New ViperSoftX Infostealer Variant Detected Through DNS<\/title>\n<link crossorigin data-rocket-preconnect href=\"https:\/\/snap.licdn.com\" rel=\"preconnect\">\n<link crossorigin data-rocket-preconnect href=\"https:\/\/ws.zoominfo.com\" rel=\"preconnect\">\n<link crossorigin data-rocket-preconnect href=\"https:\/\/sc.lfeeder.com\" rel=\"preconnect\">\n<link crossorigin data-rocket-preconnect href=\"https:\/\/www.googletagmanager.com\" rel=\"preconnect\">\n<link crossorigin data-rocket-preconnect href=\"https:\/\/cdn-cookieyes.com\" rel=\"preconnect\">\n<link crossorigin data-rocket-preconnect href=\"https:\/\/salesiq.zohopublic.com\" rel=\"preconnect\">\n<link crossorigin data-rocket-preconnect href=\"https:\/\/fonts.googleapis.com\" rel=\"preconnect\"><link rel=\"preload\" data-rocket-preload as=\"image\" href=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/dns-intelligence-detects-vipersoftx-infostealer-variant.jpg\" imagesrcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/dns-intelligence-detects-vipersoftx-infostealer-variant.jpg 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/dns-intelligence-detects-vipersoftx-infostealer-variant-1.jpg 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/dns-intelligence-detects-vipersoftx-infostealer-variant.webp 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/dns-intelligence-detects-vipersoftx-infostealer-variant-2.jpg 480w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/dns-intelligence-detects-vipersoftx-infostealer-variant-3.jpg 1200w\" imagesizes=\"(max-width: 1024px) 100vw, 1024px\" fetchpriority=\"high\">  <meta name=\"description\" content=\"DNS Threat Intelligence revealed a ViperSoftX Infostealer variant, showing how DNS Security stops zero-day infostealers and prevents data exfiltration.\"> <meta name=\"robots\" content=\"max-snippet:-1, max-image-preview:large, max-video-preview:-1\"> <meta name=\"author\" content=\"Karim Hossen\"> <meta name=\"google-site-verification\" content=\"google-site-verification=H0c1O7ZE7N1TjIz_JSYJiR3coR6om020-rZnV-Elrvo\"> <meta name=\"keywords\" content=\"data exfiltration,dns,dns security,dns threat intelligence,enterprise network security,threat detection,threat investigation\"> <link rel=\"canonical\" href=\"https:\/\/efficientip.com\/blog\/dns-intelligence-detects-vipersoftx-infostealer-variant\/\"> <meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 4.8.7\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:site_name\" content=\"EfficientIP\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"New ViperSoftX Infostealer Variant Detected Through DNS\"> <meta property=\"og:description\" content=\"DNS Threat Intelligence revealed a ViperSoftX Infostealer variant, showing how DNS Security stops zero-day infostealers and prevents data exfiltration.\"> <meta property=\"og:url\" content=\"https:\/\/efficientip.com\/blog\/dns-intelligence-detects-vipersoftx-infostealer-variant\/\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/dns-intelligence-detects-vipersoftx-infostealer-variant-3.jpg\"> <meta property=\"og:image:secure_url\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/dns-intelligence-detects-vipersoftx-infostealer-variant-3.jpg\"> <meta property=\"og:image:width\" content=\"1200\"> <meta property=\"og:image:height\" content=\"628\"> <meta property=\"article:tag\" content=\"data exfiltration\"> <meta property=\"article:tag\" content=\"dns\"> <meta property=\"article:tag\" content=\"dns security\"> <meta property=\"article:tag\" content=\"dns threat intelligence\"> <meta property=\"article:tag\" content=\"enterprise network security\"> <meta property=\"article:tag\" content=\"threat detection\"> <meta property=\"article:tag\" content=\"threat investigation\"> <meta property=\"article:published_time\" content=\"2025-09-30T07:38:00+00:00\"> <meta property=\"article:modified_time\" content=\"2025-09-29T15:37:14+00:00\"> <meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/EfficientIP\/\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:site\" content=\"@efficientip\"> <meta name=\"twitter:title\" content=\"New ViperSoftX Infostealer Variant Detected Through DNS\"> <meta name=\"twitter:description\" content=\"DNS Threat Intelligence revealed a ViperSoftX Infostealer variant, showing how DNS Security stops zero-day infostealers and prevents data exfiltration.