IndicatorPublished 19 Jun 2025Updated 20 Jun 2025

type osint · ThreatFox IOCs for 2025-06-19

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 1,153

b1.freshtug.topACR Stealer botnet C2 domain (confidence level: 50%)
api.gameforlikaks.topRhadamanthys botnet C2 domain (confidence level: 75%)
plotoraus.shopRhadamanthys botnet C2 domain (confidence level: 75%)
security.fgleragusards.comUnknown malware payload delivery domain (confidence level: 100%)
qnoeis.comUnknown malware payload delivery domain (confidence level: 100%)
equidn.xyzLumma Stealer botnet C2 domain (confidence level: 100%)
baviip.xyzLumma Stealer botnet C2 domain (confidence level: 100%)
trqqe.xyzLumma Stealer botnet C2 domain (confidence level: 100%)
guce.newservicedotup.deUnknown malware botnet C2 domain (confidence level: 100%)
namadistribution.comNimplant botnet C2 domain (confidence level: 100%)

URLs 36

https://qnoeis.com/shield.msiUnknown malware payload delivery URL (confidence level: 100%)
http://45.135.232.33/loginUnknown Stealer botnet C2 (confidence level: 100%)
http://etogavno.ru/_requestmultilinuxwindowsuniversalwordpressdatalifeprivate.phpDCRat botnet C2 (confidence level: 100%)
http://siymik2037.temp.swtest.ru/longpollwordpressprivatedownloads.phpDCRat botnet C2 (confidence level: 100%)
https://b1.crushedwildly.top/ujs/ACR Stealer botnet C2 (confidence level: 100%)
https://b1.crushedwildly.top/upACR Stealer botnet C2 (confidence level: 100%)
https://b1.crushedwildly.top/up/gACR Stealer botnet C2 (confidence level: 100%)
https://b1.crushedwildly.top/up/fACR Stealer botnet C2 (confidence level: 100%)
https://b1.husbandlandside.top/ujs/ACR Stealer botnet C2 (confidence level: 100%)
https://b1.husbandlandside.top/up/bACR Stealer botnet C2 (confidence level: 100%)

IP addresses 250

107.150.0.18Mirai payload delivery server (confidence level: 100%)
213.209.143.44Mirai payload delivery server (confidence level: 100%)
45.153.34.237Rhadamanthys botnet C2 server (confidence level: 75%)
180.178.189.34Rhadamanthys botnet C2 server (confidence level: 75%)
213.209.150.143Rhadamanthys botnet C2 server (confidence level: 75%)
45.153.34.242Rhadamanthys botnet C2 server (confidence level: 75%)
213.209.150.104Rhadamanthys botnet C2 server (confidence level: 75%)
65.109.160.160Rhadamanthys botnet C2 server (confidence level: 75%)
195.82.146.180Rhadamanthys botnet C2 server (confidence level: 75%)
94.141.123.182Rhadamanthys botnet C2 server (confidence level: 75%)

Hashes 10

Mirai payload (confidence level: 100%)

95d86f7092b2dcaae49cd5c2ad3d7f7979f470cab6337f5948f998ac48cc247c
d42374429f37505a13e40ece803b6c8b978738fd8dc8ea4093515fd796fbc308
d2553b517bd09d0fe6afb44952d7c387c77e7733766881952ffde88cc4b70e0a
1dc710fd0dfb6e29b7c8c57a2929189402bbf4065dd0453443daae3ac333b6eb
03dc543e846910b22d2cb01636990502b81cfadc394c0ee1d4c0b52ae7239e8d
ebf52c7a93796b21f879f65b111e82462101fc1a5483fdabcd6f4ff7ef579192
8243d0bcb644f380b1ebf08624b6d967c4b1728ed90b8e8385cdcc1cbaf5637c
1800e8dc6a574006d03601b98d558e8e8ab27471e019342a302c7d16ab159477
d9c5bd8dc94485e3d286637b6b97d54a4225cf23a7f2f59a4c6c92e47d16acf4
8ff3ae390aee8687d812b466e537fd747c176daca91bd2bf7d681c756cfc176c

Description

ThreatFox IOCs for 2025-06-19

Impact

For European organizations, the impact of this threat is primarily related to the potential for unauthorized network activity and payload delivery that could serve as a precursor to more severe attacks such as data breaches, ransomware deployment, or espionage. Since the threat is categorized under OSINT and network activity, it may be used by adversaries to gather intelligence on targets or to deliver malicious payloads stealthily. This could compromise confidentiality if sensitive information is exfiltrated, integrity if payloads modify or corrupt data, and availability if payloads disrupt network services. The medium severity suggests that while the immediate impact may not be critical, the threat could facilitate more damaging attacks if not detected and mitigated promptly. European organizations with extensive network infrastructure, especially those in critical sectors such as finance, energy, and government, may face increased risk due to the strategic value of their data and services. Additionally, the lack of patches means that defensive measures must rely on detection and network security controls rather than software updates.

Defensive guidance

Given the nature of this threat, European organizations should implement targeted network monitoring and threat hunting strategies focused on detecting unusual payload delivery and network activity patterns associated with OSINT-related threats. Specific recommendations include: 1) Deploy and regularly update network intrusion detection and prevention systems (IDS/IPS) with signatures and heuristics tuned to identify known ThreatFox IOCs and similar payload delivery mechanisms. 2) Enhance logging and correlation capabilities within Security Information and Event Management (SIEM) systems to detect anomalous network behaviors indicative of reconnaissance or payload delivery attempts. 3) Conduct regular threat intelligence sharing with trusted communities to stay updated on emerging IOCs and tactics related to ThreatFox and similar feeds. 4) Implement strict network segmentation and access controls to limit the lateral movement potential of any payloads delivered. 5) Train security teams to recognize OSINT-related threat patterns and incorporate proactive threat hunting exercises focused on network activity anomalies. 6) Since no patches are available, emphasize endpoint protection solutions capable of behavioral analysis to detect and block suspicious payload execution. 7) Regularly review and update incident response plans to incorporate scenarios involving OSINT-based payload delivery and network reconnaissance activities.

Community reviews

Loading reviews…