IndicatorPublished 1 Jan 2025Updated 2 Jan 2025

type osint · ThreatFox IOCs for 2025-01-01

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 27

raw.cloudboats.vipMirai botnet C2 domain (confidence level: 75%)
s4.serv00.comAgent Tesla botnet C2 domain (confidence level: 50%)
vmi2323701.contaboserver.netAsyncRAT botnet C2 domain (confidence level: 100%)
cpcalendars.pd.194-59-30-152.cprapid.comHook botnet C2 domain (confidence level: 100%)
avina.cloudHavoc botnet C2 domain (confidence level: 100%)
ecs-110-41-4-69.compute.hwclouds-dns.comCobalt Strike botnet C2 domain (confidence level: 100%)
ocqztwhhfipaggkyloea.infinitum.spaceCobalt Strike botnet C2 domain (confidence level: 100%)
ip66-179-240-177.pbiaas.comAsyncRAT botnet C2 domain (confidence level: 100%)
www.103-152-255-69.cprapid.comHavoc botnet C2 domain (confidence level: 100%)
awake-weaves.cyouLumma Stealer botnet C2 domain (confidence level: 100%)

URLs 35

http://jholo.duckdns.org:8181/upload.phpDarkVision RAT botnet C2 (confidence level: 100%)
http://124.70.193.76:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://113.44.78.183:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://47.120.37.153:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://221.14.60.132:53880/mozi.mMozi payload delivery URL (confidence level: 50%)
http://185.239.51.56/externalvmpacketlongpollsqldbfloweruniversalcentral.phpDCRat botnet C2 (confidence level: 100%)
http://891781cm.renyash.ru/processorserverdefaultsqltrafficuniversalwpprivate.phpDCRat botnet C2 (confidence level: 100%)
http://23.94.247.46/pages/login.phpUnknown malware botnet C2 (confidence level: 100%)
http://recessfriction.sbs/lod.phpUnknown malware botnet C2 (confidence level: 100%)
http://recessfriction.sbs/dol.phpUnknown malware botnet C2 (confidence level: 100%)

IP addresses 85

208.115.220.58AsyncRAT botnet C2 server (confidence level: 100%)
5.39.43.50NjRAT botnet C2 server (confidence level: 75%)
45.137.201.181NjRAT botnet C2 server (confidence level: 75%)
154.37.215.204Cobalt Strike botnet C2 server (confidence level: 100%)
107.151.240.142Cobalt Strike botnet C2 server (confidence level: 100%)
154.37.215.204Unknown malware botnet C2 server (confidence level: 100%)
209.38.217.87Unknown malware botnet C2 server (confidence level: 100%)
210.89.45.122Unknown malware botnet C2 server (confidence level: 100%)
134.175.121.153Meterpreter botnet C2 server (confidence level: 100%)
34.208.255.157Cobalt Strike botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-01-01

Impact

For European organizations, the impact of this threat as currently described is limited due to the lack of specific exploit details or active attacks. The medium severity suggests a moderate risk level, potentially indicating that the threat actors might be preparing payload delivery mechanisms or network-based attacks that could evolve. If these IOCs relate to malware delivery or network intrusion attempts, organizations could face risks including unauthorized access, data exfiltration, or disruption of services if the threat matures. However, without known exploits in the wild or specific affected software versions, the immediate operational impact is low. European entities with extensive network infrastructure and those relying on OSINT tools or open-source intelligence platforms might need to monitor for suspicious network activity and payload delivery attempts. The lack of patches or fixes implies that mitigation will rely on detection and network defense rather than software updates.

Defensive guidance

Given the nature of this threat intelligence update, European organizations should focus on enhancing their detection and monitoring capabilities. Specific recommendations include: 1) Integrate the latest ThreatFox IOCs into existing Security Information and Event Management (SIEM) systems and Intrusion Detection/Prevention Systems (IDS/IPS) to improve detection of suspicious network activity and payload delivery attempts. 2) Conduct network traffic analysis to identify anomalous patterns consistent with the described threat level and distribution. 3) Employ threat hunting exercises focused on the identified TLP:white tagged indicators, even if none are currently provided, to proactively identify potential compromises. 4) Maintain strict network segmentation and enforce least privilege access to limit potential lateral movement if payload delivery occurs. 5) Ensure endpoint protection platforms are updated and configured to detect and block known malware behaviors associated with payload delivery. 6) Educate security teams on the evolving nature of OSINT-related threats to improve response readiness. Since no patches are available, reliance on detection, network hygiene, and incident response preparedness is critical.

Community reviews

Loading reviews…