IndicatorPublished 15 Jun 2025Updated 16 Jun 2025

type osint · ThreatFox IOCs for 2025-06-15

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 191

security.fwaregyord.comUnknown malware payload delivery domain (confidence level: 100%)
hewqol.comUnknown malware payload delivery domain (confidence level: 100%)
optimosphere.comCobalt Strike botnet C2 domain (confidence level: 75%)
svchost.iqiyia.topCobalt Strike botnet C2 domain (confidence level: 75%)
tipo2.colchadretal.comCobalt Strike botnet C2 domain (confidence level: 100%)
vn3hg.optimumcs.orgCobalt Strike botnet C2 domain (confidence level: 100%)
www.waydownk.orgNimplant botnet C2 domain (confidence level: 100%)
avilor.ddns.netDarkComet botnet C2 domain (confidence level: 50%)
darkmist124.ddns.netDarkComet botnet C2 domain (confidence level: 50%)
jbvpshosti.comMirai botnet C2 domain (confidence level: 50%)

URLs 10

https://188.92.28.186/AMOS botnet C2 (confidence level: 100%)
https://emailreddit.com/AMOS botnet C2 (confidence level: 100%)
https://hewqol.com/shield.msiUnknown malware payload delivery URL (confidence level: 100%)
http://a1136728.xsph.ru/b85ebbeb.phpDCRat botnet C2 (confidence level: 100%)
http://a1136805.xsph.ru/b85c037e.phpDCRat botnet C2 (confidence level: 100%)
https://discord.gg/j2qs3cwhLockBit botnet C2 (confidence level: 50%)
http://tax.matrixtomaven.com/fre.phpLoki botnet C2 (confidence level: 50%)
http://ci77996.tw1.ru/79178553.phpDCRat botnet C2 (confidence level: 100%)
http://543672cm.nyashvibe.ru/updatebigloadmultiwordpressdownloads.phpDCRat botnet C2 (confidence level: 100%)
http://45.14.227.125/index.phpKoi Loader botnet C2 (confidence level: 100%)

IP addresses 126

81.70.241.213Cobalt Strike botnet C2 server (confidence level: 75%)
43.133.211.161Cobalt Strike botnet C2 server (confidence level: 75%)
39.98.174.154Cobalt Strike botnet C2 server (confidence level: 75%)
62.60.232.34Cobalt Strike botnet C2 server (confidence level: 75%)
43.159.57.217Cobalt Strike botnet C2 server (confidence level: 75%)
47.97.102.95Cobalt Strike botnet C2 server (confidence level: 75%)
117.72.210.133Cobalt Strike botnet C2 server (confidence level: 75%)
113.44.89.172Cobalt Strike botnet C2 server (confidence level: 75%)
124.222.124.9Cobalt Strike botnet C2 server (confidence level: 75%)
165.154.238.214Cobalt Strike botnet C2 server (confidence level: 75%)

Description

ThreatFox IOCs for 2025-06-15

Impact

For European organizations, the impact of this threat is primarily related to the detection and mitigation of malware infections or network intrusions identified through the provided IOCs. Since the threat does not describe a specific vulnerability or exploit, but rather indicators of malware presence or activity, the direct impact depends on the effectiveness of organizations' security monitoring and incident response capabilities. Potential impacts include unauthorized network access, data exfiltration, or disruption caused by malware payloads if these IOCs correspond to active campaigns. Given the medium severity rating and absence of known exploits, the threat likely represents a moderate risk that could lead to operational disruptions or data compromise if not addressed. Organizations relying heavily on OSINT feeds for threat detection may find this intelligence useful for enhancing their situational awareness and improving detection of related malware activities. However, the lack of patch availability and specific exploit details means the threat is more about ongoing monitoring and response rather than immediate remediation.

Defensive guidance

1. Integrate the provided IOCs into existing security information and event management (SIEM) systems and endpoint detection and response (EDR) tools to enhance detection capabilities for related malware activities. 2. Conduct regular network traffic analysis focusing on unusual payload delivery patterns or network behaviors matching the indicators, even if the indicators are not explicitly listed here. 3. Strengthen incident response procedures to quickly investigate alerts triggered by these IOCs, ensuring timely containment and eradication of malware infections. 4. Maintain updated threat intelligence feeds and cross-reference ThreatFox data with other OSINT sources to improve context and detection accuracy. 5. Educate security teams on interpreting OSINT-based threat intelligence, emphasizing that these indicators are part of a broader detection strategy rather than a direct vulnerability fix. 6. Implement network segmentation and strict access controls to limit the potential spread of malware payloads identified through these indicators. 7. Regularly review and update firewall and intrusion detection/prevention system (IDS/IPS) rules to incorporate emerging threat patterns related to payload delivery mechanisms. 8. Since no patches are available, focus on proactive monitoring and rapid response rather than remediation through software updates.

Community reviews

Loading reviews…