\"> <meta name=\"twitter:creator\" content=\"@efficientip\"> <meta name=\"twitter:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/dns-intelligence-detects-vipersoftx-infostealer-variant-3.jpg\"> <meta name=\"twitter:label1\" content=\"Written by\"> <meta name=\"twitter:data1\" content=\"Karim Hossen\"> <meta name=\"twitter:label2\" content=\"Est. reading time\"> <meta name=\"twitter:data2\" content=\"9 minutes\">   <link rel=\"dns-prefetch\" href=\"\/\/browser.sentry-cdn.com\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.fontawesome.com\">\n<link rel=\"dns-prefetch\" href=\"\/\/pro.fontawesome.com\">\n<link rel=\"dns-prefetch\" href=\"\/\/fonts.googleapis.com\">\n<link href=\"https:\/\/fonts.gstatic.com\" crossorigin rel=\"preconnect\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"EfficientIP \u00bb Feed\" href=\"https:\/\/efficientip.com\/feed\/\">\n<link data-minify=\"1\" rel=\"stylesheet\" id=\"fontawesome-css\" href=\"https:\/\/efficientip.com\/wp-content\/cache\/min\/1\/releases\/v5.5.0\/css\/all.css?ver=1758795740\" type=\"text\/css\" media=\"all\">\n<link data-minify=\"1\" rel=\"stylesheet\" id=\"fonts-css\" href=\"https:\/\/efficientip.com\/wp-content\/cache\/min\/1\/wp-content\/themes\/beaverwarrior\/assets\/fonts\/fonts.css?ver=1758795740\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"wp-block-library-css\" href=\"https:\/\/efficientip.com\/wp-includes\/css\/dist\/block-library\/style.min.css?ver=6.8.2\" type=\"text\/css\" media=\"all\"> <link data-minify=\"1\" rel=\"stylesheet\" id=\"font-awesome-5-css\" href=\"https:\/\/efficientip.com\/wp-content\/cache\/min\/1\/releases\/v5.15.4\/css\/all.css?ver=1758795741\" type=\"text\/css\" media=\"all\">\n<link data-minify=\"1\" rel=\"stylesheet\" id=\"dashicons-css\" href=\"https:\/\/efficientip.com\/wp-content\/cache\/min\/1\/wp-includes\/css\/dashicons.min.css?ver=1758795740\" type=\"text\/css\" media=\"all\"> <link data-minify=\"1\" rel=\"stylesheet\" id=\"bootstrap-css\" href=\"https:\/\/efficientip.com\/wp-content\/cache\/min\/1\/wp-content\/themes\/bb-theme\/css\/bootstrap.min.css?ver=1758795741\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"space-station-main-css\" href=\"https:\/\/efficientip.com\/wp-content\/cache\/background-css\/1\/efficientip.com\/wp-content\/uploads\/beaverwarrior\/skin-68d517cfe9ad1.css?wpr_t=1759204100\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"slick-slider-css\" href=\"https:\/\/efficientip.com\/wp-content\/themes\/beaverwarrior\/assets\/vendor\/slick\/slick\/slick.css\" type=\"text\/css\" media=\"all\">\n<link data-minify=\"1\" rel=\"stylesheet\" id=\"tablepress-default-css\" href=\"https:\/\/efficientip.com\/wp-content\/cache\/min\/1\/wp-content\/plugins\/tablepress\/css\/build\/default.css?ver=1758795741\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"fl-builder-google-fonts-123a601186055288986484015a249e40-css\" href=\"\/\/fonts.googleapis.com\/css?family=Poppins%3A600&ver=6.8.2\" type=\"text\/css\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/efficientip.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/efficientip.com\/wp-json\/wp\/v2\/posts\/78975\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/efficientip.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.8.2\">\n<link rel=\"shortlink\" href=\"https:\/\/efficientip.com\/?p=78975\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/efficientip.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fefficientip.com%2Fblog%2Fdns-intelligence-detects-vipersoftx-infostealer-variant%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/efficientip.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fefficientip.com%2Fblog%2Fdns-intelligence-detects-vipersoftx-infostealer-variant%2F&format=xml\">\n<noscript><\/noscript><br \/>\n<br \/>\n <link rel=\"icon\" href=\"https:\/\/efficientip.com\/wp-content\/uploads\/2022\/07\/cropped-Efficient-IP-Favicon-1-32x32.png\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/efficientip.com\/wp-content\/uploads\/2022\/07\/cropped-Efficient-IP-Favicon-1-192x192.png\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/efficientip.com\/wp-content\/uploads\/2022\/07\/cropped-Efficient-IP-Favicon-1-180x180.png\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/efficientip.com\/wp-content\/uploads\/2022\/07\/cropped-Efficient-IP-Favicon-1-270x270.png\"> <noscript><\/noscript> <noscript> <\/noscript><br \/>\n<meta name=\"generator\" content=\"WP Rocket 3.19.4\" data-wpr-features=\"wpr_lazyload_css_bg_img wpr_delay_js wpr_defer_js wpr_minify_js wpr_lazyload_images wpr_preconnect_external_domains wpr_oci wpr_image_dimensions wpr_minify_css wpr_preload_links wpr_desktop\"><\/head><body class=\"wp-singular post-template-default single single-post postid-78975 single-format-standard wp-embed-responsive wp-theme-bb-theme wp-child-theme-beaverwarrior fl-builder-2-9-3 fl-themer-1-5-1-1 fl-theme-1-7-16 fl-no-js fl-theme-builder-footer fl-theme-builder-footer-footer fl-theme-builder-singular fl-theme-builder-singular-blog-inner fl-theme-builder-header fl-theme-builder-header-header-for-white-bg fl-framework-bootstrap fl-preset-default fl-full-width fl-has-sidebar fl-search-active has-blocks\" itemscope=\"itemscope\" itemtype=\"http:\/\/schema.org\/WebPage\" data-offcanvas-hover-min data-utmpreserve-preserve data-utmpreserve-forminject id=\"readabilityBody\"> <a aria-label=\"Skip to content\" class=\"fl-screen-reader-text\" href=\"https:\/\/efficientip.com\/blog\/dns-intelligence-detects-vipersoftx-infostealer-variant\/#fl-main-content\">Skip