IndicatorPublished 19 Apr 2025Updated 20 Apr 2025

type osint · ThreatFox IOCs for 2025-04-19

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 29

check.saguf.icuClearFake payload delivery domain (confidence level: 100%)
ht.bzmajiang.cnCobalt Strike botnet C2 domain (confidence level: 100%)
www.x6se.buzzCobalt Strike botnet C2 domain (confidence level: 100%)
ec2-16-163-161-107.ap-east-1.compute.amazonaws.comShadowPad botnet C2 domain (confidence level: 90%)
lynmor.comFAKEUPDATES payload delivery domain (confidence level: 50%)
grrlspace.comFAKEUPDATES payload delivery domain (confidence level: 50%)
reddit.co.imUnknown malware payload delivery domain (confidence level: 50%)
futuristx.liveLumma Stealer botnet C2 domain (confidence level: 50%)
synmedsp.liveLumma Stealer botnet C2 domain (confidence level: 50%)
four-meme.devUnknown malware payload delivery domain (confidence level: 50%)

URLs 18

http://10.99.1.101/en-us/supershell/login/authUnknown malware botnet C2 (confidence level: 50%)
https://quicklinks-online.com/Unknown malware payload delivery URL (confidence level: 50%)
http://141.164.61.168Kimsuky botnet C2 (confidence level: 50%)
https://pastebin.com/raw/9hzqgnjrXWorm botnet C2 (confidence level: 50%)
http://182.124.109.206:54689/mozi.mMozi payload delivery URL (confidence level: 50%)
https://fstarofliught.top/wozdLumma Stealer botnet C2 (confidence level: 75%)
https://check.hosam.icu/gkcxv.googleClearFake payload delivery URL (confidence level: 100%)
https://check.colaj.icu/gkcxv.googleClearFake payload delivery URL (confidence level: 100%)
http://lumbersmile.icu/apri.phpUnknown Loader botnet C2 (confidence level: 100%)
http://lumbersmile.icu/apr.phpUnknown Loader botnet C2 (confidence level: 100%)

IP addresses 147

194.59.31.74Remcos botnet C2 server (confidence level: 100%)
196.251.88.99Remcos botnet C2 server (confidence level: 100%)
62.60.226.101Remcos botnet C2 server (confidence level: 100%)
45.94.31.80Remcos botnet C2 server (confidence level: 100%)
192.177.111.67Remcos botnet C2 server (confidence level: 100%)
197.224.236.164Unknown malware botnet C2 server (confidence level: 100%)
162.250.124.62Quasar RAT botnet C2 server (confidence level: 100%)
111.229.202.115Havoc botnet C2 server (confidence level: 100%)
171.227.30.106Venom RAT botnet C2 server (confidence level: 100%)
35.179.100.140NetSupportManager RAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-04-19

Impact

For European organizations, the impact of this threat intelligence update is primarily in enhancing situational awareness and improving detection capabilities against malware campaigns that utilize OSINT and network-based payload delivery. Since no specific exploit or vulnerability is identified, the direct risk to confidentiality, integrity, or availability is limited unless these IOCs correspond to active campaigns targeting European entities. However, failure to incorporate such threat intelligence could result in delayed detection of malware infections, leading to potential data breaches, operational disruption, or lateral movement within networks. Organizations with critical infrastructure or sensitive data could face increased risk if attackers leverage these indicators to craft targeted attacks. The medium severity suggests a moderate risk level, emphasizing the need for vigilance but not immediate crisis response.

Defensive guidance

1. Integrate the provided IOCs into existing Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to enhance detection of related malware activity. 2. Conduct regular network traffic analysis focusing on unusual payload delivery patterns and suspicious network activity that align with the threat intelligence. 3. Train security operations teams to recognize and respond to OSINT-driven attack vectors and payload delivery tactics. 4. Maintain up-to-date threat intelligence feeds and ensure automated correlation with internal logs for timely alerts. 5. Implement network segmentation and strict access controls to limit the potential spread of malware if detected. 6. Perform regular threat hunting exercises using the IOCs to proactively identify potential compromises. 7. Collaborate with national and European cybersecurity information sharing organizations to contextualize these IOCs within broader threat trends.

Community reviews

Loading reviews…