IndicatorPublished 17 Jun 2025Updated 18 Jun 2025

type osint · ThreatFox IOCs for 2025-06-17

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 61

6hms.topNetSupportManager RAT payload delivery domain (confidence level: 100%)
sinofreights.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
cellinifurniture.comKongTuke payload delivery domain (confidence level: 100%)
security.fjeareshiedls.comUnknown malware payload delivery domain (confidence level: 100%)
folepfa.comUnknown malware payload delivery domain (confidence level: 100%)
play.accountsgoogle.loginlivemiscrosoftonline.duckdns.orgHavoc botnet C2 domain (confidence level: 100%)
lh3.accountsgoogle.loginlivemiscrosoftonline.duckdns.orgHavoc botnet C2 domain (confidence level: 100%)
port-storage.ddns.netHavoc botnet C2 domain (confidence level: 100%)
host-5-58-172-98.bitternet.uaCobalt Strike botnet C2 domain (confidence level: 100%)
jrzlive.helpUnknown RAT botnet C2 domain (confidence level: 100%)

URLs 20

https://6hms.top/lsg/buf.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://6hms.top/lsg/bof.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://sinofreights.com/h.phpNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://sinofreights.com/tarijila.zipNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://cellinifurniture.com/6n9m.jsKongTuke payload delivery URL (confidence level: 100%)
https://cellinifurniture.com/js.phpKongTuke payload delivery URL (confidence level: 100%)
https://folepfa.com/shield.msiUnknown malware payload delivery URL (confidence level: 100%)
http://a1138040.xsph.ru/5c42f15e.phpDCRat botnet C2 (confidence level: 100%)
http://anthonymus.temp.swtest.ru/vmtoprocessprocessordefaultsql.phpDCRat botnet C2 (confidence level: 100%)
http://134.122.200.75/Hook botnet C2 (confidence level: 50%)

IP addresses 304

83.229.122.47Cobalt Strike botnet C2 server (confidence level: 100%)
216.250.251.190DarkComet botnet C2 server (confidence level: 100%)
91.92.136.159Sliver botnet C2 server (confidence level: 100%)
95.163.221.72Sliver botnet C2 server (confidence level: 100%)
185.224.128.52Sliver botnet C2 server (confidence level: 100%)
172.111.151.97AsyncRAT botnet C2 server (confidence level: 100%)
34.45.4.71Unknown malware botnet C2 server (confidence level: 100%)
37.27.249.191Unknown malware botnet C2 server (confidence level: 100%)
134.122.200.75Hook botnet C2 server (confidence level: 100%)
172.111.131.226Quasar RAT botnet C2 server (confidence level: 100%)

Hashes 6

Unknown malware payload (confidence level: 50%)

bbbf99de707dd28c938668d34c2e1b26
3d01bdac70797938954bd5c60a34db3c
80f4a1d42e2d4205cedf96909091cf84
9c0be24942593c11acf79e4dd9af842e
76a3ee4f0447ad47767d2b6f808b7fc6
36a00142db6e258b6604efd7cc930dd8

Description

ThreatFox IOCs for 2025-06-17

Impact

For European organizations, the potential impact of this threat lies primarily in its capability to deliver malicious payloads over network channels, which could lead to unauthorized access, data exfiltration, or disruption of services depending on the payload’s nature. Since no specific vulnerabilities or affected software are identified, the threat likely exploits generic network or social engineering vectors, increasing the risk of widespread but opportunistic attacks. Organizations relying on OSINT for threat detection or intelligence gathering might be targeted or indirectly affected if the malware leverages OSINT-derived data to tailor attacks. The medium severity suggests that while the threat is not currently critical, it could escalate if new exploits or payloads emerge. European entities with extensive network exposure, such as financial institutions, critical infrastructure, and large enterprises, may face risks related to confidentiality breaches or operational disruptions. The lack of known exploits in the wild reduces immediate risk but does not eliminate the possibility of future exploitation. Additionally, the absence of patches means that mitigation will rely heavily on detection and prevention controls rather than vulnerability remediation.

Defensive guidance

Given the limited technical details and absence of patches, European organizations should focus on enhancing network security monitoring and payload detection capabilities. Specific recommendations include: 1) Implement advanced network traffic analysis tools capable of identifying anomalous payload delivery patterns and suspicious network activity consistent with malware distribution. 2) Employ threat intelligence integration to continuously update detection rules with emerging IOCs from ThreatFox and other OSINT sources. 3) Harden email and web gateways to filter and block potential malware delivery vectors, including spear-phishing attempts that may leverage OSINT data. 4) Conduct regular user awareness training emphasizing the risks of social engineering and the importance of verifying unsolicited communications. 5) Utilize endpoint detection and response (EDR) solutions to identify and contain payload execution promptly. 6) Establish incident response procedures tailored to malware infections involving network-based payload delivery. 7) Collaborate with national and European cybersecurity centers to share intelligence and receive timely alerts about evolving threats. These measures go beyond generic advice by focusing on detection and response in the absence of specific patches or exploit details.

Community reviews

Loading reviews…