to content<\/a> <\/p>\n<div class=\"fl-page-content\" itemprop=\"mainContentOfPage\">\n<div class=\"fl-builder-content fl-builder-content-1797 fl-builder-global-templates-locked\" data-post-id=\"1797\">\n<div class=\"fl-row fl-row-full-width fl-row-bg-none fl-node-b1k2ce8oat94 fl-row-default-height fl-row-align-center\" data-node=\"b1k2ce8oat94\">\n<div class=\"fl-row-content-wrap\">\n<div class=\"fl-row-content fl-row-fixed-width fl-node-content\">\n<div class=\"fl-col-group fl-node-n03jagzvc2tl\" data-node=\"n03jagzvc2tl\">\n<div class=\"fl-col fl-node-89er0fmqv3bj fl-col-bg-color\" data-node=\"89er0fmqv3bj\">\n<div class=\"fl-col-content fl-node-content\" readability=\"32.41935483871\">\n<div class=\"fl-module fl-module-heading fl-node-1f0jhtmx592z\" data-node=\"1f0jhtmx592z\" readability=\"10\">\n<p><h2 class=\"fl-heading\"> <span class=\"fl-heading-text\">A new ViperSoftX Infostealer variant has been uncovered by EfficientIP\u2019s DNS Threat Intelligence. Using systematic domain generation and stealthy tactics, this malware evaded traditional defenses\u2014until DNS-level monitoring revealed its infrastructure.<\/span> <\/h2>\n<\/p>\n<\/div>\n<div class=\"fl-module fl-module-rich-text fl-node-thaiqw8z9u56\" data-node=\"thaiqw8z9u56\">\n<div class=\"fl-module-content fl-node-content\" readability=\"25.2\">\n<div class=\"fl-rich-text\" readability=\"26.4\">\n<p>September 30, 2025 <span class=\"separator\">|<\/span> Written by: Karim Hossen <span class=\"separator\">|<\/span> <a href=\"https:\/\/efficientip.com\/blog\/category\/dns-security\/\" rel=\"tag\" class=\"dns-security\">DNS Security<\/a><\/p>\n<\/div><\/div>\n<\/div>\n<\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<div class=\"fl-row fl-row-full-width fl-row-bg-none fl-node-3wko4tveyu8f fl-row-default-height fl-row-align-center\" data-node=\"3wko4tveyu8f\">\n<div class=\"fl-row-content-wrap\">\n<div class=\"fl-row-content fl-row-fixed-width fl-node-content\">\n<div class=\"fl-col-group fl-node-ql4karf5bwmy\" data-node=\"ql4karf5bwmy\">\n<div class=\"fl-col fl-node-j7nz3ua9yrme fl-col-bg-color fl-col-small\" data-node=\"j7nz3ua9yrme\">\n<div class=\"fl-col-content fl-node-content\">\n<div class=\"fl-module fl-module-rich-text fl-node-t7brk9mjsiu4\" data-node=\"t7brk9mjsiu4\" readability=\"32\">\n<div class=\"fl-module-content fl-node-content\" readability=\"34\">\n<p><h3>Get the latest news, invites to events, and much more<\/h3>\n<\/p><\/div>\n<\/div><\/div>\n<\/div>\n<div class=\"fl-col fl-node-6ik3bvz0h19j fl-col-bg-color fl-col-has-cols\" data-node=\"6ik3bvz0h19j\">\n<div class=\"fl-col-content fl-node-content\">\n<div class=\"fl-col-group fl-node-7tilh4d3s0ex fl-col-group-nested\" data-node=\"7tilh4d3s0ex\">\n<div class=\"fl-col fl-node-x86mc7wkasgz fl-col-bg-color\" data-node=\"x86mc7wkasgz\">\n<div class=\"fl-col-content fl-node-content\">\n<div class=\"fl-module fl-module-rich-text fl-node-6gyzi9lx5t1p resource-content\" data-node=\"6gyzi9lx5t1p\">\n<div class=\"fl-module-content fl-node-content\">\n<div class=\"fl-rich-text\"> <html readability=\"87.943058953516\"><body readability=\"175.88611790703\"><\/p>\n<figure class=\"wp-block-image size-large\"><img data-recalc-dims=\"1\" fetchpriority=\"high\" title=\"Blogdns Security Detects Zeroday Malware New Variantsocial | Efficientip\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/dns-intelligence-detects-vipersoftx-infostealer-variant.jpg?resize=640%2C335&ssl=1\" alt=\"Dns Intelligence Detects Vipersoftx Infostealer Variant\" class=\"wp-image-78987\" fetchpriority=\"high\" decoding=\"async\" width=\"640\" height=\"335\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/dns-intelligence-detects-vipersoftx-infostealer-variant.jpg 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/dns-intelligence-detects-vipersoftx-infostealer-variant-1.jpg 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/dns-intelligence-detects-vipersoftx-infostealer-variant.webp 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/dns-intelligence-detects-vipersoftx-infostealer-variant-2.jpg 480w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/dns-intelligence-detects-vipersoftx-infostealer-variant-3.jpg 1200w\" sizes=\"(max-width: 1024px) 100vw, 1024px\"><\/figure>\n<p>EfficientIP\u2019s DNS Threat Intelligence has detected a new ViperSoftX Infostealer variant linked to the previously exposed EIP-458-CryptoStealer. What began as a single-domain, stealthy zero-day has evolved into a complex, well-structured, and resilient campaign designed to evade takedowns. Attackers now reinforce their infrastructure with systematic domain clusters, selective registrations, and shared configurations, making the infostealer more persistent and dangerous. This blog shows the critical role of DNS Threat Intelligence in exposing such hidden threats.