MS-ISAC Reports 7% Rise in Malware Notifications in Q4 2025
Summary
MS-ISAC reported a 7% increase in malware notifications from Q3 to Q4 2025. SocGholish led detections, while the briefing details the top 10 malware families, infection vectors, and IOCs for defenders.
Key points
- SocGholish accounted for 30% of detections and remained the most prevalent malware; CoinMiner and Agent Tesla ranked second and third.
- The top 10 list included returning Arechclient2 and first-time appearances by ACR Stealer, Calendaromatic, and SombRAT.
- Multiple infection vectors led in Q4, with alerts increasing for ACR Stealer, Arechclient2, Jinupd, and VenomRAT.
- Tracked infection vectors were dropped malware, malspam, and malvertisement; no top-10 malware used the dropped vector at publication time.
- The briefing describes malware capabilities and provides associated domain and file-hash IOCs for threat hunting and detection.
- CIS cautions defenders to assess IOCs for organizational impact before using them for blocking.
Article Details
- Publisher
- Center for Internet Security (CIS) Cyber Threat Intelligence team
- Report Period
- Q4 2025
- Scope
- Top 10 malware prevalence, infection vectors, and associated IOCs observed by MS-ISAC monitoring services and open-source research.
- Sample Size
- Top 10 malware families
- Key Statistics
- Total malware notifications from MS-ISAC monitoring services increased 7% from Q3 2025 to Q4 2025.
- SocGholish accounted for 30% of detections in Q4 2025.
- The CIS Community Defense Model v2.0 can help defend against 77% of MITRE ATT&CK (sub-)techniques associated with malware, according to the report.
- Recommendations
- Use the provided IOCs for threat hunting, and vet each indicator for organizational impact before using it for blocking.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | ahegazedatthewond[.]org | Listed as an associated Calendaromatic indicator. |
| DOMAIN | akilay[.]kingx[.]info | Listed as an associated Agent Tesla indicator. |
| DOMAIN | app[.]abuarerestaurant[.]net | Listed as an associated SocGholish domain. |
| DOMAIN | apposx[.]com | Listed as an associated ACR Stealer indicator. |
| DOMAIN | calendaromatic[.]com | Listed as an associated Calendaromatic indicator. |
| DOMAIN | configure[.]visionsflorida[.]com | Listed as an associated SocGholish domain. |
| DOMAIN | cpajoliette[.]com | Listed as an associated ZPHP indicator. |
| DOMAIN | cpanel[.]paquetesparaorlando[.]com | Listed as an associated SocGholish domain. |
| DOMAIN | demo[.]halfmoonboulder[.]com | Listed as an associated SocGholish domain. |
| DOMAIN | diariodetaubateregiao[.]com[.]br | Listed as an associated SocGholish domain. |
| DOMAIN | dinozozo[.]com | Listed as an associated ZPHP indicator. |
| DOMAIN | dpaste[.]org | Listed among VenomRAT-associated indicators. |
| DOMAIN | estate[.]verano[.]life | Listed as an associated SocGholish domain. |
| DOMAIN | files[.]parsonspaving[.]ca | Listed as an associated SocGholish domain. |
| DOMAIN | globalsnn2-new[.]cc | Listed as an associated ACR Stealer indicator. |
| DOMAIN | globalsnn3-new[.]cc | Listed as an associated ACR Stealer indicator. |
