IndicatorPublished 14 Jun 2025Updated 15 Jun 2025

type osint · ThreatFox IOCs for 2025-06-14

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 27

security.gyqardfilares.comUnknown malware payload delivery domain (confidence level: 100%)
fokeniz.comUnknown malware payload delivery domain (confidence level: 100%)
topmicrosoftmarketing.comShadowPad botnet C2 domain (confidence level: 95%)
o.optimumcs.orgCobalt Strike botnet C2 domain (confidence level: 100%)
yingjiachuwei.comCobalt Strike botnet C2 domain (confidence level: 100%)
secure.optimumcs.orgCobalt Strike botnet C2 domain (confidence level: 100%)
cas-aws.optimumcs.orgCobalt Strike botnet C2 domain (confidence level: 100%)
tavkz.duckdns.orgHavoc botnet C2 domain (confidence level: 100%)
units-jewish.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
counterstrike2-cheats.comXWorm botnet C2 domain (confidence level: 100%)

URLs 20

http://165.232.156.200:22533/build.apkUnknown malware botnet C2 (confidence level: 50%)
http://82.115.17.84:2095/build.apkUnknown malware botnet C2 (confidence level: 50%)
http://104.238.61.204:9933/loginUnknown malware botnet C2 (confidence level: 50%)
http://104.194.215.25:22222/loginUnknown malware botnet C2 (confidence level: 50%)
http://45.86.163.48:44888/loginUnknown malware botnet C2 (confidence level: 50%)
http://78.47.219.204:22533/build.apkUnknown malware botnet C2 (confidence level: 100%)
http://162.120.71.117:53421/build.apkUnknown malware botnet C2 (confidence level: 100%)
http://103.84.207.50/build.apkUnknown malware botnet C2 (confidence level: 50%)
https://fokeniz.com/shield.msiUnknown malware payload delivery URL (confidence level: 100%)
http://47.93.42.180:81/re9mCobalt Strike botnet C2 (confidence level: 100%)

IP addresses 138

1.94.41.160Cobalt Strike botnet C2 server (confidence level: 75%)
47.76.30.15Cobalt Strike botnet C2 server (confidence level: 75%)
20.41.73.175Cobalt Strike botnet C2 server (confidence level: 75%)
47.97.154.223Cobalt Strike botnet C2 server (confidence level: 75%)
196.251.72.112AsyncRAT botnet C2 server (confidence level: 100%)
196.251.66.21AsyncRAT botnet C2 server (confidence level: 100%)
82.156.109.69Unknown malware botnet C2 server (confidence level: 100%)
121.127.231.163Hook botnet C2 server (confidence level: 100%)
185.72.199.83Quasar RAT botnet C2 server (confidence level: 100%)
157.230.38.27Havoc botnet C2 server (confidence level: 100%)

Hashes 35

Qilin payload (confidence level: 50%)

0d68a310f4265821900249bec89364c2
53c8a4f0497929de4a5039b2c14bf426
670fe8faaede4e2e033311fb662d2a4a
f982da00c547913fd0ae7d0da0fc77e7
9ea321b6a0f069caab7092cfe1cbbde0
2f76a29d4e4292d7f29a29345717812c
826a8e8c05983aa3a884d7abcfa473ac
8ca5c9745e8a0e18167a9b932821645a
5862f9fc9c9a0d766eba29eb4945f619
3158a3849ea2695d6ec5aea6512fd030

Description

ThreatFox IOCs for 2025-06-14

Impact

For European organizations, the impact of this threat could manifest in several ways. Since the threat involves OSINT and network activity for payload delivery, it may be used to conduct reconnaissance on organizational assets, identify vulnerabilities, and deliver malware that compromises confidentiality, integrity, or availability of systems. The medium severity suggests that while immediate widespread disruption is unlikely, targeted attacks could lead to unauthorized access, data leakage, or foothold establishment within networks. European entities with significant online presence or those involved in critical infrastructure, finance, or government sectors may face increased risk due to the potential for tailored payloads following OSINT reconnaissance. The absence of known exploits and patches means organizations cannot rely on traditional vulnerability management alone but must focus on detecting suspicious network activity and payload delivery attempts. Additionally, the use of OSINT techniques implies attackers may adapt quickly to publicly available information, increasing the risk of social engineering or spear-phishing campaigns that could facilitate initial compromise.

Defensive guidance

1. Enhance network monitoring with a focus on detecting anomalous payload delivery patterns and unusual OSINT-related reconnaissance activities, such as excessive querying of public information sources or suspicious external communications. 2. Implement advanced threat hunting practices that correlate OSINT-derived intelligence with internal network telemetry to identify early signs of compromise. 3. Employ strict segmentation and least privilege principles to limit the impact of any successful payload delivery, ensuring that malware cannot easily propagate across critical systems. 4. Conduct regular employee training emphasizing the risks associated with OSINT exploitation, including awareness of social engineering tactics that may leverage publicly available information. 5. Utilize threat intelligence sharing platforms to stay updated on emerging IOCs and TTPs related to OSINT-driven malware campaigns, enabling proactive defense adjustments. 6. Deploy endpoint detection and response (EDR) solutions capable of identifying and blocking payload execution even in the absence of known signatures, focusing on behavioral indicators. 7. Review and harden public-facing information to minimize exposure of sensitive data that could be exploited through OSINT techniques.

Community reviews

Loading reviews…