<\/p>\n<h2 class=\"wp-block-heading\"><strong>Recap: How DNS Threat Intelligence First Exposed the EIP Infostealer<\/strong><\/h2>\n<p>The<a href=\"https:\/\/efficientip.com\/blog\/zero-day-malware-first-detected-by-dns-threat-intelligence\/\"> EIP-458-CryptoStealer<\/a>, later confirmed as a ViperSoftX Infostealer variant, was first detected by EfficientIP\u2019s DNS Threat Intelligence through DNS traffic monitoring. This early detection was crucial as the zero-day malware employed advanced evasion tactics, shifting from DNS TXT manipulation to HTTPS and operating in memory with encoded data to enable stealthy <a href=\"https:\/\/efficientip.com\/glossary\/what-is-data-exfiltration\/\">data exfiltration<\/a>. Traditional security measures like antivirus, EDR, and firewalls proved insufficient against such stealthy threats, underscoring the necessity of <a href=\"https:\/\/efficientip.com\/solutions\/360-dns-security-your-first-line-of-defense\/\">DNS Security<\/a> as a critical layer of defense. Our <a href=\"https:\/\/efficientip.com\/blog\/dns-threat-intelligence-exposed-an-infostealer-deep-dive\/\">previous blog <\/a>detailed this deep research, showing how DNS Threat Intelligence uncovered the campaign and exposed its evolving tactics.<\/p>\n<h2 class=\"wp-block-heading\"><strong>A New Variant of the Infostealer Recently Exposed<\/strong><\/h2>\n<p>Continuous monitoring by DNS Threat Intelligence identified a new zero-day variant of the EIP-458 Infostealer campaign by mid-2025, formally designated EIP-461-CryptoStealer v2. The variant reveals that the campaign is expanding, showing greater persistence, and evolving its tactics. Moreover, the research revealed that the Cryptostealer is, in fact, a ViperSoftX Infostealer variant.<\/p>\n<p>The broadened activity demonstrates that attackers are deliberately strengthening their infrastructure to resist takedown efforts. This shift highlights a determined move toward long-term durability, persistence, and reach.<\/p>\n<h2 class=\"wp-block-heading\"><strong>Strengthening Attack Infrastructure With Structured Clusters<\/strong><\/h2>\n<p>In analyzing this new ViperSoftX Infostealer variant, researchers found that attackers no longer relied on isolated domains. Instead, they built structured clusters with clear naming rules, rotating them in as needed. This systematic design gave the campaign persistence, even when individual domains were blocked or taken down.<\/p>\n<p>We\u2019ll cover these techniques in depth \u2014 including how EfficientIP\u2019s AI-driven detection exposed entire clusters before they became operational \u2014 in our next blog focused on early detection of domain-based threats.<\/p>\n<h2 class=\"wp-block-heading\"><strong>Coordinated Infrastructure and Registration Tactics<\/strong><\/h2>\n<p>Expanding beyond domain patterns, the campaign demonstrated a carefully coordinated approach to infrastructure and registration. While hundreds of interchangeable domains were algorithmically possible, only a select few were formally registered and made operational. <\/p>\n<p>Notably, activatordb.com was registered on March 16, 2025 and slimawriter.com on April 17, 2025, both through Njalla, a registrar known for providing anonymity services. In contrast, quasardb.com appeared legitimate \u2014 registered since 2007, tied to QUASAR DATABASE TECHNOLOGIES, hosted on Microsoft Azure, with ownership validated through TXT records.<\/p>\n<p>The use of VirusTotal Graph quickly highlighted links across these domains. Several unregistered domains were already flagged as malicious by antivirus engines and associated with a specific PowerShell script (SHA256: db0bb352bd600db588e65f7bd1ee74bfad9cb11ee67f59497e2d442c6f962aa9). This script was responsible for downloading the stager from domains such as slimawriter.com, underscoring the operational role of this infrastructure.<\/p>\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-large\"><img data-recalc-dims=\"1\" fetchpriority=\"high\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/dns-intelligence-detects-vipersoftx-infostealer-variant.png?resize=640%2C670&ssl=1\" alt=\"Graph of Malicious Domain Connections\" class=\"wp-image-78983\" title=\"Graph of Malicious Domain Connections\" fetchpriority=\"high\" decoding=\"async\" width=\"640\" height=\"670\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/dns-intelligence-detects-vipersoftx-infostealer-variant.png 978w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/dns-intelligence-detects-vipersoftx-infostealer-variant-2.png 286w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/dns-intelligence-detects-vipersoftx-infostealer-variant-3.png 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/dns-intelligence-detects-vipersoftx-infostealer-variant-4.png 480w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/dns-intelligence-detects-vipersoftx-infostealer-variant-1.webp 1224w\" sizes=\"(max-width: 978px) 100vw, 978px\"><figcaption class=\"wp-element-caption\"><strong>Graph of Malicious Domain Connections<\/strong><\/figcaption><\/figure>\n<\/div>\n<p>Graph-based analysis of DNS infrastructure confirmed that these domains were not isolated artifacts but part of a linked ecosystem. Shared configurations, overlapping registration details, and synchronized activity patterns revealed deliberate planning by the attackers. By registering only the minimal number of domains needed to keep the campaign active, while leaving many others dormant or unregistered, they built an infrastructure that was both resilient and scalable.