IndicatorPublished 20 Jun 2025Updated 21 Jun 2025

type osint · ThreatFox IOCs for 2025-06-20

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 39

analytticasnoden.comUnknown malware payload delivery domain (confidence level: 100%)
security.fweragyrads.comUnknown malware payload delivery domain (confidence level: 100%)
foepsa.comUnknown malware payload delivery domain (confidence level: 100%)
v361422.hosted-by-vdsina.comUnknown Stealer botnet C2 domain (confidence level: 100%)
c.testcs888.comCobalt Strike botnet C2 domain (confidence level: 75%)
c2.moustartline.comCobalt Strike botnet C2 domain (confidence level: 75%)
update.applefilesync.comUnknown malware botnet C2 domain (confidence level: 100%)
mathiasputzola.comUnknown malware botnet C2 domain (confidence level: 100%)
tax-warrior.gl.at.ply.ggAsyncRAT botnet C2 domain (confidence level: 50%)
us.worldisendmail.mlCobalt Strike botnet C2 domain (confidence level: 50%)

URLs 11

https://foepsa.com/shield.msiUnknown malware payload delivery URL (confidence level: 100%)
http://45.141.233.187/38a5d6b24dac26be.phpStealc botnet C2 (confidence level: 50%)
https://pastebin.com/raw/0vnvsaurAsyncRAT botnet C2 (confidence level: 50%)
https://pastebin.com/raw/fxnwdeqaAsyncRAT botnet C2 (confidence level: 50%)
https://onedrive.live.com/download?cid=0b476d68a3403083&resid=b476d68a3403083%21227&authkey=abk0a0lwlokyhoyUnknown Loader payload delivery URL (confidence level: 50%)
http://404830cm.nyashvibe.ru/external_secureprocessprocessordle.phpDCRat botnet C2 (confidence level: 100%)
https://api.micosoftr.icu/djiowejdfCobalt Strike botnet C2 (confidence level: 100%)
https://www.googleapi.top/jquery-3.3.1.min.jsCobalt Strike botnet C2 (confidence level: 100%)
https://app.symphoniabags.com/ajaxactionFAKEUPDATES botnet C2 (confidence level: 100%)
https://0.0.mastermaths.com.sg/Vidar botnet C2 (confidence level: 100%)

IP addresses 152

8.137.98.198Cobalt Strike botnet C2 server (confidence level: 100%)
45.141.233.66Cobalt Strike botnet C2 server (confidence level: 100%)
45.141.233.66Cobalt Strike botnet C2 server (confidence level: 100%)
74.119.193.204Cobalt Strike botnet C2 server (confidence level: 100%)
78.187.29.22DarkComet botnet C2 server (confidence level: 100%)
147.135.215.25Remcos botnet C2 server (confidence level: 100%)
62.60.226.198Remcos botnet C2 server (confidence level: 100%)
118.195.137.135Unknown malware botnet C2 server (confidence level: 100%)
196.251.71.166AsyncRAT botnet C2 server (confidence level: 100%)
18.183.72.243AsyncRAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-06-20

Impact

For European organizations, the impact of this malware threat could manifest primarily through network-based payload delivery mechanisms, potentially leading to unauthorized access, data exfiltration, or disruption of services. Since the threat is categorized under OSINT and network activity, attackers may leverage publicly available information to tailor attacks, increasing the likelihood of successful social engineering or spear-phishing campaigns. The absence of known exploits suggests that the malware may rely on user interaction or network vulnerabilities not yet publicly disclosed. European entities with significant digital infrastructure, especially those involved in critical sectors such as finance, energy, and government, could face risks of operational disruption or data breaches. The medium severity rating indicates that while the threat is not currently critical, it warrants attention due to its potential to evolve or be combined with other attack vectors. The lack of patches means organizations cannot rely on traditional vulnerability management and must focus on detection and prevention strategies. Additionally, the OSINT nature of the threat implies that attackers may gather intelligence on European targets to enhance attack precision, increasing the risk of targeted campaigns. The impact on confidentiality, integrity, and availability depends on the payload delivered, which is unspecified, but the network activity tag suggests possible lateral movement or command and control communications that could compromise internal networks.

Defensive guidance

Given the absence of specific patches or known exploits, European organizations should adopt a multi-layered defense strategy focusing on detection, prevention, and response. Practical measures include: 1) Enhancing network monitoring to detect unusual payload delivery or network activity patterns, leveraging advanced threat detection tools capable of analyzing traffic for anomalies and known malware signatures. 2) Implementing strict email and web filtering policies to reduce the risk of malware delivery via phishing or drive-by downloads, including sandboxing of suspicious attachments and URLs. 3) Conducting regular OSINT monitoring to identify emerging indicators related to this threat and updating detection rules accordingly. 4) Strengthening endpoint protection with behavior-based detection to identify malicious payload execution even in the absence of known signatures. 5) Enforcing user awareness training focused on recognizing social engineering tactics that may be used to deliver the payload. 6) Segmenting networks to limit lateral movement in case of infection and ensuring robust incident response plans are in place to quickly contain and remediate infections. 7) Collaborating with threat intelligence sharing platforms to receive timely updates and IOCs as they become available. These steps go beyond generic advice by emphasizing OSINT-driven monitoring and behavior-based detection tailored to the nature of this threat.

Community reviews

Loading reviews…