| DOMAIN | ijels[.]com | Listed as an associated ZPHP indicator. |
| DOMAIN | images[.]nestledinniagara[.]com | Listed as an associated SocGholish domain. |
| DOMAIN | images[.]weightlosstonight[.]net | Listed as an associated SocGholish domain. |
| DOMAIN | indeanapolice[.]cc | Listed as an associated ACR Stealer indicator. |
| DOMAIN | investor[.]veranofund[.]com | Listed as an associated SocGholish domain. |
| DOMAIN | joinmc[.]link | Listed among VenomRAT-associated indicators. |
| DOMAIN | karbowanec[.]com | Listed as an associated CoinMiner domain. |
| DOMAIN | krestinaful[.]com | Listed as an associated Calendaromatic indicator. |
| DOMAIN | mail[.]gcsho[.]com | Listed as an associated Agent Tesla indicator. |
| DOMAIN | mail[.]kino2[.]top | Listed as an associated Agent Tesla indicator. |
| DOMAIN | mail[.]vinatax[.]us | Listed as an associated Agent Tesla indicator. |
| DOMAIN | memory-scanner[.]cc | Listed as an associated ACR Stealer indicator. |
| DOMAIN | mercedesheritage[.]com | Listed as an associated ZPHP indicator. |
| DOMAIN | miner[.]rocks | Listed as an associated CoinMiner domain. |
| DOMAIN | obsidianmidnight[.]top | Listed as an associated ZPHP indicator. |
| DOMAIN | ovementxview[.]com | Listed as an associated Calendaromatic indicator. |
| DOMAIN | pippyheydguide[.]com | Listed as an associated ZPHP indicator. |
| DOMAIN | pktriot[.]net | Listed among VenomRAT-associated indicators. |
| DOMAIN | portmap[.]io | Listed among VenomRAT-associated indicators. |
| DOMAIN | sberex[.]com | Listed as an associated CoinMiner domain. |
| DOMAIN | secure[.]kasindramaharaj[.]com | Listed as an associated SocGholish domain. |
| DOMAIN | selcukpeker[.]com | Listed as an associated ZPHP indicator. |
| DOMAIN | shadowqueueflow[.]com | Listed as an associated SocGholish domain. |
| DOMAIN | theriygrt[.]com | Listed among VenomRAT-associated indicators. |
| DOMAIN | tropicalhorizonext[.]com | Listed as an associated Calendaromatic indicator. |
| DOMAIN | tyuropium[.]com | Listed among VenomRAT-associated indicators. |
| DOMAIN | umnsrx[.]net | Listed as an associated CoinMiner domain. |
| DOMAIN | watchsmiler[.]com | Listed as an associated ZPHP indicator. |
| DOMAIN | zulpine[.]shop | Listed as an associated Agent Tesla indicator. |
| SHA256 | 006f0054609064c00d3d217ee37f924b4cf8c4fabde362408cdec1446d719913 | Hash listed among ACR Stealer IOCs. |
| SHA256 | 00b84eae83e4cd6165255247026c702c2c88f5cea8a1032187c2b842dc54095d | Hash listed among ACR Stealer IOCs. |
| SHA256 | 0111ffb0dab4bdef8c8788e4ce6ad4fc071b9f7b1f3affb7ead8d5df9582f34f | Hash listed among ACR Stealer IOCs. |
| SHA256 | 04a4108b85dd9d19175d5fbfafb837d4118526fd67e0b2541151d4003e2cfe35 | Hash listed among Agent Tesla IOCs. |
| SHA256 | 0cec3100b84f95dfb1e856390cf41809b653812fd4d51025517ba11b167442fa | Hash listed among VenomRAT IOCs. |
| SHA256 | 12ab29ed1c3f60092c101e9c8451ff44fda6c9787c6e32e3956e9a645be5dcee | Hash listed among ACR Stealer IOCs. |
| SHA256 | 1619bcad3785be31ac2fdee0ab91392d08d9392032246e42673c3cb8964d4cb7 | Hash listed among Calendaromatic IOCs. |
| SHA256 | 2428bd931dde4d818437ff9e12197bdbb4a5c0548bc7c068bb732c7bc4847554 | Hash listed among VenomRAT IOCs. |