<\/p>\n<p>This selective registration strategy gave attackers the ability to operate with stealth and efficiency: a few active domains maintained the campaign, while the larger pool of potential domains remained hidden until needed. Combined with the systematic naming and DGA logic, this coordination ensured the campaign could endure disruption and scale on demand.<\/p>\n<h2 class=\"wp-block-heading\"><strong>Link to Notorious ViperSoftX Confirmed<\/strong><\/h2>\n<p>A critical finding in the analysis is the <strong>confirmed link to the notorious ViperSoftX malware family<\/strong>. ViperSoftX is a long-running infostealer known for targeting credentials, cryptocurrency wallets, and browser data \u2014 and it <strong>remains active today<\/strong>, with ongoing campaigns observed in the wild.<\/p>\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img data-recalc-dims=\"1\" fetchpriority=\"high\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/dns-intelligence-detects-vipersoftx-infostealer-variant-1.png?resize=387%2C512&ssl=1\" alt=\"Vipersoftx Activity June 2025\" class=\"wp-image-78977\" title=\"Vipersoftx Activity June 2025\" fetchpriority=\"high\" decoding=\"async\" width=\"387\" height=\"512\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/dns-intelligence-detects-vipersoftx-infostealer-variant-1.png 387w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/09\/dns-intelligence-detects-vipersoftx-infostealer-variant-5.png 227w\" sizes=\"(max-width: 387px) 100vw, 387px\"><figcaption class=\"wp-element-caption\"><strong>ViperSoftX Activity June 2025<\/strong><\/figcaption><\/figure>\n<\/div>\n<p><strong>ViperSoftX Activity June 2025<\/strong><\/p>\n<p>The present campaign shows direct overlap with this family, confirmed through cryptographic and infrastructure evidence. The strongest proof comes from cryptographic reuse. Analysis revealed that the malware employed an <strong>RSA public key (KeyBlob)<\/strong> to verify payload signatures \u2014 the exact same key previously identified in ViperSoftX samples. In hexadecimal form, the key is:<\/p>\n<figure class=\"wp-block-table\">\n<table class=\"has-fixed-layout\">\n<tbody readability=\"2.5\">\n<tr readability=\"5\">\n<td>0602000000c2a40000525341310004000001000100c2abc28813c28bc3971fc2a9c3b2c2850bc292694f0dc28c58770002c3b94f114dc298c3a4c2a21f38755944c2b6c382c2aac3ba10034e685c252509c3bac2a4c3b4c383765cc2be3a1423c286530ac3a572c3a5c289c3b4c2b20a1f2e50c39d49c281c3b0c2b709c3b5c2b1c3844dc28f47c28e3c0575c3b136027417c3a1c291352e15c28ec29ec38ec3bac2b5c3b1086e6554c39ac39b63c384c38370475d376fc39ac3910c65c2a52d0d247661c3a8c381c3b5c39dc2b4c2a9<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n<p>The reuse of this <strong>unique cryptographic signature<\/strong> provides <strong>high-confidence attribution<\/strong>, confirming that the same threat actors are behind both the current malware and ViperSoftX. Publicly available research on GitHub further corroborates this link, documenting earlier PowerShell variants of ViperSoftX using the same key.<\/p>\n<p>Historical infrastructure patterns reinforce the connection. Previous ViperSoftX variants relied on a similar <strong>domain generation scheme<\/strong>, using prefixes like <em>wmail<\/em>, <em>fairu<\/em>, <em>bideo<\/em>, <em>privatproxy<\/em>, and <em>ahoravideo<\/em>, combined with suffixes such as <em>endpoint<\/em>, <em>blog<\/em>, <em>chat<\/em>, <em>cdn<\/em>, and <em>schnellvpn<\/em>, across <em>.com<\/em> and <em>.xyz<\/em> TLDs. <\/p>\n<figure class=\"wp-block-table\">\n<table class=\"has-fixed-layout\">\n<tbody>\n<tr>\n<td><strong>Prefix<\/strong><\/td>\n<td><strong>Suffix<\/strong><\/td>\n<td><strong>TLD<\/strong><\/td>\n<\/tr>\n<tr>\n<td>wmail<\/td>\n<td>endpoint<\/td>\n<td>com<\/td>\n<\/tr>\n<tr>\n<td>fairu<\/td>\n<td>blog<\/td>\n<td>xyz<\/td>\n<\/tr>\n<tr>\n<td>bideo<\/td>\n<td>chat<\/td>\n<td><\/td>\n<\/tr>\n<tr>\n<td>privatproxy<\/td>\n<td>cdn<\/td>\n<td><\/td>\n<\/tr>\n<tr>\n<td>ahoravideo<\/td>\n<td>schnellvpn<\/td>\n<td><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n<p>The continuity of domain-generation logic, combined with the cryptographic overlap, confirms this is not a copycat but an <strong>evolution of the same malware line<\/strong>. The domains observed in the current campaign belong to the same DGA family (PwrSh:CryptoStealer-C) that EfficientIP has been tracking in its DNS threat intelligence feed, <a href=\"https:\/\/efficientip.com\/products\/dns-threat-pulse\/\">DNS Threat Pulse (DTP)<\/a>, since June 2022. This long-term presence demonstrates that the same ViperSoftX operators have been refining and extending their campaigns for years.