IndicatorPublished 15 Nov 2024Updated 16 Nov 2024

type osint · ThreatFox IOCs for 2024-11-15

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 5

ngt-techs.comFAKEUPDATES payload delivery domain (confidence level: 100%)
brake-effect.cyouLumma Stealer botnet C2 domain (confidence level: 100%)
gidcldeaccadneh.topMintsLoader botnet C2 domain (confidence level: 100%)
gum4t.sbsVidar botnet C2 domain (confidence level: 100%)
igosoccer.cnPlugX botnet C2 domain (confidence level: 75%)

URLs 10

https://ngt-techs.com/work/original.jsFAKEUPDATES payload delivery URL (confidence level: 100%)
https://ngt-techs.com/work/index.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
https://ngt-techs.com/work/fix.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
https://ngt-techs.com/work/das.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
https://pillowforman.b-cdn.net/mu8etrx.htmlVidar payload delivery URL (confidence level: 100%)
http://pillowforman.b-cdn.net/rmxq14/buyx7ms.htmlVidar payload delivery URL (confidence level: 100%)
http://124.222.57.94:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://124.221.2.15:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://dudtybresah.cyou/apiLumma Stealer botnet C2 (confidence level: 75%)
https://goldenstream.shop/apiLumma Stealer botnet C2 (confidence level: 75%)

IP addresses 31

103.75.180.125Havoc botnet C2 server (confidence level: 100%)
198.46.178.152Remcos botnet C2 server (confidence level: 100%)
192.3.120.119Cobalt Strike botnet C2 server (confidence level: 100%)
23.95.209.116Cobalt Strike botnet C2 server (confidence level: 100%)
122.51.243.47Cobalt Strike botnet C2 server (confidence level: 100%)
202.181.24.231Cobalt Strike botnet C2 server (confidence level: 100%)
1.94.206.54Cobalt Strike botnet C2 server (confidence level: 100%)
43.156.248.33Cobalt Strike botnet C2 server (confidence level: 100%)
47.121.132.28Cobalt Strike botnet C2 server (confidence level: 100%)
156.234.42.33Cobalt Strike botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2024-11-15

Impact

For European organizations, the impact of this threat is moderate but non-negligible. Since the threat involves malware payload delivery and network activity, it could lead to unauthorized access, data exfiltration, or disruption of network services if successfully deployed. However, organizations relying on OSINT feeds like ThreatFox for threat detection should consider this information to enhance their monitoring and incident response capabilities. Potential impacts include increased risk of malware infections that could compromise confidentiality and integrity of data, especially in sectors with high network exposure or those targeted by advanced persistent threats (APTs). The medium severity suggests that while immediate critical disruption is unlikely, persistent exposure without mitigation could lead to operational risks and data breaches.

Defensive guidance

1. Integrate ThreatFox IOCs into existing Security Information and Event Management (SIEM) and endpoint detection and response (EDR) systems to enhance detection capabilities. 2. Conduct regular network traffic analysis to identify unusual payload delivery attempts or suspicious network activity consistent with the threat profile. 3. Employ threat hunting exercises focused on the updated IOCs to proactively identify potential infections or compromise. 4. Maintain updated and comprehensive endpoint protection solutions that can detect and block malware payloads even in the absence of specific patches. 5. Enhance user awareness training to recognize phishing or social engineering attempts that could serve as initial infection vectors. 6. Collaborate with national and European cybersecurity centers to share intelligence and receive timely updates on evolving threats. 7. Implement network segmentation and strict access controls to limit the lateral movement of malware within organizational networks.

Community reviews

Loading reviews…