IndicatorPublished 28 Oct 2023Updated 29 Oct 2023

type osint · ThreatFox IOCs for 2023-10-28

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 17

sdl.faqserv.comIRATA payload delivery domain (confidence level: 100%)
cdm.faqserv.comIRATA payload delivery domain (confidence level: 100%)
cfb.faqserv.comIRATA payload delivery domain (confidence level: 100%)
adsh.vizvaz.comIRATA payload delivery domain (confidence level: 100%)
rbm.faqserv.comIRATA payload delivery domain (confidence level: 100%)
service-m2easdvn-1303971391.bj.apigw.tencentcs.comCobalt Strike botnet C2 domain (confidence level: 100%)
gamesstartf.xyzMekotio botnet C2 domain (confidence level: 100%)
nuevo2gameslop.xyzMekotio botnet C2 domain (confidence level: 100%)
nuevoconceti.xyzMekotio botnet C2 domain (confidence level: 100%)
repicdominic.xyzMekotio botnet C2 domain (confidence level: 100%)

URLs 21

http://175.24.176.154/api/settingsCobalt Strike botnet C2 (confidence level: 100%)
https://175.24.176.154:8443/api/settingsCobalt Strike botnet C2 (confidence level: 100%)
http://5.75.188.83:3306/Vidar botnet C2 (confidence level: 100%)
http://momalua.fun/apiLumma Stealer botnet C2 (confidence level: 100%)
http://kusmanin.fun/apiLumma Stealer botnet C2 (confidence level: 100%)
http://39.108.189.188:1111/j.adCobalt Strike botnet C2 (confidence level: 100%)
http://20.51.226.216/_/scs/mail-static/_/js/Cobalt Strike botnet C2 (confidence level: 100%)
http://185.225.74.128:8080/compare/v1.44/vxk7p0gbe8Cobalt Strike botnet C2 (confidence level: 100%)
http://124.70.45.102:8090/j.adCobalt Strike botnet C2 (confidence level: 100%)
http://89.23.103.35/cxCobalt Strike botnet C2 (confidence level: 100%)

IP addresses 172

101.34.83.16Cobalt Strike botnet C2 server (confidence level: 80%)
104.238.35.163BianLian botnet C2 server (confidence level: 80%)
147.78.47.231Cobalt Strike botnet C2 server (confidence level: 80%)
92.116.89.214Deimos botnet C2 server (confidence level: 50%)
161.189.238.234Deimos botnet C2 server (confidence level: 50%)
104.238.35.163BianLian botnet C2 server (confidence level: 50%)
104.238.35.163BianLian botnet C2 server (confidence level: 50%)
104.236.210.243BianLian botnet C2 server (confidence level: 50%)
45.56.165.27BianLian botnet C2 server (confidence level: 50%)
85.13.118.11BianLian botnet C2 server (confidence level: 50%)

Description

ThreatFox IOCs for 2023-10-28

Impact

For European organizations, the impact of this threat intelligence update is primarily informational. Since no specific vulnerabilities or exploits are described, there is no direct risk of compromise solely from this information. However, the presence of new or updated IOCs related to malware and payload delivery can aid security teams in enhancing detection capabilities and network monitoring. Organizations that integrate ThreatFox IOCs into their security operations can improve their ability to identify suspicious network activity and potential payload delivery attempts. The medium severity rating suggests that while the threat is not negligible, it does not represent an imminent or critical risk. European entities with mature security infrastructures can leverage this intelligence to fine-tune their defenses, but those lacking robust threat detection may find limited immediate benefit. The lack of patch availability and known exploits reduces urgency but underscores the importance of proactive monitoring. Overall, the impact is moderate and centers on improving situational awareness and detection rather than responding to an active compromise.

Defensive guidance

Given the nature of this threat intelligence update, mitigation should focus on enhancing detection and response capabilities rather than patching or immediate remediation. Specific recommendations include: 1) Integrate the provided IOCs from ThreatFox into existing Security Information and Event Management (SIEM) systems and Intrusion Detection/Prevention Systems (IDS/IPS) to enable automated detection of related network activity and payload delivery attempts. 2) Conduct regular network traffic analysis to identify anomalies or patterns matching the IOCs, especially focusing on payload delivery mechanisms. 3) Maintain updated threat intelligence feeds and ensure security teams are trained to interpret and act upon OSINT-derived indicators. 4) Implement network segmentation and strict egress filtering to limit the potential impact of payload delivery and lateral movement. 5) Enhance endpoint detection and response (EDR) capabilities to identify and contain malware infections early. 6) Conduct periodic threat hunting exercises using the new IOCs to proactively identify potential compromises. These steps go beyond generic advice by emphasizing the operational integration of threat intelligence and proactive detection tailored to the nature of the provided data.

Community reviews

Loading reviews…