IndicatorPublished 9 Jun 2025Updated 10 Jun 2025

type osint · ThreatFox IOCs for 2025-06-09

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 82

latarelisafi.proUnknown Loader payload delivery domain (confidence level: 90%)
analyticanods.comUnknown malware payload delivery domain (confidence level: 100%)
security.garudflores.comUnknown malware payload delivery domain (confidence level: 100%)
koslep.comUnknown malware payload delivery domain (confidence level: 100%)
www.zestarcade.xyzCobalt Strike botnet C2 domain (confidence level: 100%)
assistance-trash.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
department-monica.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
hatem2youssef.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
hatem2youssef2.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
khalifarema.zapto.orgRemcos botnet C2 domain (confidence level: 100%)

URLs 45

https://www.publynx.com/ajaxactionFAKEUPDATES botnet C2 (confidence level: 100%)
https://koslep.com/flare.msiUnknown malware payload delivery URL (confidence level: 100%)
http://530182cm.nyashvibe.ru/externalimagepipe_geocpuserverbasewpcentral.phpDCRat botnet C2 (confidence level: 100%)
http://a1130890.xsph.ru/f1527fee.phpDCRat botnet C2 (confidence level: 100%)
https://12333333.sasha-solzhenicyn.ru/loginLumma Stealer botnet C2 (confidence level: 50%)
http://a1062538.xsph.ru/17156566.phpDCRat botnet C2 (confidence level: 50%)
http://45.207.212.160/Hook botnet C2 (confidence level: 50%)
http://45.207.212.9/Hook botnet C2 (confidence level: 50%)
http://154.64.231.82:8888/supershell/loginUnknown malware botnet C2 (confidence level: 50%)
http://195.82.147.187/loginLumma Stealer botnet C2 (confidence level: 50%)

IP addresses 162

192.227.247.100Cobalt Strike botnet C2 server (confidence level: 75%)
117.72.209.44Cobalt Strike botnet C2 server (confidence level: 75%)
113.45.228.7Cobalt Strike botnet C2 server (confidence level: 75%)
47.96.128.129Cobalt Strike botnet C2 server (confidence level: 75%)
111.229.217.32Cobalt Strike botnet C2 server (confidence level: 75%)
43.252.229.158Cobalt Strike botnet C2 server (confidence level: 75%)
121.36.53.239Cobalt Strike botnet C2 server (confidence level: 75%)
106.75.61.100Cobalt Strike botnet C2 server (confidence level: 75%)
1.15.34.67Cobalt Strike botnet C2 server (confidence level: 75%)
91.199.163.56Cobalt Strike botnet C2 server (confidence level: 75%)

Description

ThreatFox IOCs for 2025-06-09

Impact

For European organizations, the impact of this threat primarily lies in the potential for improved detection and response capabilities through the integration of these IOCs into security monitoring tools. Since no active exploits or specific vulnerabilities are identified, the direct risk of compromise from this threat feed is low. However, failure to incorporate such threat intelligence could leave organizations more vulnerable to malware infections or network intrusions that these IOCs help identify. The medium severity suggests that the threat intelligence may relate to malware campaigns or payload delivery methods that could affect confidentiality, integrity, or availability if successfully executed. European organizations with mature security operations centers (SOCs) and threat intelligence teams stand to benefit most by leveraging this data to enhance their detection rules and incident response. Conversely, organizations lacking such capabilities may be at increased risk of undetected malware activity. The absence of patches or exploit details means the threat is more about awareness and detection than immediate remediation. Overall, the impact is indirect but important for maintaining robust cybersecurity postures in Europe.

Defensive guidance

1. Integrate the provided ThreatFox IOCs into existing Security Information and Event Management (SIEM) systems, intrusion detection/prevention systems (IDS/IPS), and endpoint detection and response (EDR) tools to enhance detection capabilities. 2. Regularly update threat intelligence feeds and ensure automated ingestion of new IOCs to maintain up-to-date defenses. 3. Conduct network traffic analysis focusing on payload delivery mechanisms and suspicious network activity patterns highlighted by the IOCs. 4. Train SOC analysts and incident responders to recognize and investigate alerts generated from these IOCs promptly. 5. Implement network segmentation and strict egress filtering to limit the potential spread or communication of malware payloads. 6. Maintain robust backup and recovery procedures to mitigate impact in case of successful malware infection. 7. Collaborate with information sharing organizations and national cybersecurity centers to contextualize these IOCs within local threat landscapes. 8. Since no patches are available, focus on detection, containment, and response rather than remediation of a specific vulnerability.

Community reviews

Loading reviews…