VENOMSPIDER

Overview 66 indicators

No published description. This group is tracked by Maltrail from vendor reporting but is not named in MITRE ATT&CK, so there is no curated profile to show.

Principal sources 38 reports

Ranked by how many of this actor's indicators each report brought in.

• 13community.emergingthreats.net/t/ruleset-update-summary-2025-05-14-v10…
• 8proofpoint.com/us/threat-insight/post/fake-jobs-campai…
• 7x.com/s1dhy/status/1825654074068578528
• 7x.com/fr0s7_/status/1826559678668501494
• 7app.any.run/tasks/57be831c-884f-4bc5-8287-f31c60c7d…
• 7app.any.run/tasks/97eb6e11-41c2-4861-a1f5-b48fc59be…
• 7app.any.run/tasks/0397179e-485a-4b4c-bfb6-8c855ad24…
• 6x.com/RecordedFuture/status/19197779553681203…

Related groups 1

What the sources have in common — not a claim that these are the same actor. See the whole graph.

• BITTER G1002
  1 report cite both

Timeline 66 indicators

Each entry is a batch of indicators that appeared upstream on one date, under the report it was filed with.

No indicator matches. Only the most recent 300 are on this page — the rest are in the JSON.

1. 2026-01-02 or earlier 13 domainthis year

   community.emergingthreats.net/t/ruleset-update-summary-2025-05-14-v10…

   api.incapdns.kz

   beta.w3.org.kz

   cast.voxcdn.kz

   developer.master.org.kz

   incapdns.kz

   mail.incapdns.kz

   master.org.kz

   ryanberardi.com

   stats.wp.org.kz

   tool.municipiodechepo.org

   voxcdn.kz

   w3.org.kz

   wp.org.kz

   copy batch

2. 2026-01-02 or earlier 6 domainthis year

   x.com/RecordedFuture/status/19197779553681203… · x.com/skocherhan/status/1919869645646889308 · recordedfuture.com/research/terrastealerv2-and-terralogger · go.recordedfuture.com/hubfs/reports/cta-2025-0501.pdf

   boldvertex.store

   jonatechlab.com

   pub-ee3b9adcbb354679b5c35d5210673997.r2.dev

   qb-hos.pages.dev

   swiftvantage.online

   wetransfers.io

   copy batch

3. 2026-01-02 or earlier 3 domain, 2 ipv4, 1 urlthis year

   x.com/DaveLikesMalwre/status/1910770682071539… · virustotal.com/gui/file/0151383431f7d057aa48ddff60feaa… · virustotal.com/gui/file/18c8117c589f6986ff02504283c5af… · virustotal.com/gui/file/b24603f97e43ce0445f13d902adad6… · virustotal.com/gui/file/207c283b7877f26e57b555dc638a29…

   domain	avadgray.org
   domain	monstrack.org
   domain	swissblog.org
   ipv4	65.20.104.138:443
   ipv4	65.20.104.138:445
   url	http://65.20.104.138

   copy batch

4. 2025-01-14 1 domain, 1 ipv41 yr ago

   x.com/DaveLikesMalwre/status/1878933026547040…

   domain	waveax.net
   ipv4	65.20.99.10:8080

   copy batch

5. 2024-12-28 1 domain, 1 ipv42 yrs ago

   x.com/DaveLikesMalwre/status/1872840653597823… · app.any.run/tasks/a2b2b424-9c0a-48ca-89a0-5535bfcc2…

   domain	finatick.com
   ipv4	65.20.104.212:8080

   copy batch

6. 2024-12-02 1 ipv42 yrs ago

   zscaler.com/blogs/security-research/unveiling-revc2…

   208.85.17.52:8082

   copy batch

7. 2024-10-19 2 domain, 2 url2 yrs ago

   x.com/malwrhunterteam/status/1847583357485416… · virustotal.com/gui/file/1ddb7d620b40e406d07b5242683583…

   domain	drive.fileio.center
   domain	fileio.center
   url	http://170.75.168.151
   url	http://65.38.121.211

   copy batch

8. 2024-10-14 1 ipv42 yrs ago

   x.com/DaveLikesMalwre/status/1845590642430529… · virustotal.com/gui/file/b1781a062bfca853a3b556afe982e1…

   170.75.168.151:8080

   copy batch

9. 2024-09-25 2 domain, 2 ipv42 yrs ago

   x.com/k3yp0d/status/1838668770841108608 · virustotal.com/gui/file/c0579b32a8dfad75f00078c48a25ae…

   domain	nopsec.org
   domain	seopager.xyz
   ipv4	217.69.8.13:8082
   ipv4	65.20.107.145:8080

   copy batch

10. 2024-09-16 1 domain, 1 url, 2 url_path2 yrs ago

    x.com/k3yp0d/status/1835549865155154285 · virustotal.com/gui/file/01446c36f93532f2cd8af96396e220…

    domain	yerra.org
    url	http://72.5.43.19
    url_path	/aaaQHvrzTFUuAh
    url_path	/ccckweJYfszthKpQa

