IndicatorPublished 10 Oct 2024Updated 11 Oct 2024

type osint · ThreatFox IOCs for 2024-10-10

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 17

cfd-regulations.comLumma Stealer payload delivery domain (confidence level: 100%)
avatrade-supervision.comLumma Stealer payload delivery domain (confidence level: 100%)
avatrade-global.comLumma Stealer payload delivery domain (confidence level: 100%)
avatrade-regulation.comLumma Stealer payload delivery domain (confidence level: 100%)
avatrade-compliance.comLumma Stealer payload delivery domain (confidence level: 100%)
avatrade-services.comLumma Stealer payload delivery domain (confidence level: 100%)
heche.topXehookStealer botnet C2 domain (confidence level: 100%)
sixvr16ht.topCryptBot botnet C2 domain (confidence level: 100%)
forkj4ht.topCryptBot botnet C2 domain (confidence level: 100%)
megaarmshop.comFAKEUPDATES payload delivery domain (confidence level: 100%)

URLs 34

https://49.13.89.149Vidar botnet C2 (confidence level: 100%)
https://195.201.118.191Vidar botnet C2 (confidence level: 100%)
https://steamcommunity.com/profiles/76561199751190313Vidar botnet C2 (confidence level: 100%)
https://65.108.57.141/Vidar botnet C2 (confidence level: 100%)
https://195.201.118.191/Vidar botnet C2 (confidence level: 100%)
https://116.202.179.237/Vidar botnet C2 (confidence level: 100%)
http://159.69.178.243/Vidar botnet C2 (confidence level: 100%)
http://168.119.243.238/Vidar botnet C2 (confidence level: 100%)
http://116.203.6.107/Vidar botnet C2 (confidence level: 100%)
https://dissapoiznw.storeLumma Stealer botnet C2 (confidence level: 75%)

IP addresses 82

54.215.126.153Hook botnet C2 server (confidence level: 100%)
5.95.41.85Unknown malware botnet C2 server (confidence level: 100%)
46.8.236.23Havoc botnet C2 server (confidence level: 100%)
113.45.220.201Cobalt Strike botnet C2 server (confidence level: 100%)
121.37.128.90Cobalt Strike botnet C2 server (confidence level: 100%)
124.222.176.39Cobalt Strike botnet C2 server (confidence level: 100%)
139.159.251.99Cobalt Strike botnet C2 server (confidence level: 100%)
1.94.131.204Cobalt Strike botnet C2 server (confidence level: 100%)
110.40.137.97Cobalt Strike botnet C2 server (confidence level: 100%)
94.232.247.97Cobalt Strike botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2024-10-10

Impact

For European organizations, the impact of this threat intelligence is primarily in enhancing detection and response capabilities rather than mitigating an immediate, high-risk exploit. Since no specific affected products or vulnerabilities are identified, the direct risk to confidentiality, integrity, or availability is limited. However, the presence of payload delivery and network activity tags indicates that the underlying threats could facilitate malware infections or network intrusions if corresponding vulnerabilities or misconfigurations exist in organizational environments. European entities with mature security operations centers (SOCs) can leverage these IOCs to improve monitoring and threat hunting, potentially reducing the dwell time of attackers. Organizations lacking robust threat intelligence integration may not benefit as much, potentially increasing exposure to related malware campaigns. The medium severity rating suggests vigilance but not urgent emergency response. The lack of known exploits in the wild reduces immediate risk but does not preclude future exploitation if threat actors adapt these indicators into active campaigns.

Defensive guidance

1. Integrate the provided IOCs from ThreatFox into existing security information and event management (SIEM) and endpoint detection and response (EDR) systems to enhance detection capabilities. 2. Conduct regular threat hunting exercises using these indicators to identify any signs of compromise or related malicious activity within the network. 3. Maintain up-to-date network segmentation and strict access controls to limit the potential impact of payload delivery attempts. 4. Ensure all systems are patched and hardened against known vulnerabilities, even though no specific patches are indicated here, to reduce the attack surface. 5. Educate security teams on the nature of OSINT-based threat intelligence to improve interpretation and operationalization of such data. 6. Collaborate with national and European cybersecurity information sharing organizations to contextualize these IOCs within broader threat trends. 7. Monitor for updates from ThreatFox and other intelligence sources for any escalation or new exploit information related to these indicators.

Community reviews

Loading reviews…