IndicatorPublished 18 Jun 2025Updated 19 Jun 2025

type osint · ThreatFox IOCs for 2025-06-18

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 49

security.fizaregiyard.comUnknown malware payload delivery domain (confidence level: 100%)
wepolix.comUnknown malware payload delivery domain (confidence level: 100%)
www.ssatech.onlineAsyncRAT botnet C2 domain (confidence level: 100%)
www.waillyrx5.comAsyncRAT botnet C2 domain (confidence level: 75%)
100.56.171.34.bc.googleusercontent.comHavoc botnet C2 domain (confidence level: 100%)
apis.accountsgoogle.loginlivemiscrosoftonline.duckdns.orgHavoc botnet C2 domain (confidence level: 100%)
play.accountsgooogle.loginlivemiscrosoftonline.duckdns.orgHavoc botnet C2 domain (confidence level: 100%)
zoutailian.jlx9.asiaCobalt Strike botnet C2 domain (confidence level: 100%)
ecs-113-44-144-145.compute.hwclouds-dns.comCobalt Strike botnet C2 domain (confidence level: 100%)
mta73.bwcasino.emailUnknown malware botnet C2 domain (confidence level: 100%)

URLs 25

https://wepolix.com/shield.msiUnknown malware payload delivery URL (confidence level: 100%)
http://a1139192.xsph.ru/3ddfcbfe.phpDCRat botnet C2 (confidence level: 100%)
https://dan-ban.bz/xder.ps1Unknown Stealer payload delivery URL (confidence level: 100%)
https://78.47.43.88/Vidar botnet C2 (confidence level: 100%)
https://9.20.storysaverr.app/Vidar botnet C2 (confidence level: 100%)
https://b1.wreckermodule.life/upACR Stealer botnet C2 (confidence level: 100%)
https://b1.wreckermodule.life/up/fACR Stealer botnet C2 (confidence level: 100%)
https://b1.wreckermodule.life/up/gACR Stealer botnet C2 (confidence level: 100%)
https://b1.wreckermodule.life/up/bACR Stealer botnet C2 (confidence level: 100%)
https://b1.wreckermodule.life/up/pACR Stealer botnet C2 (confidence level: 100%)

IP addresses 149

8.155.7.173Cobalt Strike botnet C2 server (confidence level: 100%)
123.249.3.92Cobalt Strike botnet C2 server (confidence level: 100%)
39.104.78.25Cobalt Strike botnet C2 server (confidence level: 100%)
196.251.72.80Remcos botnet C2 server (confidence level: 100%)
85.209.128.39AsyncRAT botnet C2 server (confidence level: 100%)
128.90.106.75AsyncRAT botnet C2 server (confidence level: 100%)
151.242.58.75AsyncRAT botnet C2 server (confidence level: 100%)
172.94.96.143AsyncRAT botnet C2 server (confidence level: 100%)
3.129.217.57Havoc botnet C2 server (confidence level: 100%)
46.246.82.3DCRat botnet C2 server (confidence level: 100%)

Hashes 3

Crimson RAT payload (confidence level: 100%)

948571781f0a6edfd6d9357441fbfbb8
33ac03a2a13d5870261233349fc9aef0
6c3dcb8f513f46eabed0d1564c065ec6

Description

ThreatFox IOCs for 2025-06-18

Impact

For European organizations, the impact of this threat lies primarily in its role as a source of intelligence on malware campaigns that utilize OSINT techniques for payload delivery and network-based operations. While no direct exploit or vulnerability is identified, organizations that fail to incorporate these IOCs into their detection and response workflows may be at increased risk of undetected malware infections or network intrusions. The threat's medium severity suggests a moderate risk of confidentiality breaches, potential integrity compromises through malware payloads, and availability impacts if the malware disrupts network operations. Given the lack of specific affected products, the threat could potentially impact a wide range of organizations, especially those with significant network exposure or those that rely heavily on OSINT-derived data for operational purposes. The absence of known exploits in the wild reduces immediate risk but does not eliminate the possibility of future exploitation or the use of these IOCs by threat actors to enhance their campaigns. European organizations in sectors such as finance, critical infrastructure, and government may face increased risk due to the strategic value of their data and networks, making them attractive targets for malware campaigns leveraging OSINT.

Defensive guidance

To mitigate risks associated with this threat, European organizations should implement the following specific measures: 1) Integrate the latest ThreatFox IOCs into existing security information and event management (SIEM) systems and endpoint detection and response (EDR) tools to enhance detection capabilities against malware payloads and network activity linked to OSINT-driven campaigns. 2) Conduct regular threat hunting exercises focused on network traffic anomalies and suspicious payload delivery patterns that align with the provided IOCs, even in the absence of known exploits. 3) Strengthen network segmentation and monitoring to limit the lateral movement of malware if initial compromise occurs, particularly focusing on segments handling sensitive or critical data. 4) Enhance employee training on recognizing phishing or social engineering attempts that may be informed by OSINT, as these are common initial vectors for payload delivery. 5) Collaborate with national and European cybersecurity information sharing platforms to stay updated on evolving IOCs and threat actor tactics related to OSINT-based malware campaigns. 6) Since no patches are available, emphasize proactive detection and response rather than reliance on vulnerability remediation. 7) Employ network traffic analysis tools capable of identifying unusual outbound connections or command-and-control communications that may be associated with the malware indicated by these IOCs.

Community reviews

Loading reviews…