    copy batch

11. 2024-08-22 5 domain, 2 url2 yrs ago

    x.com/s1dhy/status/1825654074068578528 · x.com/fr0s7_/status/1826559678668501494 · app.any.run/tasks/57be831c-884f-4bc5-8287-f31c60c7d… · app.any.run/tasks/97eb6e11-41c2-4861-a1f5-b48fc59be… · app.any.run/tasks/0397179e-485a-4b4c-bfb6-8c855ad24…

    domain	api.sharefiles.center
    domain	api.totalsphere.center
    domain	sharefiles.center
    domain	totalsphere.center
    domain	vad.totalsphere.center
    url	http://65.38.121.145
    url	http://65.38.121.75

    copy batch

12. 2024-08-19 2 domain, 1 ipv42 yrs ago

    x.com/r3dbU7z/status/1825446509082505613 · virustotal.com/gui/file/4ca845b77a71cc1b5d8b367f3329a7… · virustotal.com/gui/file/28cb51c171d591b2bb35bc9a437901… · virustotal.com/gui/file/d2809ea33f5d54c9c6d1c6037f1b3e…

    domain	gdrive.rest
    domain	winapi.net
    ipv4	65.20.104.150:8080

    copy batch

13. 2020-06-18 1 domain6 yrs ago

    twitter.com/VK_Intel/status/1286747453849468929 · virustotal.com/gui/file/38f3a52e1ebd93db75f0fb6ce61725…

    maps.doaglas.com

    copy batch

14. 2019-12-30 1 domain7 yrs ago

    twitter.com/VK_Intel/status/1211758023376592896

    blog.jasonlees.com

    copy batch

15. 2019-12-09 2 domain7 yrs ago

    twitter.com/James_inthe_box/status/1204125950033575… · app.any.run/tasks/48907a8c-bc47-4552-a705-334e93d0e…

    anuffrost.com

    dns.hahdyman.com

    copy batch

16. 2019-04-19 1 domain7 yrs ago

    twitter.com/VK_Intel/status/1119082329324965893

    report.monicabellucci.kz

    copy batch

17. 2019-02-25 8 domain7 yrs ago

    proofpoint.com/us/threat-insight/post/fake-jobs-campai…

    api.cloudservers.kz

    contactlistsagregator.com

    interrafcu.com

    mail.rediffmail.kz

    onlinemail.kz

    secure.cloudserv.ink

    tonsandmillions.com

    usstaffing.services

    copy batch

Further reading 38

• x.com/DaveLikesMalwre/status/1845590642430529…
• app.any.run/tasks/0397179e-485a-4b4c-bfb6-8c855ad24…
• x.com/DaveLikesMalwre/status/1878933026547040…
• proofpoint.com/us/threat-insight/post/fake-jobs-campai…
• recordedfuture.com/research/terrastealerv2-and-terralogger
• virustotal.com/gui/file/c0579b32a8dfad75f00078c48a25ae…
• community.emergingthreats.net/t/ruleset-update-summary-2025-05-14-v10…
• twitter.com/James_inthe_box/status/1204125950033575…
• app.any.run/tasks/97eb6e11-41c2-4861-a1f5-b48fc59be…
• virustotal.com/gui/file/207c283b7877f26e57b555dc638a29…
• virustotal.com/gui/file/b24603f97e43ce0445f13d902adad6…
• x.com/k3yp0d/status/1838668770841108608
• virustotal.com/gui/file/b1781a062bfca853a3b556afe982e1…
• twitter.com/VK_Intel/status/1119082329324965893
• virustotal.com/gui/file/28cb51c171d591b2bb35bc9a437901…
• x.com/malwrhunterteam/status/1847583357485416…
• go.recordedfuture.com/hubfs/reports/cta-2025-0501.pdf
• app.any.run/tasks/a2b2b424-9c0a-48ca-89a0-5535bfcc2…
• x.com/DaveLikesMalwre/status/1872840653597823…
• zscaler.com/blogs/security-research/unveiling-revc2…
• x.com/RecordedFuture/status/19197779553681203…
• virustotal.com/gui/file/01446c36f93532f2cd8af96396e220…
• virustotal.com/gui/file/38f3a52e1ebd93db75f0fb6ce61725…
• twitter.com/VK_Intel/status/1286747453849468929
• virustotal.com/gui/file/1ddb7d620b40e406d07b5242683583…
• x.com/s1dhy/status/1825654074068578528
• x.com/r3dbU7z/status/1825446509082505613
• x.com/skocherhan/status/1919869645646889308
• x.com/DaveLikesMalwre/status/1910770682071539…
• x.com/k3yp0d/status/1835549865155154285
• virustotal.com/gui/file/d2809ea33f5d54c9c6d1c6037f1b3e…
• x.com/fr0s7_/status/1826559678668501494
• virustotal.com/gui/file/0151383431f7d057aa48ddff60feaa…
• virustotal.com/gui/file/4ca845b77a71cc1b5d8b367f3329a7…
• app.any.run/tasks/57be831c-884f-4bc5-8287-f31c60c7d…
• twitter.com/VK_Intel/status/1211758023376592896
• app.any.run/tasks/48907a8c-bc47-4552-a705-334e93d0e…
• virustotal.com/gui/file/18c8117c589f6986ff02504283c5af…