<\/p>\n<p>This attribution significantly elevates the threat level. Attackers are not only reusing a <strong>proven infostealer family<\/strong> but also scaling it with <strong>systematic clusters, coordinated infrastructure, and DGA-powered persistence<\/strong>, transforming ViperSoftX into a more resilient and persistent campaign.<\/p>\n<p>The EfficientIP DNS Security solution can detect such resilient attacks thanks to the combination of <a href=\"https:\/\/efficientip.com\/products\/dns-client-query-filtering\/\">advanced DNS Filtering<\/a> and a <a href=\"https:\/\/efficientip.com\/products\/dns-threat-pulse\/\">dynamic threat intelligence feed<\/a>, enabling early detection of suspicious activity and blocking malware, phishing, and data exfiltration attempts.<\/p>\n<h2 class=\"wp-block-heading\"><strong>Key IOC Summary (Domains and Hash Files Only)<\/strong><\/h2>\n<figure class=\"wp-block-table\">\n<table class=\"has-fixed-layout\">\n<tbody readability=\"54\">\n<tr>\n<td><strong>Description<\/strong><\/td>\n<td><strong>Type<\/strong><\/td>\n<td><strong>Value<\/strong><\/td>\n<\/tr>\n<tr readability=\"2\">\n<td colspan=\"3\"><strong>Unique Malware Detection \u2013 May 2025 \u2013 EIP-458<\/strong><\/td>\n<\/tr>\n<tr readability=\"4\">\n<td>Active C2, registered Apr 17, 2025 via Njalla<\/td>\n<td>Domain<\/td>\n<td>slimawriter[.]com<\/td>\n<\/tr>\n<tr readability=\"2\">\n<td>Original C2 domain used to deliver stager via DNS TXT queries<\/td>\n<td>Domain<\/td>\n<td>activatorcounter[.]com<\/td>\n<\/tr>\n<tr readability=\"3\">\n<td>Stage file<\/td>\n<td>Hash<\/td>\n<td>Md5 : afd1c0d22c427d419da11b855a63605dSha1: 1ae9b3e0b4d8df0c045258d43521c5f89b8a7be8Sha256: e06d9924e8bb258480702d91a75bfda05f4ddf71869762e3bdfdd6f7f7554437<\/td>\n<\/tr>\n<tr readability=\"3\">\n<td>Payload file<\/td>\n<td>Hash<\/td>\n<td>Md5 : 6be0c02582a2d8da479f543dacf1691dSha1: 86675dedad33de575cf809a607ace11062f834a7Sha256: a7c268b33d953662c2208167d1c8393143707ded559c98b854d2f5c455209ceb<\/td>\n<\/tr>\n<tr readability=\"2\">\n<td colspan=\"3\"><strong>Unique New Variant Detection \u2013 September 2025 \u2013 EIP-461<\/strong><\/td>\n<\/tr>\n<tr readability=\"4\">\n<td>Registered domain, Mar 16, 2025 via Njalla<\/td>\n<td>Domain<\/td>\n<td>activatordb[.]com<\/td>\n<\/tr>\n<tr readability=\"4\">\n<td>Legitimate domain (since 2007, Azure-hosted, tied to QUASAR DATABASE TECHNOLOGIES)<\/td>\n<td>Domain<\/td>\n<td>quasardb[.]com<\/td>\n<\/tr>\n<tr readability=\"4\">\n<td>PowerShell stager for in-memory execution<\/td>\n<td>SHA256<\/td>\n<td>db0bb352bd600db588e65f7bd1ee74bfad9cb11ee67f59497e2d442c6f962aa9<\/td>\n<\/tr>\n<tr readability=\"3\">\n<td colspan=\"3\"><strong>Domains Detected by DGA Tuple Clustering Detection \u2013 From June 2022 \u2013 EIP-455<\/strong><strong>Also identified as Infostealer EIP-461<\/strong><\/td>\n<\/tr>\n<tr readability=\"13\">\n<td>Systematic domain cluster \u2013 Slima prefix<\/td>\n<td>Domains<\/td>\n<td>slimardb[.]com, slimardb[.]xyz, slimashlow[.]com, slimashlow[.]xyz, slimatfdsc[.]com, slimatfdsc[.]xyz, slimavirtualb[.]com, slimavirtualb[.]xyz, slimawriter[.]xyz<\/td>\n<\/tr>\n<tr readability=\"13\">\n<td>Systematic domain cluster \u2013 Activato prefix<\/td>\n<td>Domains<\/td>\n<td>activatordb[.]xyz, activatoshlow[.]com, activatoshlow[.]xyz, activatotfdsc[.]com, activatotfdsc[.]xyz, activatovirtualb[.]com, activatovirtualb[.]xyz, activatowriter[.]com, activatowriter[.]xyz<\/td>\n<\/tr>\n<tr readability=\"14\">\n<td>Systematic domain cluster \u2013 Freed prefix<\/td>\n<td>Domains<\/td>\n<td>freedrdb[.]com, freedrdb[.]xyz, freedshlow[.]com, freedshlow[.]xyz, freedtfdsc[.]com, freedtfdsc[.]xyz, freedvirtualb[.]com, freedvirtualb[.]xyz, freedwriter[.]com, freedwriter[.]xyz<\/td>\n<\/tr>\n<tr readability=\"13\">\n<td>Systematic domain cluster \u2013 Quasar prefix<\/td>\n<td>Domains<\/td>\n<td>quasardb[.]xyz, quasashlow[.]com, quasashlow[.]xyz, quasatfdsc[.]com, quasatfdsc[.]xyz, quasavirtualb[.]com, quasavirtualb[.]xyz, quasawriter[.]com, quasawriter[.]xyz<\/td>\n<\/tr>\n<tr readability=\"14\">\n<td>Systematic domain cluster \u2013 Yeild prefix<\/td>\n<td>Domains<\/td>\n<td>yeildrdb[.]com, yeildrdb[.]xyz, yeildshlow[.]com, yeildshlow[.]xyz, yeildtfdsc[.]com, yeildtfdsc[.]xyz, yeildvirtualb[.]com, yeildvirtualb[.]xyz, yeildwriter[.]com, yeildwriter[.]xyz<\/td>\n<\/tr>\n<tr readability=\"4\">\n<td>Active C2, registered Apr 17, 2025 via Njalla<\/td>\n<td>Domain<\/td>\n<td>slimawriter[.]com<\/td>\n<\/tr>\n<tr readability=\"2\">\n<td>Original C2 domain used to deliver stager via DNS TXT queries<\/td>\n<td>Domain<\/td>\n<td>activatorcounter[.]com<\/td>\n<\/tr>\n<tr readability=\"4\">\n<td>Active C2, registered