IndicatorPublished 26 Oct 2024Updated 27 Oct 2024

type osint · ThreatFox IOCs for 2024-10-26

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 11

explorationmsn.storeLumma Stealer botnet C2 domain (confidence level: 100%)
cemeteryun.cyouLumma Stealer botnet C2 domain (confidence level: 50%)
js.liveya.orgMooBot botnet C2 domain (confidence level: 100%)
cpcalendars.bmzbaumaschinen.comBashlite botnet C2 domain (confidence level: 100%)
js1.search-st1.comBashlite botnet C2 domain (confidence level: 100%)
search-dl1.comBashlite botnet C2 domain (confidence level: 100%)
webmail.mg-plant.comBashlite botnet C2 domain (confidence level: 100%)
timeless-tales.shopAmadey botnet C2 domain (confidence level: 100%)
dns.cdn-serveri68n-googleapis.orgAmadey botnet C2 domain (confidence level: 100%)
search-jrd.comBashlite botnet C2 domain (confidence level: 100%)

URLs 14

https://crisiwarny.store/apiLumma Stealer botnet C2 (confidence level: 75%)
https://founpiuer.store/apiLumma Stealer botnet C2 (confidence level: 75%)
https://navygenerayk.store/apiLumma Stealer botnet C2 (confidence level: 75%)
https://necklacedmny.store/apiLumma Stealer botnet C2 (confidence level: 75%)
http://rustpidc.beget.tech/l1nc0in.phpDCRat botnet C2 (confidence level: 100%)
http://20.25.126.96:443/bddsCobalt Strike botnet C2 (confidence level: 75%)
http://20.25.126.96:443/sp6dCobalt Strike botnet C2 (confidence level: 75%)
http://20.25.126.96:443/wu8yCobalt Strike botnet C2 (confidence level: 75%)
http://utahsadventurefamily.shop:443/voorraad/hyundai/ioniq-6Cobalt Strike botnet C2 (confidence level: 75%)
https://thumbi.cfd/apiLumma Stealer botnet C2 (confidence level: 100%)

IP addresses 104

62.204.41.150Stealc botnet C2 server (confidence level: 100%)
146.235.228.60Cobalt Strike botnet C2 server (confidence level: 100%)
119.29.202.88Cobalt Strike botnet C2 server (confidence level: 100%)
106.14.127.122Sliver botnet C2 server (confidence level: 100%)
89.213.51.15Unknown malware botnet C2 server (confidence level: 100%)
185.104.195.215AsyncRAT botnet C2 server (confidence level: 100%)
167.99.69.166Cobalt Strike botnet C2 server (confidence level: 100%)
117.72.103.29Cobalt Strike botnet C2 server (confidence level: 100%)
38.6.177.11Cobalt Strike botnet C2 server (confidence level: 100%)
185.186.76.151ShadowPad botnet C2 server (confidence level: 90%)

Description

ThreatFox IOCs for 2024-10-26

Impact

For European organizations, the impact of this threat is currently moderate and largely dependent on the nature of the payloads delivered and the network activity patterns associated with the IOCs. Since no specific affected software or systems are identified, the threat could manifest in various forms, such as phishing campaigns, malware infections, or network intrusions leveraging publicly available intelligence. The lack of known exploits in the wild reduces immediate risk, but the presence of payload delivery mechanisms indicates a potential for infection and subsequent compromise if defenses are insufficient. European organizations with extensive network exposure, especially those in critical infrastructure, finance, or government sectors, could face risks related to data exfiltration, service disruption, or unauthorized access if these IOCs correspond to active campaigns. The medium severity suggests that while the threat is not critical, vigilance is necessary to detect and mitigate any attempts to leverage these IOCs for malicious purposes. The absence of patches means organizations must rely on detection and prevention controls rather than remediation of a vulnerability.

Defensive guidance

1. Integrate the provided IOCs from ThreatFox into existing security monitoring tools such as SIEMs, IDS/IPS, and endpoint detection platforms to enhance detection capabilities. 2. Conduct network traffic analysis focusing on unusual or suspicious payload delivery patterns, especially those matching the shared IOCs. 3. Employ threat hunting exercises using the IOCs to proactively identify potential compromises or reconnaissance activities within the network. 4. Strengthen email and web filtering solutions to block known malicious payload delivery vectors that may be associated with the IOCs. 5. Maintain up-to-date threat intelligence feeds and collaborate with information sharing groups to receive timely updates on any evolution of this threat. 6. Educate staff on recognizing social engineering tactics that could be used to initiate payload delivery. 7. Implement network segmentation and least privilege principles to limit the impact of any successful payload execution. 8. Since no patches are available, focus on hardening systems and applying security best practices to reduce the attack surface.

Community reviews

Loading reviews…