IndicatorPublished 15 Nov 2023Updated 16 Nov 2023

type osint · ThreatFox IOCs for 2023-11-15

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 32

www.theokanegroup.comCobalt Strike botnet C2 domain (confidence level: 100%)
rockpython.xyzCobalt Strike botnet C2 domain (confidence level: 100%)
service-3s2hxn8v-1308639534.sh.apigw.tencentcs.comCobalt Strike botnet C2 domain (confidence level: 100%)
www2.eastus.cloudapp.azure.comCobalt Strike botnet C2 domain (confidence level: 100%)
www1.allegiancefithealth.comCobalt Strike botnet C2 domain (confidence level: 100%)
dodovdo.storeIRATA botnet C2 domain (confidence level: 100%)
salesthe.xyzIRATA botnet C2 domain (confidence level: 100%)
sahmane.sbsIRATA botnet C2 domain (confidence level: 100%)
ed.sahmane.sbsIRATA botnet C2 domain (confidence level: 100%)
7desktop.comHavoc botnet C2 domain (confidence level: 100%)

URLs 119

http://shohetrc.com/forum/index.phpAmadey botnet C2 (confidence level: 100%)
http://shohetrc.com/forum/login.phpAmadey botnet C2 (confidence level: 100%)
http://shohetrc.com/forum/index.php?scr=1Amadey botnet C2 (confidence level: 100%)
http://tceducn.com/forum/index.phpAmadey botnet C2 (confidence level: 100%)
http://tceducn.com/forum/login.phpAmadey botnet C2 (confidence level: 100%)
http://shohetrc.com/forum/plugins/clip64.dllAmadey payload delivery URL (confidence level: 100%)
http://shohetrc.com/forum/plugins/cred64.dllAmadey payload delivery URL (confidence level: 100%)
https://planbusiness.com.tr/nmm2yjmyyje4mmmx/Coper botnet C2 (confidence level: 80%)
https://planlimited.com.tr/nmm2yjmyyje4mmmx/Coper botnet C2 (confidence level: 80%)
https://planultra.com.tr/nmm2yjmyyje4mmmx/Coper botnet C2 (confidence level: 80%)

IP addresses 203

111.230.198.166Cobalt Strike botnet C2 server (confidence level: 80%)
101.36.110.122Cobalt Strike botnet C2 server (confidence level: 80%)
54.174.89.226Sliver botnet C2 server (confidence level: 80%)
83.40.181.55Meterpreter botnet C2 server (confidence level: 80%)
65.49.210.124Cobalt Strike botnet C2 server (confidence level: 80%)
8.210.141.104Cobalt Strike botnet C2 server (confidence level: 100%)
141.164.62.87ShadowPad botnet C2 server (confidence level: 75%)
178.190.102.43Sliver botnet C2 server (confidence level: 80%)
103.212.81.158Remcos botnet C2 server (confidence level: 75%)
52.61.168.199Unknown malware botnet C2 server (confidence level: 80%)

Description

ThreatFox IOCs for 2023-11-15

Impact

For European organizations, the impact of this threat intelligence update is primarily in enhancing situational awareness and improving detection capabilities. Since there are no known active exploits or patches, the immediate risk of compromise is low to medium. However, the presence of payload delivery and network activity indicators means organizations could be targeted by malware campaigns leveraging these IOCs for initial access or lateral movement. European entities with extensive network infrastructure and those in critical sectors such as finance, energy, and government should consider this intelligence as part of their threat hunting and monitoring processes. The lack of specific affected products or vulnerabilities limits the direct operational impact but underscores the need for continuous monitoring of network traffic and endpoint behavior to detect potential malicious activity early.

Defensive guidance

1. Integrate the provided IOCs into existing Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to enhance detection capabilities. 2. Conduct proactive threat hunting exercises using the updated IOCs to identify any signs of compromise within the network. 3. Maintain up-to-date network segmentation and strict access controls to limit potential lateral movement if payload delivery attempts occur. 4. Regularly update and patch all systems and software, even though no specific patches are indicated, to reduce the attack surface. 5. Educate security teams on the latest OSINT feeds and encourage collaboration with threat intelligence sharing platforms to stay informed about emerging threats. 6. Implement network traffic analysis tools to monitor for unusual or suspicious payload delivery patterns that align with the IOCs. 7. Review and update incident response plans to incorporate detection and response strategies for malware-related network activity.

Community reviews

Loading reviews…