Apr 17, 2025 via Njalla<\/td>\n<td>Domain<\/td>\n<td>slimawriter[.]com<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n<h2 class=\"wp-block-heading\"><strong>Recommendations<\/strong><\/h2>\n<p>The evolution of <strong>EIP-461-CryptoStealer v2<\/strong> demonstrates that modern infostealers are designed for <strong>persistence and resilience<\/strong>, evading traditional endpoint and perimeter defenses. To reduce exposure to stealthy malware campaigns such as the evolving EIP Infostealer, organizations must adopt <strong>proactive DNS-centric defenses<\/strong>:<\/p>\n<ol class=\"wp-block-list\">\n<li><strong>Implement layered security with DNS traffic analysis<\/strong><strong><br \/><\/strong><a href=\"https:\/\/efficientip.com\/products\/dns-guardian\/\"> Monitor anomalies<\/a> such as TXT-only queries, unusual packet sizes, or systematic domain patterns by leveraging <a href=\"https:\/\/efficientip.com\/solutions\/360-dns-security-your-first-line-of-defense\/\">DNS Security<\/a>. DNS is often the first and only layer to reveal malicious activity.<\/li>\n<li><strong>Regularly update DNS threat intelligence feeds<\/strong><strong><br \/><\/strong>Ensure resolvers are enriched with continuously updated <a href=\"https:\/\/efficientip.com\/products\/dns-threat-pulse\/\">DNS-Centric intelligence feeds capable<\/a> of identifying newly generated domains and malicious clusters.<\/li>\n<li><strong>Enable granular DNS filtering at the resolver level<\/strong><strong><br \/><\/strong>Block malicious infrastructure in real time using <a href=\"https:\/\/efficientip.com\/products\/dns-client-query-filtering\/\">granular client filtering<\/a> to disrupt C2 communications, stop data exfiltration, and prevent attackers from rotating through systematic domain clusters.<\/li>\n<li><strong>Integrate DNS insights into SOC and SIEM workflows<\/strong><strong><br \/><\/strong> Feed DNS IOCs into <a href=\"https:\/\/efficientip.com\/industry-alliances\/\">SOC playbooks and SIEM dashboards<\/a> to accelerate investigation, triage, and incident response.<\/li>\n<li><strong>Conduct regular DNS audits and risk assessments<\/strong><strong><br \/><\/strong>Regular<a href=\"https:\/\/efficientip.com\/support-services\/dns-risk-assessment\/\"> DNS risk assessments<\/a> help organizations uncover hidden exposures and validate their defensive posture.<\/li>\n<li><strong>Utilize AI-driven algorithms for malware and DGA detection and analytics<\/strong><strong><br \/><\/strong>Tools such as EfficientIP\u2019s <strong>patented DGA Tuple Clustering engine<\/strong> can expose malicious clusters before they become operational. The <a href=\"https:\/\/efficientip.com\/products\/dns-intelligence%20center\/\"><strong>DNS Intelligence Center <\/strong><\/a>delivers insightful, actionable, and reliable DNS analytics to strengthen threat detection, accelerate investigations, and support forensic analysis.<\/li>\n<\/ol>\n<p>By implementing these measures, organizations can ensure that <a href=\"https:\/\/efficientip.com\/solutions\/360-dns-security-your-first-line-of-defense\/\">DNS Security<\/a> serves as a <strong>front-line defense<\/strong> \u2014 proactively detecting, blocking, and anticipating infostealer campaigns before they cause data theft, financial losses, or regulatory exposure.<\/p>\n<h2 class=\"wp-block-heading\"><strong>Conclusion<\/strong><\/h2>\n<p>The discovery of a new EIP-458 Infostealer variant shows how the campaign continues to expand with systematic domains and resilient infrastructure. The confirmed link to the notorious ViperSoftX family underscores the severity of this threat: attackers are not only reusing proven malware but also scaling it into stronger, more persistent campaigns. According to a <a href=\"https:\/\/efficientip.com\/resources\/forrester-2025-dns-security-report\/\">Forrester study<\/a>, 85% of security leaders conduct regular DNS audits to improve cloud infrastructure security. EfficientIP helps put this into practice with a<a href=\"https:\/\/efficientip.com\/support-services\/dns-risk-assessment\/\"> free DNS Risk Assessment<\/a>, enabling organizations to validate their exposure and strengthen DNS as a front-line defense.<\/p>\n<p><\/body><br \/>\n<\/html><\/div>\n<\/p><\/div>\n<\/div>\n<\/div>\n<\/div><\/div>\n<div class=\"fl-col-group fl-node-8oqvc36nk4wz fl-col-group-nested\" data-node=\"8oqvc36nk4wz\">\n<div class=\"fl-col fl-node-zfgsxvydn1tu fl-col-bg-photo\" data-node=\"zfgsxvydn1tu\">\n<div class=\"fl-col-content fl-node-content\" readability=\"26.426229508197\">\n<div class=\"fl-module fl-module-heading fl-node-iudprhnsx4c3\" data-node=\"iudprhnsx4c3\" readability=\"7\">\n<p><h3 class=\"fl-heading\"> <span class=\"fl-heading-text\"> Check if Infostealers Are Hiding in Your DNS <\/span> <\/h3>\n<\/p>\n<\/div>\n<div class=\"fl-module fl-module-rich-text fl-node-zjyf4i1pa2sr\" data-node=\"zjyf4i1pa2sr\">\n<div class=\"fl-module-content fl-node-content\" readability=\"31.5\">\n<div class=\"fl-rich-text\" readability=\"33\">\n<p>Run a free DNS Risk Assessment to check if hidden infostealers like EIP-458 or ViperSoftX are in your network.