IndicatorPublished 13 Jun 2025Updated 14 Jun 2025

type osint · ThreatFox IOCs for 2025-06-13

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 107

s8os.tvknzupwbdfg.esUnknown malware botnet C2 domain (confidence level: 50%)
ug1fyhmfbjfgalckjkoq1i7mdmejkiantb82qxx7zffn9hfl5jnz.rcxpffxvge.esUnknown malware botnet C2 domain (confidence level: 50%)
b1.hashgranite.topACR Stealer botnet C2 domain (confidence level: 75%)
b1.husbandlandside.topACR Stealer botnet C2 domain (confidence level: 75%)
b1.crushedwildly.topACR Stealer botnet C2 domain (confidence level: 75%)
b1.encountergulf.worldACR Stealer botnet C2 domain (confidence level: 75%)
b1.wreckermodule.lifeACR Stealer botnet C2 domain (confidence level: 75%)
security.gyaerdfiared.comUnknown malware payload delivery domain (confidence level: 100%)
popcies.comUnknown malware payload delivery domain (confidence level: 100%)
ananalyticsnodes.comUnknown malware payload delivery domain (confidence level: 100%)

URLs 51

https://u6re.dezceccc.ru/zldat!voguciearvyb/Unknown malware botnet C2 (confidence level: 50%)
https://0spw.dezceccc.ru/@3zm8siv4yqu01/Unknown malware botnet C2 (confidence level: 50%)
https://wqngm.dezceccc.ru/t0v!rb7kxfpoxpiw/Unknown malware botnet C2 (confidence level: 50%)
https://popcies.com/shield.msiUnknown malware payload delivery URL (confidence level: 100%)
http://134.209.111.11:8080/build.apkUnknown malware botnet C2 (confidence level: 100%)
https://lemon.snapitweb.com/build.apkUnknown malware botnet C2 (confidence level: 75%)
https://www.rucat.fedor-turin.ru/loginLumma Stealer botnet C2 (confidence level: 50%)
http://121.127.231.161/Hook botnet C2 (confidence level: 50%)
http://27.106.116.66:8888/supershell/loginUnknown malware botnet C2 (confidence level: 50%)
http://server9.localstats.org/Glupteba botnet C2 (confidence level: 50%)

IP addresses 159

122.10.117.18Cobalt Strike botnet C2 server (confidence level: 75%)
47.98.130.151Cobalt Strike botnet C2 server (confidence level: 75%)
38.207.178.63Cobalt Strike botnet C2 server (confidence level: 75%)
39.105.201.242Cobalt Strike botnet C2 server (confidence level: 75%)
107.175.30.227Cobalt Strike botnet C2 server (confidence level: 75%)
43.153.162.106Cobalt Strike botnet C2 server (confidence level: 75%)
47.92.141.198Cobalt Strike botnet C2 server (confidence level: 75%)
114.96.89.69Cobalt Strike botnet C2 server (confidence level: 75%)
117.72.79.68Cobalt Strike botnet C2 server (confidence level: 75%)
82.157.8.52Cobalt Strike botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-06-13

Impact

For European organizations, the primary impact of this threat lies in its role as a source of actionable intelligence rather than a direct attack vector. The dissemination of IOCs related to malware and network activity can enhance the ability of security teams to detect and respond to emerging threats. However, if these IOCs are incomplete or outdated, there is a risk of false negatives or delayed detection, potentially allowing malicious payloads to infiltrate networks undetected. Given the medium severity rating and the absence of known active exploits, the immediate risk to confidentiality, integrity, and availability is moderate. Nonetheless, organizations relying heavily on OSINT feeds for threat detection should ensure the integration of such intelligence into their security operations to maintain situational awareness. The lack of patches or specific vulnerable products means that traditional vulnerability management approaches are less applicable, shifting the focus to network monitoring and incident response capabilities. European entities with critical infrastructure, financial services, and government sectors may find this intelligence particularly relevant due to their high exposure to targeted malware campaigns and the strategic importance of maintaining robust threat detection mechanisms.

Defensive guidance

1. Integrate ThreatFox IOCs into existing Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to enhance detection capabilities for malware and network-based threats. 2. Regularly update and validate OSINT feeds to ensure the relevance and accuracy of indicators, reducing false positives and negatives. 3. Employ network segmentation and strict access controls to limit the potential spread of malicious payloads detected through these indicators. 4. Conduct continuous training for security analysts on interpreting and acting upon OSINT-derived intelligence to improve response times and effectiveness. 5. Implement automated alerting mechanisms triggered by matches to ThreatFox IOCs to enable rapid incident response. 6. Collaborate with European cybersecurity information sharing communities to contextualize ThreatFox data within regional threat landscapes. 7. Since no patches are available, focus on proactive threat hunting and anomaly detection to identify novel or evolving payload delivery methods that may not yet be covered by existing IOCs.

Community reviews

Loading reviews…