IndicatorPublished 10 Jun 2025Updated 11 Jun 2025

type osint · ThreatFox IOCs for 2025-06-10

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 82

ncmtraders.comKongTuke payload delivery domain (confidence level: 100%)
a82523.topKongTuke payload delivery domain (confidence level: 100%)
security.garsecflae.comUnknown malware payload delivery domain (confidence level: 100%)
losaz.comUnknown malware payload delivery domain (confidence level: 100%)
cloudproc.netUnknown malware payload delivery domain (confidence level: 75%)
cf-verifi.pages.devUnknown malware payload delivery domain (confidence level: 75%)
841932-tmo.comUnknown malware payload delivery domain (confidence level: 75%)
841932-verizion.comUnknown malware payload delivery domain (confidence level: 75%)
841932-spectrumwireless.comUnknown malware payload delivery domain (confidence level: 75%)
cetus-zone.networkUnknown malware payload delivery domain (confidence level: 75%)

URLs 80

https://ncmtraders.com/3s7j.jsKongTuke payload delivery URL (confidence level: 100%)
https://ncmtraders.com/js.phpKongTuke payload delivery URL (confidence level: 100%)
http://a82523.top/12KongTuke payload delivery URL (confidence level: 100%)
https://a82523.top/zfyg.hKongTuke payload delivery URL (confidence level: 100%)
https://losaz.com/flare.msiUnknown malware payload delivery URL (confidence level: 100%)
https://841932-tmo.com/Unknown malware payload delivery URL (confidence level: 75%)
https://841932-verizion.com/Unknown malware payload delivery URL (confidence level: 75%)
https://841932-spectrumwireless.com/Unknown malware payload delivery URL (confidence level: 75%)
https://cetus-zone.network/Unknown malware payload delivery URL (confidence level: 75%)
https://841932-sasktels.com/Unknown malware payload delivery URL (confidence level: 75%)

IP addresses 178

183.6.20.32Cobalt Strike botnet C2 server (confidence level: 75%)
120.25.121.197Cobalt Strike botnet C2 server (confidence level: 75%)
111.229.121.53Cobalt Strike botnet C2 server (confidence level: 75%)
43.139.178.211Cobalt Strike botnet C2 server (confidence level: 75%)
156.238.230.57Cobalt Strike botnet C2 server (confidence level: 75%)
111.230.8.147Cobalt Strike botnet C2 server (confidence level: 75%)
45.155.220.44Cobalt Strike botnet C2 server (confidence level: 75%)
139.224.103.84Cobalt Strike botnet C2 server (confidence level: 75%)
154.37.213.233Cobalt Strike botnet C2 server (confidence level: 100%)
50.16.129.49Sliver botnet C2 server (confidence level: 100%)

Hashes 11

DISGOMOJI payload (confidence level: 100%)

452cd18570471e80dd6bf34addede334
d5a3766e744a563278b18267d6bd7113
c763ecf315481525afcd47c5f32c1fd7
68fbe197c62a3777d2299f9eabed2c70
43e4260c595b20e357be75c0c1fbec29
d24c797f94933a3ec5227a6f57e15358
c8c21b4642f12c28f6e5e0389bbf8c36
e429ebfbc827ac8a865dce20470d3e8b
fe7bb6d0835879043e4b9fef7fa59375
1a17955be2f99813c03d9f4970131593

Description

ThreatFox IOCs for 2025-06-10

Impact

For European organizations, the impact of this threat intelligence update is primarily in enhancing situational awareness and improving detection capabilities against potential malware payload delivery and network-based attacks. Since no active exploits or vulnerabilities are identified, the direct risk to confidentiality, integrity, or availability is limited at this stage. However, failure to integrate these IOCs into security monitoring tools could result in missed detection opportunities, allowing adversaries to operate undetected. Organizations with mature security operations centers (SOCs) and threat hunting teams can leverage this intelligence to fine-tune network monitoring, intrusion detection systems, and endpoint detection and response (EDR) solutions. The medium severity rating suggests that while the threat is not critical, it should not be ignored, especially in sectors with high-value targets or sensitive data. European entities involved in critical infrastructure, finance, or government may benefit most from incorporating these IOCs to preemptively identify suspicious activity related to payload delivery attempts or network intrusions.

Defensive guidance

1. Integrate the provided IOCs into existing security information and event management (SIEM) systems, intrusion detection/prevention systems (IDS/IPS), and endpoint detection and response (EDR) platforms to enhance detection capabilities. 2. Conduct regular threat hunting exercises using these IOCs to identify any signs of compromise or suspicious network activity. 3. Maintain updated network segmentation and strict access controls to limit the potential spread of malware payloads if detected. 4. Employ network traffic analysis tools to monitor for anomalous payload delivery patterns or unusual network communications that match the IOC profiles. 5. Ensure that incident response teams are aware of this intelligence update and prepared to investigate alerts triggered by these indicators. 6. Collaborate with information sharing and analysis centers (ISACs) relevant to the organization's sector to exchange additional context and updates related to these IOCs. 7. Since no patches are available, focus on detection and containment strategies rather than remediation of a vulnerability.

Community reviews

Loading reviews…