IndicatorPublished 8 Jun 2024Updated 9 Jun 2024

type osint · ThreatFox IOCs for 2024-06-08

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 24

assets.rdntocdns.comUnknown malware payload delivery domain (confidence level: 100%)
cdn.rdntocdns.comUnknown malware payload delivery domain (confidence level: 100%)
css.rdntocdns.comUnknown malware payload delivery domain (confidence level: 100%)
rest1.rdntocdns.comUnknown malware payload delivery domain (confidence level: 100%)
rest2.rdntocdns.comUnknown malware payload delivery domain (confidence level: 100%)
service-o1dc3wx3-1311799005.bj.tencentapigw.com.cnCobalt Strike botnet C2 domain (confidence level: 100%)
v7yen47u2e.xyzClearFake payload delivery domain (confidence level: 100%)
abastecimentoonline.chatAstaroth botnet C2 domain (confidence level: 100%)
atende-br.chatAstaroth botnet C2 domain (confidence level: 100%)
businessgreat.oneAstaroth botnet C2 domain (confidence level: 100%)

URLs 135

https://dcc.olcrv.com/login/tologinMore_eggs botnet C2 (confidence level: 49%)
https://83.97.73.39/ytyxnjljzdi1yzfh/Coper botnet C2 (confidence level: 80%)
https://97felu2ehv0r5iff3cslcamel.store/ytyxnjljzdi1yzfh/Coper botnet C2 (confidence level: 80%)
https://6zimks6know8jihvtoa8camel.store/ytyxnjljzdi1yzfh/Coper botnet C2 (confidence level: 80%)
https://3w0mi18gkfrf6l8a8d09camel.store/ytyxnjljzdi1yzfh/Coper botnet C2 (confidence level: 80%)
https://brfw0g97s9mwun8juhb0camel.store/ytyxnjljzdi1yzfh/Coper botnet C2 (confidence level: 80%)
https://re5bvyc4l6004tqmtzp4camel.store/ytyxnjljzdi1yzfh/Coper botnet C2 (confidence level: 80%)
https://k6fvq8c11dqqjd446ck9camel.store/ytyxnjljzdi1yzfh/Coper botnet C2 (confidence level: 80%)
https://7l19jlu5trkqndh24li4camel.store/ytyxnjljzdi1yzfh/Coper botnet C2 (confidence level: 80%)
https://pq2trelsquu44xbpritocamel.store/ytyxnjljzdi1yzfh/Coper botnet C2 (confidence level: 80%)

IP addresses 54

3.125.223.134NjRAT botnet C2 server (confidence level: 75%)
154.12.93.14Ghost RAT botnet C2 server (confidence level: 100%)
4.203.104.98NjRAT botnet C2 server (confidence level: 100%)
138.162.7.28Sliver payload delivery server (confidence level: 50%)
136.144.162.236Sliver botnet C2 server (confidence level: 50%)
92.243.64.130BianLian botnet C2 server (confidence level: 50%)
104.238.61.20BianLian botnet C2 server (confidence level: 50%)
93.123.39.194Havoc botnet C2 server (confidence level: 50%)
82.168.162.65Havoc botnet C2 server (confidence level: 50%)
39.96.169.89Havoc botnet C2 server (confidence level: 50%)

Description

ThreatFox IOCs for 2024-06-08

Impact

For European organizations, the impact of this threat is primarily in the realm of situational awareness and detection rather than direct compromise. Since the IOCs are related to OSINT and network activity, they can help organizations identify and respond to potential malware payload deliveries before they cause harm. The medium severity suggests that while the threat is not currently critical, failure to incorporate these IOCs into detection systems could result in missed opportunities to detect early-stage attacks or reconnaissance activities. European entities with extensive network infrastructures, especially those in critical sectors such as finance, energy, and government, could benefit from integrating these IOCs to enhance their threat hunting and incident response capabilities. However, the lack of known exploits and patches indicates that the immediate risk of exploitation is low, reducing the likelihood of widespread impact or operational disruption.

Defensive guidance

To effectively mitigate the risks associated with this threat, European organizations should: 1) Integrate the provided IOCs into their existing Security Information and Event Management (SIEM) and Intrusion Detection/Prevention Systems (IDS/IPS) to improve detection of suspicious network activity and payload delivery attempts. 2) Regularly update threat intelligence feeds and correlate these IOCs with internal logs to identify potential compromises early. 3) Conduct proactive threat hunting exercises using these indicators to uncover latent threats within their networks. 4) Enhance network segmentation and monitoring to limit the lateral movement of potential malware payloads. 5) Train security teams on interpreting OSINT-derived IOCs and incorporating them into incident response workflows. 6) Maintain up-to-date endpoint protection and network security controls, even though no specific patches are available for this threat, to reduce the attack surface for payload delivery mechanisms.

Community reviews

Loading reviews…