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/div><\/div>\n<\/div><\/div>\n<\/div>\n<\/div><\/div>\n<div class=\"fl-col-group fl-node-q0luxfnc68h4\" data-node=\"q0luxfnc68h4\">\n<div class=\"fl-col fl-node-58pt2he0o7nw fl-col-bg-color\" data-node=\"58pt2he0o7nw\">\n<div class=\"fl-col-content fl-node-content\">\n<div class=\"fl-module fl-module-bw-related-posts fl-node-qjvi3gu1mc6t\" data-node=\"qjvi3gu1mc6t\">\n<div class=\"fl-module-content fl-node-content\" readability=\"9.7377521613833\">\n<div class=\"related-posts\" readability=\"2.1988472622478\">  <\/p>\n<h2 class=\"related-posts__title\"> Latest Blog Posts <\/h2>\n<p class=\"related-posts__description\"> Explore content highlighting the value EfficientIP solutions bring to your network <\/p>\n<p>  <\/div>\n<\/p><\/div>\n<\/div>\n<\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div><\/div>\n<p><\/p>\n<footer class=\"fl-builder-content fl-builder-content-651 fl-builder-global-templates-locked\" data-post-id=\"651\" data-type=\"footer\" itemscope=\"itemscope\" itemtype=\"http:\/\/schema.org\/WPFooter\">\n<div class=\"fl-row fl-row-full-width fl-row-bg-color fl-node-8r0kfap1bu5m fl-row-default-height fl-row-align-center\" data-node=\"8r0kfap1bu5m\">\n<div class=\"fl-row-content-wrap\">\n<div class=\"fl-row-content fl-row-fixed-width fl-node-content\">\n<div class=\"fl-col-group fl-node-tb9w0znxom2s fl-col-group-equal-height fl-col-group-align-center fl-col-group-custom-width\" data-node=\"tb9w0znxom2s\">\n<div class=\"fl-col fl-node-kbfdxo6msgna fl-col-bg-color fl-col-small fl-col-small-custom-width\" data-node=\"kbfdxo6msgna\">\n<div class=\"fl-col-content fl-node-content\">\n<div class=\"fl-module fl-module-rich-text fl-node-so3qg2du7cjl\" data-node=\"so3qg2du7cjl\">\n<div class=\"fl-module-content fl-node-content\">\n<div class=\"fl-rich-text\">\n<p>\u00a9 2025 EfficientIP<\/p>\n<\/div><\/div>\n<\/div>\n<\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/footer>\n<p> <br \/>\n <noscript><\/noscript><br \/>\n <\/body> <a href=\"https:\/\/efficientip.com\/blog\/dns-intelligence-detects-vipersoftx-infostealer-variant\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>New ViperSoftX Infostealer Variant Detected Through DNS Skip to content<\/p>\n","protected":false},"author":5,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[2158,30,62,2123,897,1027,3480],"tags":[2159,38,69,2127,904,1029,3481],"class_list":["post-8041","post","type-post","status-publish","format-standard","hentry","category-data-exfiltration","category-dns","category-dns-security","category-dns-threat-intelligence","category-enterprise-network-security","category-threat-detection","category-threat-investigation","tag-data-exfiltration","tag-dns","tag-dns-security","tag-dns-threat-intelligence","tag-enterprise-network-security","tag-threat-detection","tag-threat-investigation"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Efficient IP","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/efficient-ip\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/data-exfiltration\/\" rel=\"category tag\">Data Exfiltration<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/dns\/\" rel=\"category tag\">DNS<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/dns-security\/\" rel=\"category tag\">DNS Security<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/dns-threat-intelligence\/\" rel=\"category tag\">DNS Threat Intelligence<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/enterprise-network-security\/\" rel=\"category tag\">enterprise network security<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/threat-detection\/\" rel=\"category tag\">threat detection<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/threat-investigation\/\" rel=\"category tag\">Threat Investigation<\/a>","tag_info":"Threat Investigation","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/8041","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=8041"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/8041\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=8041"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=8041"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=8041"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":8041,"date":"2025-09-30T02:38:00","date_gmt":"2025-09-30T07:38:00","guid":{"rendered":"https:\/\/efficientip.com\/?p=78975"},"modified":"2025-09-30T02:38:00","modified_gmt":"2025-09-30T07:38:00","slug":"dns-intelligence-detects-vipersoftx-infostealer-variant","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2025\/09\/30\/dns-intelligence-detects-vipersoftx-infostealer-variant\/","title":{"rendered":"DNS Intelligence Detects ViperSoftX Infostealer Variant"},"content":{"rendered":"