IndicatorPublished 21 May 2025Updated 22 May 2025

type osint · ThreatFox IOCs for 2025-05-21

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 3,747

nackt-bilder.topNetSupportManager RAT payload delivery domain (confidence level: 100%)
acc.hu.results.plasma.synlab.comERMAC botnet C2 domain (confidence level: 100%)
dnsgo-windowsds.liveKongTuke payload delivery domain (confidence level: 100%)
nzyeyghzrr333b.topFAKEUPDATES payload delivery domain (confidence level: 100%)
hjdfikgmhficchm.topFAKEUPDATES botnet C2 domain (confidence level: 100%)
11xiaoshuju.comCobalt Strike botnet C2 domain (confidence level: 100%)
www.cbzha.comCobalt Strike botnet C2 domain (confidence level: 100%)
www.detfec.comHavoc botnet C2 domain (confidence level: 100%)
spin.tamsonvn.comHavoc botnet C2 domain (confidence level: 100%)
acc.hu.webreqadmin.plasma.synlab.comERMAC botnet C2 domain (confidence level: 100%)

URLs 50

http://94.156.177.41/droid/five/pvqdq929bsx_a_d_m1n_a.phpLokiBot botnet C2 (confidence level: 100%)
https://nackt-bilder.top/vv/select.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://nackt-bilder.top/vv/ddas.phpNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://viralmarketingsuite.com/tera.zipNetSupportManager RAT payload delivery URL (confidence level: 100%)
http://831471cm.nyashvibe.ru/eternalvmpipe_serverprotectsqlflowerdlelocal.phpDCRat botnet C2 (confidence level: 100%)
https://dnsgo-windowsds.live/z9jthrrilKongTuke payload delivery URL (confidence level: 100%)
http://nzyeyghzrr333b.top/f15.svgFAKEUPDATES payload delivery URL (confidence level: 100%)
https://www.igorkalinin.com/windows.en.htmlUnknown malware payload delivery URL (confidence level: 100%)
http://142.93.255.45/Unknown malware payload delivery URL (confidence level: 100%)
https://zdravaprehrana.ba/temp/Unknown malware payload delivery URL (confidence level: 100%)

IP addresses 362

38.60.136.235Mirai botnet C2 server (confidence level: 75%)
16.170.104.183Cobalt Strike botnet C2 server (confidence level: 75%)
103.242.12.203Cobalt Strike botnet C2 server (confidence level: 75%)
118.35.10.88Cobalt Strike botnet C2 server (confidence level: 75%)
39.107.72.158Cobalt Strike botnet C2 server (confidence level: 75%)
60.204.218.12Cobalt Strike botnet C2 server (confidence level: 75%)
101.43.252.53Cobalt Strike botnet C2 server (confidence level: 75%)
58.87.96.198Cobalt Strike botnet C2 server (confidence level: 75%)
193.37.69.43Cobalt Strike botnet C2 server (confidence level: 75%)
103.248.228.159Cobalt Strike botnet C2 server (confidence level: 75%)

Hashes 186

1d895cf4391b817e54fb9ec9d8e65f7eAkira payload (confidence level: 50%)
03b9887dee2c3c825b6a6c0df1d104adAkira payload (confidence level: 50%)
4d79fb750955ec8702cb79cfdb36e66bAkira payload (confidence level: 50%)
c387b2eb96bb137cdd54220d920edce9Akira payload (confidence level: 50%)
be1f993b1d26e6baa3c8f7dc0cb63472Akira payload (confidence level: 50%)
28a72219951ce207601e120c9d590d47Akira payload (confidence level: 50%)
39a14bfc65e6f5e13fc2817206a39cadAkira payload (confidence level: 50%)
977452c8332167f83a417b079169ac8aAkira payload (confidence level: 50%)
e72e0069e1fb4328e2704bda97fb4a40Akira payload (confidence level: 50%)
000f566767eadc0cce4829b861b9faea77c25294KrakenKeylogger payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-05-21

Impact

For European organizations, the impact of this threat is currently limited due to the lack of specific exploit details or known active campaigns. However, the presence of payload delivery and network activity indicators implies a risk of malware infections that could lead to data breaches, operational disruptions, or unauthorized network access if exploited. Organizations relying heavily on networked infrastructure and those with extensive external exposure could be at risk of initial compromise vectors such as phishing or drive-by downloads leading to payload delivery. The medium severity rating suggests that while the threat is not immediately critical, it should not be ignored, especially in sectors with high-value data or critical infrastructure. The absence of patches or known exploits means that mitigation will rely on proactive detection and network defense rather than vulnerability remediation.

Defensive guidance

European organizations should enhance their network monitoring capabilities to detect unusual network activity and potential payload delivery attempts. Implementing advanced threat detection tools that leverage behavioral analytics and anomaly detection can help identify early signs of compromise. Regularly updating and tuning intrusion detection/prevention systems (IDS/IPS) to incorporate emerging IOCs from trusted OSINT sources like ThreatFox is essential. Organizations should also conduct phishing awareness training to reduce the risk of initial infection vectors. Network segmentation and strict access controls can limit the lateral movement of malware if an infection occurs. Since no patches are available, maintaining robust endpoint protection with heuristic and signature-based detection, combined with timely incident response plans, will be critical. Sharing threat intelligence within industry-specific Information Sharing and Analysis Centers (ISACs) can improve collective defense.

Community reviews

Loading reviews…