IndicatorPublished 14 Mar 2025Updated 15 Mar 2025

type osint · ThreatFox IOCs for 2025-03-14

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 344

check.lixir.icuClearFake payload delivery domain (confidence level: 100%)
check.fetoq.icuClearFake payload delivery domain (confidence level: 100%)
webmail.takeufagame1212.xyzHavoc botnet C2 domain (confidence level: 100%)
cpcontacts.10bestbusiness.websiteHavoc botnet C2 domain (confidence level: 100%)
cpcalendars.ipmnewsworld.comHavoc botnet C2 domain (confidence level: 100%)
cpcalendars.topandbestnews.comHavoc botnet C2 domain (confidence level: 100%)
balancefitnow.comHook botnet C2 domain (confidence level: 100%)
cpcalendars.apkhubnewz.comHavoc botnet C2 domain (confidence level: 100%)
manusiabodoh.cyberdark.xyzUnknown malware botnet C2 domain (confidence level: 100%)
www.58-pet-funeral-services-14.cfdFormbook botnet C2 domain (confidence level: 50%)

URLs 132

http://77.105.147.252/_7base/windowstraffic.phpDCRat botnet C2 (confidence level: 100%)
https://miliste.com/contactAMOS botnet C2 (confidence level: 75%)
https://twltter.dev/Unknown malware payload delivery URL (confidence level: 50%)
https://84.200.154.155/Unknown malware payload delivery URL (confidence level: 50%)
https://84.200.24.181/Unknown malware payload delivery URL (confidence level: 50%)
https://cityscapea.run/loginLumma Stealer botnet C2 (confidence level: 50%)
http://87.120.166.174/Hook botnet C2 (confidence level: 50%)
http://20.191.194.222:3000/Hook botnet C2 (confidence level: 50%)
http://196.251.71.185/Hook botnet C2 (confidence level: 50%)
http://45.93.20.224/pndj30vs11/login.phpAmadey botnet C2 (confidence level: 50%)

IP addresses 179

85.31.231.183Cobalt Strike botnet C2 server (confidence level: 100%)
189.1.220.101Cobalt Strike botnet C2 server (confidence level: 100%)
196.251.88.124Remcos botnet C2 server (confidence level: 100%)
177.136.225.183Remcos botnet C2 server (confidence level: 100%)
147.124.211.21Remcos botnet C2 server (confidence level: 100%)
100.42.182.237Sliver botnet C2 server (confidence level: 100%)
49.113.78.205Unknown malware botnet C2 server (confidence level: 100%)
186.169.94.13AsyncRAT botnet C2 server (confidence level: 100%)
47.83.219.200Unknown malware botnet C2 server (confidence level: 100%)
87.120.166.174Hook botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-03-14

Impact

For European organizations, the impact of this threat could manifest in several ways. As the malware involves payload delivery and network activity, it may enable unauthorized access, data exfiltration, or lateral movement within networks. The OSINT component suggests attackers might leverage publicly available information to tailor attacks, increasing their effectiveness. Although no known exploits are currently active, the presence of such malware could facilitate espionage, intellectual property theft, or disruption of services. Sectors with high-value data or critical infrastructure, such as finance, energy, healthcare, and government, could be particularly targeted. The medium severity rating indicates that while immediate catastrophic damage is unlikely, the threat could serve as a foothold for more severe attacks, potentially compromising confidentiality and integrity of sensitive data. The lack of patches or specific mitigations means organizations must rely on detection and prevention strategies to mitigate risks.

Defensive guidance

Given the limited technical details, mitigation should focus on enhancing detection and prevention capabilities. Organizations should implement advanced network monitoring to identify unusual outbound traffic patterns indicative of payload delivery or command and control communications. Employing threat intelligence feeds, including updates from ThreatFox and MISP, can help identify emerging IOCs as they become available. Regularly updating and hardening endpoint protection solutions to detect malware behaviors associated with OSINT gathering and payload delivery is critical. Network segmentation can limit lateral movement if infection occurs. Additionally, conducting employee training to recognize phishing or social engineering attempts that may serve as initial infection vectors is essential. Collaborating with national cybersecurity centers in Europe for timely threat intelligence sharing will also enhance preparedness.

Community reviews

Loading reviews…