IndicatorPublished 11 Jun 2025Updated 12 Jun 2025

type osint · ThreatFox IOCs for 2025-06-11

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 90

security.flapegjardse.comUnknown malware payload delivery domain (confidence level: 100%)
nesapa.comUnknown malware payload delivery domain (confidence level: 100%)
static.148.29.9.176.clients.your-server.deHavoc botnet C2 domain (confidence level: 100%)
etnxin63.tk10.topCobalt Strike botnet C2 domain (confidence level: 100%)
outlook.optimumcs.orgCobalt Strike botnet C2 domain (confidence level: 100%)
etnsg6.nicetk.topCobalt Strike botnet C2 domain (confidence level: 100%)
login.optimumcs.orgCobalt Strike botnet C2 domain (confidence level: 100%)
kf.pinkbnb.netCobalt Strike botnet C2 domain (confidence level: 100%)
lpmrsa.netHavoc botnet C2 domain (confidence level: 100%)
appsmacosx.comAMOS payload delivery domain (confidence level: 75%)

URLs 17

https://nesapa.com/shield.msiUnknown malware payload delivery URL (confidence level: 100%)
https://78.47.69.208/Vidar botnet C2 (confidence level: 100%)
https://32.0.4t.com/Vidar botnet C2 (confidence level: 100%)
https://api.telegram.org/bot6593110417:aahd3ejsvvfs6uyfmjwwzrgcoimyda6p5zg/Agent Tesla botnet C2 (confidence level: 50%)
https://andreameixueiro.com/iransat_vlxwzzs182.binUnknown Loader botnet C2 (confidence level: 50%)
https://drive.google.com/uc?export=download&id=1zs8dtti5_wmj-76xq2wmobnkdizyljakUnknown Loader botnet C2 (confidence level: 50%)
https://onedrive.live.com/download?cid=72ef66c14df86b76&resid=72ef66c14df86b76%21173&authkey=alqcuouptad_r-qUnknown Loader botnet C2 (confidence level: 50%)
http://89.38.128.49/externalsecurecpuupdatetestuniversaltemporary.phpDCRat botnet C2 (confidence level: 100%)
https://secure.nashbashmotorsports.com/ajaxactionFAKEUPDATES botnet C2 (confidence level: 100%)
https://valifoprofsto.com/work/Latrodectus botnet C2 (confidence level: 50%)

IP addresses 164

89.117.67.63FAKEUPDATES botnet C2 server (confidence level: 100%)
146.70.113.140Cobalt Strike botnet C2 server (confidence level: 75%)
103.51.144.18Cobalt Strike botnet C2 server (confidence level: 75%)
156.238.233.76Cobalt Strike botnet C2 server (confidence level: 75%)
138.197.71.186Cobalt Strike botnet C2 server (confidence level: 75%)
43.139.233.218Cobalt Strike botnet C2 server (confidence level: 75%)
154.89.152.16Cobalt Strike botnet C2 server (confidence level: 75%)
194.233.82.123Cobalt Strike botnet C2 server (confidence level: 75%)
103.19.190.184Cobalt Strike botnet C2 server (confidence level: 75%)
47.92.213.214Cobalt Strike botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-06-11

Impact

For European organizations, the potential impact of this threat is moderate but should not be underestimated. Since the threat involves OSINT and network activity related to payload delivery, it could facilitate targeted attacks such as spear-phishing, network intrusions, or malware deployment leveraging publicly available information. This could lead to unauthorized access, data exfiltration, or disruption of services. The absence of known exploits in the wild and patches suggests that exploitation may require specific conditions or manual attacker effort, limiting immediate widespread impact. However, organizations with high-value assets, especially those in critical infrastructure, finance, or government sectors, could be at risk if attackers leverage OSINT to tailor their payload delivery effectively. The threat may also serve as a precursor to more sophisticated attacks, making early detection and response crucial to mitigate potential damage. European entities should consider this threat as part of their broader threat landscape, emphasizing the importance of monitoring network activity and OSINT-derived intelligence to prevent successful payload delivery and subsequent compromise.

Defensive guidance

1. Enhance OSINT Monitoring: Implement continuous monitoring of open-source intelligence to detect emerging threats and indicators related to malware campaigns. 2. Network Traffic Analysis: Deploy advanced network traffic analysis tools capable of identifying anomalous payload delivery attempts, including unusual outbound connections or data flows. 3. Threat Intelligence Integration: Integrate ThreatFox and other reputable threat intelligence feeds into security information and event management (SIEM) systems to correlate and respond to relevant IOCs promptly. 4. User Awareness and Training: Conduct targeted training to educate employees about the risks of social engineering and spear-phishing attacks that may leverage OSINT data. 5. Network Segmentation: Apply strict network segmentation to limit the lateral movement potential of malware if payload delivery is successful. 6. Endpoint Detection and Response (EDR): Utilize EDR solutions to detect and contain suspicious activities at the endpoint level, focusing on payload execution and persistence mechanisms. 7. Incident Response Preparedness: Develop and regularly update incident response plans to address malware infections, including containment, eradication, and recovery procedures. 8. Access Controls and Least Privilege: Enforce strong access controls and the principle of least privilege to reduce the impact of potential compromises. These measures go beyond generic advice by emphasizing proactive OSINT monitoring, integration of specific threat feeds, and tailored network defenses aligned with the nature of the threat.

Community reviews

Loading reviews…