| SHA256 | 29a6fd32cae16336ef5eb28c495e2c6bc38e6555ee9d564792984c359838b4c2 | Hash listed among Calendaromatic IOCs. |
| SHA256 | 2db0c548a91356a4f79bcad8d492342699a5842b36cd813485145df0c2957c08 | Hash listed among Arechclient2 IOCs. |
| SHA256 | 2df520219dd0db59d75203dec58c8d0dcce55b4e947defb1df30fdce4af982da | Hash listed among Arechclient2 IOCs. |
| SHA256 | 38cd4bb0d7e4b8bc5de10df2a2554939ae96642109567e103d779b6eb19c40ae | Hash listed among ACR Stealer IOCs. |
| SHA256 | 3e59379f585ebf0becb6b4e06d0fbbf806de28a4bb256e837b4555f1b4245571 | Hash listed among CoinMiner IOCs. |
| SHA256 | 3e99b0f5eb750b818e55f23a6f1fcf8213e7ed3ac850529ade7e6fa6b7afe0e2 | Hash listed among VenomRAT IOCs. |
| SHA256 | 4867b739b7a4cb72fdd88c7716150e12183b98a07a752753ced440355a5ee193 | Hash listed among ACR Stealer IOCs. |
| SHA256 | 497ed5bca59fa6c01f80d55c5f528a40daff4e4afddfbe58dbd452c45d4866a3 | Hash listed among Calendaromatic IOCs. |
| SHA256 | 4ad9fd2b5519c521765a80f3411f825adcd38409ba6cfefd595873c9c6db92c3 | Hash listed among Jinupd IOCs. |
| SHA256 | 561bf3f3db67996ce81d98f1df91bfa28fb5fc8472ed64606ef8427a97fd8cdd | Hash listed among SombRAT IOCs. |
| SHA256 | 59f7c03a2021cb28a433ae0d018388b2a5b802686ca94699fa0bc9e1917aead0 | Hash listed among CoinMiner IOCs. |
| SHA256 | 64010a9fe4483155044ad76aecbd2cdafab0fc1399e4ae0c644bcce6acbf7f58 | Hash listed among Arechclient2 IOCs. |
| SHA256 | 664aaf79f6347412ff7f0548ea18e07a793b1dac84cd60df011bdba433f7837b | Hash listed among Agent Tesla IOCs. |
| SHA256 | 68f9e86795c5dd817dec72f776ea0162a8c4a9cef26b54843fac00c101158ba1 | Hash listed among Arechclient2 IOCs. |
| SHA256 | 69934dc1d4fdb552037774ee7a75c20608c09680128c9840b508551dbcf463ad | Hash listed among Calendaromatic IOCs. |
| SHA256 | 703f5e60fded94a8fda75bd5bbed5877b2a02bbdfaa36ca9ef2784ab9dbd72f9 | Hash listed among Agent Tesla IOCs. |
| SHA256 | 70d63029c65c21c4681779e1968b88dc6923f92408fe5c7e9ca6cb86d7ba713a | Hash listed among SombRAT IOCs. |
| SHA256 | 8323094c43fcd2da44f60b46f043f7ca4ad6a2106b6561598e94008ece46168b | Hash listed among SombRAT IOCs. |
| SHA256 | 8721d3af5d2d01dc76d8102716dd6bc4271284a7682df46f10b6aacfd5b2cd48 | Hash listed among VenomRAT IOCs. |
| SHA256 | 9375878e6780ed937d68f58904d27257c5ec7af0fef24c6126a8e05eb2dbd4f3 | Hash listed among Jinupd IOCs. |
| SHA256 | 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 | Hash listed among CoinMiner IOCs. |
| SHA256 | ac5fc65ae9500c1107cdd72ae9c271ba9981d22c4d0c632d388b0d8a3acb68f4 | Hash listed among Agent Tesla IOCs. |
| SHA256 | ad0bfefa643b395400d4c89181446dbfec57f263dda39555c2ef5e704a9e6eb6 | Hash listed among Arechclient2 IOCs. |
| SHA256 | b399e181c8d546bbb1658f711220fee6995ffa627aacc24654d10e8c635bdf32 | Hash listed among Calendaromatic IOCs. |
| SHA256 | b9ff92917225778b82c30587d5559628f0ab14c359bd2b6ae4981ff262480fc8 | Hash listed among VenomRAT IOCs. |
| SHA256 | bbf45b03ba04ceab793e2a4dda578c9d4881ba26d1a39bc1257a7996f7c3dfac | Hash listed among VenomRAT IOCs. |
| SHA256 | bc55d60466f7d1a03e4002759aa95cae2bd08cf9c0685f2f822ebcc8956569b2 | Hash listed among VenomRAT IOCs. |
| SHA256 | beb842dd5ec5124b36d861a60410a2f354e0571807d8b4c214f186e70da15698 | Hash listed among Agent Tesla IOCs. |
