Content Editor | 2026-06-16 | Unknown |
| CVE-2026-54420 LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following Vulnerability | LiteSpeed cPanel Plugin | 2026-06-15 | Unknown |
| CVE-2026-20262 Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability | Cisco Catalyst SD-WAN Manager | 2026-06-15 | Unknown |
| CVE-2026-35273 Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function Vulnerability | Oracle PeopleSoft Enterprise PeopleTools | 2026-06-12 | Known |
| CVE-2026-10520 Ivanti Sentry OS Command Injection Vulnerability | Ivanti Sentry | 2026-06-11 | Unknown |
| CVE-2026-11645 Google Chromium V8 Out-of-Bounds Read and Write Vulnerability | Google Chromium V8 | 2026-06-09 | Unknown |
| CVE-2026-7473 Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability | Arista Extensible Operating System | 2026-06-09 | Unknown |
| CVE-2026-20245 Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability | Cisco Catalyst SD-WAN Manager | 2026-06-09 | Unknown |
| CVE-2026-42271 BerriAI LiteLLM Command Injection Vulnerability | BerriAI LiteLLM | 2026-06-08 | Unknown |
| CVE-2026-50751 Check Point Security Gateway Improper Authentication Vulnerability | Check Point Security Gateway | 2026-06-08 | Known |
| CVE-2026-28318 SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability | SolarWinds Serv-U | 2026-06-05 | Unknown |
| CVE-2026-45247 Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data Vulnerability | Mirasvit Mirasvit Full Page Cache Warmer | 2026-06-03 | Unknown |
| CVE-2022-0492 Linux Kernel Improper Authentication Vulnerability | Linux Kernel | 2026-06-02 | Unknown |
| CVE-2025-48595 Android Framework Integer Overflow Vulnerability | Android Framework | 2026-06-02 | Unknown |
| CVE-2024-21182 Oracle WebLogic Server Unspecified Vulnerability | Oracle WebLogic Server | 2026-06-01 | Unknown |
| CVE-2026-0257 Palo Alto Networks PAN-OS Authentication Bypass Vulnerability | Palo Alto Networks PAN-OS | 2026-05-29 | Unknown |
| CVE-2026-48027 Nx Console Embedded Malicious Code Vulnerability | Nx Nx Console | 2026-05-27 | Known |
| CVE-2026-45321 TanStack Unspecified Vulnerability | TanStack TanStack | 2026-05-27 | Known |
| CVE-2026-8398 Daemon Tools Lite Embedded Malicious Code Vulnerability | Daemon Daemon Tools Lite | 2026-05-27 | Unknown |
| CVE-2026-48172 LiteSpeed cPanel Plugin Privilege Escalation Vulnerability | LiteSpeed cPanel Plugin | 2026-05-26 | Unknown |
| CVE-2026-9082 Drupal Core SQL Injection Vulnerability | Drupal Core | 2026-05-22 | Unknown |
| CVE-2025-34291 Langflow Origin Validation Error Vulnerability | Langflow Langflow | 2026-05-21 | Unknown |
| CVE-2026-34926 Trend Micro Apex One (On-Premise) Directory Traversal Vulnerability | Trend Micro Apex One | 2026-05-21 | Unknown |
| CVE-2008-4250 Microsoft Windows Buffer Overflow Vulnerability | Microsoft Windows | 2026-05-20 | Unknown |
Top malware families
#1Cobalt Strike
1421#2ClearFake
397#3Remcos
387#4Triada
354#5AsyncRAT
282#6Unknown malware
233#7AdaptixC2
214#8VShell
147Threat categories
botnet_cc3575
payload427
payload_delivery426
Active botnet C2 infrastructure
FEODO| C2 | Malware | Country | First seen |
|---|---|---|---|
| 50.16.16.211:443 | QakBot | US | 2025-12-30 13:56:31 |
Live malware URLs
URLHAUSmalware_download
http://59.103.116.68:53661/i
Mozi
malware_download
http://112.248.113.115:34830/i
