IndicatorPublished 7 Jun 2025Updated 8 Jun 2025

type osint · ThreatFox IOCs for 2025-06-07

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 166

relay.shipperzone.onlineUnknown RAT botnet C2 domain (confidence level: 100%)
security.flerashields.comUnknown malware payload delivery domain (confidence level: 100%)
azeqope.comUnknown malware payload delivery domain (confidence level: 100%)
aveopixel.xyzUnknown Webinject credit card skimming domain (confidence level: 100%)
beppixel.topUnknown Webinject credit card skimming domain (confidence level: 100%)
bestmerikschannel.topUnknown Webinject credit card skimming domain (confidence level: 100%)
canmeriksmonday.xyzUnknown Webinject credit card skimming domain (confidence level: 100%)
carefulmetriks.topUnknown Webinject credit card skimming domain (confidence level: 100%)
distantmeriks.topUnknown Webinject credit card skimming domain (confidence level: 100%)
fabulo.xyzUnknown Webinject credit card skimming domain (confidence level: 100%)

URLs 84

https://pathwayplan.com/sbwufsws.zipNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://azeqope.com/flare.msiUnknown malware payload delivery URL (confidence level: 100%)
http://45.207.212.81/Hook botnet C2 (confidence level: 50%)
http://server4.cdneurop.cloud/Glupteba botnet C2 (confidence level: 50%)
http://server6.localstats.org/Glupteba botnet C2 (confidence level: 50%)
http://server16.cdneurop.cloud/Glupteba botnet C2 (confidence level: 50%)
http://210.114.12.10Kimsuky botnet C2 (confidence level: 50%)
http://pentagon.cyUnknown Stealer botnet C2 (confidence level: 50%)
http://www.4250029.xyz/hi07/Formbook botnet C2 (confidence level: 50%)
http://www.4260333.xyz/hi07/Formbook botnet C2 (confidence level: 50%)

IP addresses 171

107.173.154.215Cobalt Strike botnet C2 server (confidence level: 75%)
180.76.144.175Cobalt Strike botnet C2 server (confidence level: 75%)
8.130.152.120Cobalt Strike botnet C2 server (confidence level: 75%)
182.92.131.115Cobalt Strike botnet C2 server (confidence level: 75%)
47.237.86.35Cobalt Strike botnet C2 server (confidence level: 75%)
27.25.158.13Cobalt Strike botnet C2 server (confidence level: 75%)
81.70.32.160Cobalt Strike botnet C2 server (confidence level: 75%)
8.142.117.162Cobalt Strike botnet C2 server (confidence level: 75%)
47.95.32.38Cobalt Strike botnet C2 server (confidence level: 75%)
201.18.212.142Cobalt Strike botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-06-07

Impact

For European organizations, the impact of this threat is currently ambiguous due to the lack of detailed technical information and specific affected systems. However, given the medium severity and the focus on network activity and payload delivery, there is potential risk for organizations that rely heavily on networked infrastructure and have exposure to external threat intelligence feeds or OSINT sources. Malware payload delivery can lead to data breaches, disruption of services, or unauthorized access if successfully executed. The absence of known exploits in the wild reduces immediate risk, but organizations should remain vigilant as threat actors may leverage these IOCs to craft targeted attacks. The impact could be more pronounced in sectors with high reliance on network communications and sensitive data, such as finance, critical infrastructure, and government entities within Europe.

Defensive guidance

Given the nature of the threat as an OSINT-related malware IOC advisory without specific vulnerabilities or exploits, mitigation should focus on enhancing detection and response capabilities. European organizations should: 1) Integrate the provided IOCs into their security information and event management (SIEM) systems and threat intelligence platforms to improve detection of related network activity and payload delivery attempts. 2) Conduct regular network traffic analysis to identify anomalous behavior consistent with the indicators. 3) Maintain up-to-date endpoint protection and network security controls to prevent payload execution. 4) Educate security teams on interpreting and operationalizing OSINT-derived threat intelligence to proactively identify emerging threats. 5) Collaborate with national and European cybersecurity centers to share intelligence and receive updates on evolving threats. Since no patches are available, emphasis should be on monitoring and incident response preparedness rather than remediation of a specific vulnerability.

Community reviews

Loading reviews…