| SHA256 | c0db3dadf2e270240bb5cad8a652e5e11e3afe41b8ee106d67d47b06f5163261 | Hash listed among SombRAT IOCs. |
| SHA256 | c24774d9b3455b47a41c218d404ae6b702da0d2e3e8ad3d2a353ffddd62239c2 | Hash listed among Calendaromatic IOCs. |
| SHA256 | ca6b92b816c98e3fca7b287cf665257a93f1a35cc768cae223ac31a97d1af203 | Hash listed among Jinupd IOCs. |
| SHA256 | d69764b22d1b68aa9462f1f5f0bf18caebbcff4d592083f80dbce39c64890295 | Hash listed among SombRAT IOCs. |
| SHA256 | dc363b99506502dac735b4b5636dfeadc07fec6742140da0d89673110538e532 | Hash listed among ACR Stealer IOCs. |
| SHA256 | e01fa4ca545c8a4002b9afe3243f80027b76ef5fb81fd5d9e9d1dcaddfaca54b | Hash listed among Jinupd IOCs. |
| SHA256 | e32d6b2b38b11db56ae5bce0d5e5413578a62960aa3fab48553f048c4d5f91f0 | Hash listed among Calendaromatic IOCs. |
| SHA256 | e4a1b01b2a76ef02a2f6ea32275eeee4f44b867d2d5768bf89f870cbfacfa47e | Hash listed among VenomRAT IOCs. |
| SHA256 | f213970c9bde24a7b774e16803b9df9be69e02f1795e777241ada5201ed72666 | Hash listed among Jinupd IOCs. |
| SHA256 | f377e3c8144315d9e4d73354cca966040fd137f6a0e892a843430fd5a0e7590b | Hash listed among Calendaromatic IOCs. |
| SHA256 | f7131fc0267d5e0eae0b00ee05eb221351910114d1794c30997a5e45e24059ef | Hash listed among VenomRAT IOCs. |
| SHA256 | f82938352cebfe4338e0e3e763cfee88aa5dd6229ac36200ce0392619153f4cd | Hash listed among Arechclient2 IOCs. |
Threat Actors
Malware
ACRStealerIn Q3 2025, the MS-ISAC also observed the return of Arechclient2, while ACR Stealer, Calendaromatic, and SombRAT made their first appearances.Agent TeslaCoinMiner, a cryptocurrency miner, and Agent Tesla, a remote access trojan (RAT), followed SocGholish.ArechClient2In Q3 2025, the MS-ISAC also observed the return of Arechclient2, while ACR Stealer, Calendaromatic, and SombRAT made their first appearances.AsyncRATAdditionally, SocGholish can lead to further exploitation, such as loading the NetSupport and AsyncRAT remote access tools or even ransomware in some cases.CalendaromaticIn Q3 2025, the MS-ISAC also observed the return of Arechclient2, while ACR Stealer, Calendaromatic, and SombRAT made their first appearances.CoinMinerCoinMiner, a cryptocurrency miner, and Agent Tesla, a remote access trojan (RAT), followed SocGholish.FIVEHANDSSombRAT has been linked to campaigns involving FIVEHANDS ransomware.JinupdACR Stealer, Agent Tesla, Arechclient2, CoinMiner, Jinupd, and VenomRAT used this technique at the time of publication.Lumma StealerZPHP is also known to drop the NetSupport remote access tool and Lumma Stealer malware.NetSupportAdditionally, SocGholish can lead to further exploitation, such as loading the NetSupport and AsyncRAT remote access tools or even ransomware in some cases.SocGholishSocGholish continued to lead the Top 10 Malware, comprising 30% of detections.SombRATIn Q3 2025, the MS-ISAC also observed the return of Arechclient2, while ACR Stealer, Calendaromatic, and SombRAT made their first appearances.VenomRATACR Stealer, Agent Tesla, Arechclient2, CoinMiner, Jinupd, and VenomRAT used this technique at the time of publication.ZPHPSocGholish, Calendaromatic, and ZPHP used this technique at the time of publication.