32-bitelfmipsMozi
malware_download
https://obsudfch.site-shartbandi-enfejar.bet/4ed9d899-1b76-4912-a54c-12b1e0d060d4
ClearFakewin-0x4679windows
malware_download
http://219.155.195.215:53450/i
32-bitelfmipsMozi
malware_download
http://216.249.4.20:48369/i
32-bitarmelfmirai
malware_download
http://216.249.4.20:48369/bin.sh
32-bitarmelfmirai
malware_download
https://ecyz.plinko-1xbet.games/1427ff78-0347-4582-a70a-0b42a371875e
ClearFakewin-0x0cd5windows
malware_download
http://110.36.77.34:38726/i
32-bitelfmipsMozi
malware_download
http://219.155.195.215:53450/bin.sh
32-bitelfmipsMozi
malware_download
http://223.151.249.23:38648/bin.sh
32-bitarmelfmirai
malware_download
http://171.116.111.62:43207/bin.sh
mirai
malware_download
https://texjqbwa.site-shartbandi-bedun-filter.com/53513975-0ab6-448d-9de3-b77e36a4e3ce
ClearFakewin-0x4679windows
malware_download
http://105.224.66.14:53221/i
mirai
malware_download
http://59.96.141.232:43521/i
32-bitelfmipsMozi
malware_download
https://ign0g5ax.site-shartbandi-khareji.com/?ublib=f5e33013-fea1-4dff-acaf-7fb9aa754359
ClearFakemac-0x68dcmacOS
malware_download
https://wjyt.betturkey.bet/df0cac38-39b0-41ff-9c9f-6f17db7377ff
ClearFakewin-0x0cd5windows
malware_download
http://105.224.66.14:53221/bin.sh
mirai
malware_download
http://58.208.16.222:3588/i
32-bitelfmipsMozi
malware_download
http://182.113.194.106:55664/i
32-bitelfmipsMozi
malware_download
http://115.48.149.165:57807/i
32-bitelfmipsMozi
malware_download
http://119.189.200.96:40294/i
32-bitelfmipsMozi
malware_download
https://nswofmyl.site-shartbandi-50toman.com/1d4f406e-85a9-4e87-9be4-99ae4b016b79
ClearFakewin-0x4679windows
malware_download
http://110.178.52.170:46321/bin.sh
mirai
malware_download
http://110.36.25.33:45409/i
32-bitelfmipsMozi
malware_download
https://p9kos7r3.scriptyek.com/?ublib=78ce0396-6765-4b9c-a78e-8a73ff3d54d8
ClearFakemac-0x76c7macOS
malware_download
https://kzjx.betropol.bet/ac0e1f83-9ee4-4487-8a47-f81e3e90755c
ClearFakewin-0x0cd5windows
malware_download
http://182.112.29.45:59971/i
32-bitelfmipsMozi
malware_download
http://110.36.25.33:45409/bin.sh
32-bitelfmipsMozi
malware_download
https://tdhviatnam.com/secured_stub.ps1
asciipowershellps1
malware_download
http://107.173.143.52/30/goodthingsarecoming.hta
hta
Curated IOC database
THREATFOX| Indicator | Type | Family / Threat | Confidence | First seen |
|---|---|---|---|---|
| ip:port | VShell | 100 | 2026-07-13 20:05:09 | |
| ip:port | VShell | 100 | 2026-07-13 20:05:07 | |
| ip:port | VShell | 100 | 2026-07-13 20:05:07 | |
| ip:port | VShell | 100 | 2026-07-13 20:05:06 | |
| ip:port | DCRat | 100 | 2026-07-13 20:05:05 | |
| domain | ClearFake | 100 | 2026-07-13 20:03:23 | |
| domain | ClearFake | 100 | 2026-07-13 20:02:43 | |
| domain | ClearFake | 100 | 2026-07-13 20:02:36 | |
| ip:port | AsyncRAT | 75 | 2026-07-13 19:45:28 | |
| ip:port | Remcos | 75 | 2026-07-13 19:45:13 | |
| ip:port | Evilginx | 75 | 2026-07-13 19:45:03 | |
| ip:port | Havoc | 75 | 2026-07-13 19:44:54 | |
| ip:port | AdaptixC2 | 75 | 2026-07-13 19:44:48 | |
| domain | ClearFake | 100 | 2026-07-13 19:44:48 | |
| ip:port | AsyncRAT | 75 | 2026-07-13 19:44:18 | |
| ip:port | Remcos | 75 | 2026-07-13 19:44:13 | |
| ip:port | Remcos | 75 | 2026-07-13 19:44:03 | |
| ip:port | Remcos | 75 | 2026-07-13 19:44:03 | |
| ip:port | AsyncRAT | 75 | 2026-07-13 19:44:00 | |
