IndicatorPublished 8 Jun 2025Updated 9 Jun 2025

type osint · ThreatFox IOCs for 2025-06-08

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 35

security.folregaurd.comUnknown malware payload delivery domain (confidence level: 100%)
dekmos.comUnknown malware payload delivery domain (confidence level: 100%)
e-batvrod.proUnknown Loader payload delivery domain (confidence level: 90%)
click-jackets.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
mrmega-28915.portmap.ioXWorm botnet C2 domain (confidence level: 100%)
raketa909-53062.portmap.ioXWorm botnet C2 domain (confidence level: 100%)
outside-sand.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
krasnov-20846.portmap.ioXWorm botnet C2 domain (confidence level: 100%)
feed-option.gl.at.ply.ggQuasar RAT botnet C2 domain (confidence level: 100%)
breachforums.liveUnknown malware botnet C2 domain (confidence level: 100%)

URLs 3

https://dekmos.com/flare.msiUnknown malware payload delivery URL (confidence level: 100%)
http://fsdas3421fds.x10.mx/eternallineprocesspublic.phpDCRat botnet C2 (confidence level: 100%)
http://5.252.153.62/9ac416e3d978da3b.phpStealc botnet C2 (confidence level: 100%)

IP addresses 128

91.212.166.205Lumma Stealer botnet C2 server (confidence level: 100%)
91.212.166.204Lumma Stealer botnet C2 server (confidence level: 100%)
39.103.58.78Cobalt Strike botnet C2 server (confidence level: 75%)
124.156.107.3Cobalt Strike botnet C2 server (confidence level: 75%)
43.136.118.94Cobalt Strike botnet C2 server (confidence level: 75%)
124.222.152.64Cobalt Strike botnet C2 server (confidence level: 100%)
192.159.99.207AsyncRAT botnet C2 server (confidence level: 100%)
78.175.189.137AsyncRAT botnet C2 server (confidence level: 100%)
101.99.94.46Quasar RAT botnet C2 server (confidence level: 100%)
15.185.76.54NetSupportManager RAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-06-08

Impact

For European organizations, the impact of this threat is currently moderate due to the absence of known active exploits and specific affected software versions. However, the presence of network activity and payload delivery indicators suggests a risk of initial compromise through network-based attacks, which could lead to unauthorized access, data exfiltration, or further malware deployment. Organizations with extensive network exposure or those relying on OSINT tools might be more susceptible if attackers leverage these indicators to craft targeted attacks. The medium severity implies that while immediate widespread disruption is unlikely, there is a tangible risk of infiltration that could escalate if combined with other vulnerabilities or social engineering tactics. European entities in critical infrastructure, finance, and government sectors should be vigilant, as successful payload delivery could undermine confidentiality, integrity, and availability of sensitive systems. The lack of patches means mitigation must focus on detection and prevention rather than remediation of a software flaw.

Defensive guidance

Given the nature of this threat, European organizations should implement enhanced network monitoring to detect unusual payload delivery attempts and suspicious network activity consistent with the provided IOCs once available. Deploying and regularly updating intrusion detection and prevention systems (IDS/IPS) with threat intelligence feeds such as ThreatFox can improve early detection capabilities. Network segmentation and strict access controls can limit the lateral movement of any payloads delivered. Organizations should also conduct regular threat hunting exercises using the latest OSINT indicators to identify potential compromises early. Employee training on recognizing phishing and social engineering attempts remains critical, as payload delivery often involves user interaction. Since no patches are available, maintaining up-to-date endpoint protection platforms and applying security hardening best practices will reduce the attack surface. Finally, sharing intelligence within European cybersecurity communities can help track evolving tactics related to this threat.

Community reviews

Loading reviews…