IndicatorPublished 18 Feb 2025Updated 19 Feb 2025

type osint · ThreatFox IOCs for 2025-02-18

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 95

check.hbskw.icuClearFake payload delivery domain (confidence level: 100%)
impactsupport.worldLumma Stealer payload delivery domain (confidence level: 100%)
tattoobg.comAMOS botnet C2 domain (confidence level: 100%)
gratefulheartx.techLumma Stealer payload delivery domain (confidence level: 100%)
balancedzlife.techLumma Stealer payload delivery domain (confidence level: 100%)
pgldrop24.proLumma Stealer payload delivery domain (confidence level: 100%)
bellthinkyj28.helpLumma Stealer botnet C2 domain (confidence level: 100%)
patchpreseh.helpLumma Stealer botnet C2 domain (confidence level: 100%)
nestlecompany.worldLumma Stealer botnet C2 domain (confidence level: 100%)
google.baobecgiang.netCobalt Strike botnet C2 domain (confidence level: 75%)

URLs 81

https://check.hbskw.icu/gkcxv.googleClearFake payload delivery URL (confidence level: 100%)
https://bellthinkyj28.help/apiLumma Stealer botnet C2 (confidence level: 100%)
https://patchpreseh.help/apiLumma Stealer botnet C2 (confidence level: 100%)
http://196.251.90.44:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://ecozessentials.com/e6cb1c8fc7cd1659.phpStealc botnet C2 (confidence level: 100%)
http://119.45.118.52:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://115.120.242.123:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://check.rlcbb.icu/gkcxv.googleClearFake payload delivery URL (confidence level: 100%)
https://check.kpwlp.icu/gkcxv.googleClearFake payload delivery URL (confidence level: 100%)
https://waveschurch.xyz/art.phpUnknown Loader botnet C2 (confidence level: 100%)

IP addresses 137

185.7.214.51Tofsee botnet C2 server (confidence level: 100%)
185.147.125.146Tofsee botnet C2 server (confidence level: 100%)
193.143.1.5Tofsee botnet C2 server (confidence level: 100%)
185.147.125.146Tofsee botnet C2 server (confidence level: 100%)
185.147.125.147Tofsee botnet C2 server (confidence level: 100%)
193.143.1.5Tofsee botnet C2 server (confidence level: 100%)
185.215.113.51Lumma Stealer payload delivery server (confidence level: 100%)
185.7.214.51Tofsee botnet C2 server (confidence level: 100%)
206.123.150.192Remcos botnet C2 server (confidence level: 100%)
128.90.103.206AsyncRAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-02-18

Impact

For European organizations, the impact of this threat intelligence update is primarily in enhancing situational awareness and improving detection capabilities against potential malware campaigns. Since no specific malware or exploit details are provided, the direct operational impact is limited. However, the presence of payload delivery and network activity indicators suggests that organizations could face attempts at malware infiltration or command-and-control communications if these IOCs correspond to active campaigns. European entities with mature security operations centers (SOCs) and threat intelligence teams can leverage this information to update detection rules and monitor network traffic for suspicious activity. The medium severity rating implies that while the threat is not immediately critical, ignoring such intelligence could allow adversaries to establish footholds or exfiltrate data if payload delivery attempts succeed. The lack of known exploits in the wild reduces immediate risk but does not preclude future exploitation. Overall, the impact is moderate and mostly preventative, emphasizing the importance of proactive threat hunting and network monitoring.

Defensive guidance

1. Integrate the provided IOCs into existing security information and event management (SIEM) systems and intrusion detection/prevention systems (IDS/IPS) to enhance detection of related network activity and payload delivery attempts. 2. Conduct regular threat hunting exercises using these IOCs to identify any signs of compromise or suspicious behavior within the network. 3. Maintain up-to-date endpoint protection and network segmentation to limit the impact of potential payload delivery and lateral movement. 4. Employ network traffic analysis tools to monitor for anomalous communications that may align with the threat intelligence indicators. 5. Share updated threat intelligence with relevant internal teams and external partners to ensure coordinated defense efforts. 6. Since no patches are available, focus on detection and response capabilities rather than remediation. 7. Train security personnel to recognize and respond to indicators related to OSINT-derived threats and payload delivery techniques. 8. Regularly review and update firewall and proxy rules to block known malicious IPs or domains associated with the IOCs once identified.

Community reviews

Loading reviews…