| ip:port | AsyncRAT | 75 | 2026-07-13 19:44:00 | |
| ip:port | Evilginx | 75 | 2026-07-13 19:43:57 | |
| ip:port | Havoc | 75 | 2026-07-13 19:43:44 | |
| ip:port | DCRat | 75 | 2026-07-13 19:43:19 | |
| ip:port | Remcos | 75 | 2026-07-13 19:43:17 | |
| ip:port | Remcos | 75 | 2026-07-13 19:43:11 | |
| domain | ClearFake | 100 | 2026-07-13 19:42:17 | |
| domain | ClearFake | 100 | 2026-07-13 19:08:37 | |
| domain | ClearFake | 100 | 2026-07-13 19:07:02 | |
| ip:port | Cobalt Strike | 100 | 2026-07-13 19:05:08 | |
| ip:port | Cobalt Strike | 100 | 2026-07-13 19:05:07 | |
| ip:port | DCRat | 100 | 2026-07-13 19:05:06 | |
| domain | ClearFake | 100 | 2026-07-13 18:54:11 | |
| domain | ClearFake | 100 | 2026-07-13 18:52:24 | |
| domain | ClearFake | 100 | 2026-07-13 18:43:04 | |
| domain | ClearFake | 100 | 2026-07-13 18:41:43 | |
| domain | ClearFake | 100 | 2026-07-13 18:12:57 | |
| domain | ClearFake | 100 | 2026-07-13 18:11:22 | |
| domain | ClearFake | 100 | 2026-07-13 18:11:20 | |
| ip:port | VShell | 100 | 2026-07-13 18:05:04 | |
| domain | ClearFake | 100 | 2026-07-13 17:52:05 | |
| domain | ClearFake | 100 | 2026-07-13 17:50:56 | |
| domain | ClearFake | 100 | 2026-07-13 17:50:03 | |
| domain | ClearFake | 100 | 2026-07-13 17:43:17 | |
| domain | ClearFake | 100 | 2026-07-13 17:41:11 | |
| domain | Unknown Loader | 100 | 2026-07-13 17:24:45 | |
| domain | ClearFake | 100 | 2026-07-13 17:17:26 | |
| domain | ClearFake | 100 | 2026-07-13 17:15:57 | |
| domain | ClearFake | 100 | 2026-07-13 17:15:48 | |
| ip:port | Remcos | 100 | 2026-07-13 17:10:05 | |
| domain | Unknown malware | 100 | 2026-07-13 17:09:40 | |
| domain | Unknown Loader | 100 | 2026-07-13 17:07:01 | |
| domain | Unknown RAT | 100 | 2026-07-13 17:05:17 | |
| ip:port | VShell | 100 | 2026-07-13 17:05:11 | |
| ip:port | VShell | 100 | 2026-07-13 17:05:07 | |
| ip:port | VShell | 100 | 2026-07-13 17:05:07 | |
| ip:port | VShell | 100 | 2026-07-13 17:05:05 | |
| ip:port | VShell | 100 | 2026-07-13 17:05:04 | |
| sha1_hash | SalatStealer | 95 | 2026-07-13 16:58:33 | |
| md5_hash | SalatStealer | 95 | 2026-07-13 16:58:33 | |
| sha256_hash | Venus Stealer | 95 | 2026-07-13 16:58:32 | |
| sha1_hash | Venus Stealer | 95 | 2026-07-13 16:58:32 | |
| md5_hash | Venus Stealer | 95 | 2026-07-13 16:58:32 | |
| sha256_hash | SalatStealer | 95 | 2026-07-13 16:58:32 | |
| sha256_hash | SalatStealer | 95 | 2026-07-13 16:58:31 | |
| sha1_hash | SalatStealer | 95 | 2026-07-13 16:58:31 | |
| md5_hash | SalatStealer | 95 | 2026-07-13 16:58:31 | |
| sha256_hash | Venus Stealer | 95 | 2026-07-13 16:58:30 | |
| sha1_hash | Venus Stealer | 95 | 2026-07-13 16:58:30 | |
| md5_hash | Venus Stealer | 95 | 2026-07-13 16:58:30 | |
| sha256_hash | SalatStealer | 95 | 2026-07-13 16:58:29 | |
| sha1_hash | SalatStealer | 95 | 2026-07-13 16:58:29 | |
| md5_hash | SalatStealer | 95 | 2026-07-13 16:58:29 | |
| md5_hash | Kuiper | 95 | 2026-07-13 16:58:28 | |
| sha256_hash | SalatStealer | 95 | 2026-07-13 16:58:28 | |
| sha1_hash | SalatStealer | 95 | 2026-07-13 16:58:28 | |
| md5_hash | SalatStealer | 95 | 2026-07-13 16:58:28 | |
| md5_hash | Kuiper | 95 | 2026-07-13 16:58:27 | |
| sha256_hash | Kuiper | 95 | 2026-07-13 16:58:27 | |
| sha1_hash | Kuiper | 95 | 2026-07-13 16:58:27 | |
| md5_hash | QvoidStealer | 95 | 2026-07-13 16:58:26 |