IndicatorPublished 15 Apr 2025Updated 16 Apr 2025

type osint · ThreatFox IOCs for 2025-04-15

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 110

check.symad.icuClearFake payload delivery domain (confidence level: 100%)
uochut.shopFAKEUPDATES payload delivery domain (confidence level: 100%)
gillilandlandscape.comFAKEUPDATES payload delivery domain (confidence level: 100%)
www.chamberscertifiedbookkeeping.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
0k6v5xuhp.localto.netSpyNote credit card skimming domain (confidence level: 100%)
amoliera.orgClearFake payload delivery domain (confidence level: 100%)
security.flargyard.comClearFake payload delivery domain (confidence level: 100%)
goclouder.comClearFake payload delivery domain (confidence level: 100%)
analytiwave.comClearFake payload delivery domain (confidence level: 100%)
security.secuclauf.comClearFake payload delivery domain (confidence level: 100%)

URLs 45

https://uochut.shop/help/loop.jsFAKEUPDATES payload delivery URL (confidence level: 100%)
https://uochut.shop/help/index.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
https://uochut.shop/help/ops.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
https://gillilandlandscape.com/winston.zipFAKEUPDATES payload delivery URL (confidence level: 100%)
https://westrosei.live/agozLumma Stealer botnet C2 (confidence level: 100%)
https://amssh.co/windowspowershell_web_backdoor payload delivery URL (confidence level: 100%)
https://amssh.co/spotifypowershell_web_backdoor payload delivery URL (confidence level: 100%)
https://check.pilod.icu/gkcxv.googleClearFake payload delivery URL (confidence level: 100%)
http://198.50.242.157:442/pages/login.phpUnknown malware botnet C2 (confidence level: 100%)
https://ins.sg/officepowershell_web_backdoor payload delivery URL (confidence level: 100%)

IP addresses 182

94.158.245.66NetSupportManager RAT botnet C2 server (confidence level: 100%)
185.239.48.173Bashlite botnet C2 server (confidence level: 75%)
207.244.199.46Unknown malware botnet C2 server (confidence level: 100%)
18.197.239.109NjRAT botnet C2 server (confidence level: 75%)
192.142.18.214Cobalt Strike botnet C2 server (confidence level: 100%)
198.167.198.12Remcos botnet C2 server (confidence level: 100%)
207.148.37.85ShadowPad botnet C2 server (confidence level: 90%)
207.148.37.86ShadowPad botnet C2 server (confidence level: 90%)
176.65.142.245AsyncRAT botnet C2 server (confidence level: 100%)
174.138.8.142Unknown malware botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-04-15

Impact

For European organizations, this malware-related threat could result in unauthorized payload delivery and network compromise, potentially leading to data exfiltration, disruption of services, or lateral movement within networks. Given the lack of specific affected products or versions, the impact is likely broad but nonspecific, affecting organizations that may be targeted through network-based malware delivery methods. The medium severity suggests that while the threat is credible, it may not currently be widespread or highly sophisticated. However, European entities with critical infrastructure or sensitive data could face operational disruptions or confidentiality breaches if targeted. The absence of known exploits in the wild reduces immediate risk but does not eliminate the potential for future exploitation or targeted attacks leveraging these IOCs. Organizations relying on network perimeter defenses and endpoint security should remain vigilant to detect and mitigate payload delivery attempts associated with this threat.

Defensive guidance

Given the nature of this threat as a malware campaign with network activity, European organizations should implement advanced network monitoring and intrusion detection systems capable of identifying unusual payload delivery patterns. Regularly updating and tuning security information and event management (SIEM) systems to incorporate new IOCs from ThreatFox and other OSINT feeds will enhance detection capabilities. Employ network segmentation to limit lateral movement in case of infection and enforce strict access controls. Endpoint protection platforms should be configured to detect and block known malware signatures and behaviors. Conduct regular employee training on phishing and social engineering tactics, as these are common malware delivery vectors. Since no patches are available, focus on proactive threat hunting and incident response readiness. Additionally, organizations should subscribe to threat intelligence feeds to stay informed about evolving indicators and tactics related to this malware activity.

Community reviews

Loading reviews…