IndicatorPublished 21 Jun 2025Updated 22 Jun 2025

type osint · ThreatFox IOCs for 2025-06-21

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 28

security.fpwergwavrd.comUnknown malware payload delivery domain (confidence level: 100%)
posugxa.comUnknown malware payload delivery domain (confidence level: 100%)
microsoftcdnlicense.putinswin.esUnknown RAT botnet C2 domain (confidence level: 100%)
dd.tstcs888.comCobalt Strike botnet C2 domain (confidence level: 75%)
172.91.188.35.bc.googleusercontent.comUnknown malware botnet C2 domain (confidence level: 100%)
120.32.198.104.bc.googleusercontent.comUnknown malware botnet C2 domain (confidence level: 100%)
ec2-54-250-175-201.ap-northeast-1.compute.amazonaws.comCobalt Strike botnet C2 domain (confidence level: 100%)
webapi.360se.dpdns.orgCobalt Strike botnet C2 domain (confidence level: 75%)
anyukov-43802.portmap.ioQuasar RAT botnet C2 domain (confidence level: 100%)
return-aug.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)

URLs 2

http://somanydomain.anondns.netMirai payload delivery URL (confidence level: 100%)
https://posugxa.com/shield.msiUnknown malware payload delivery URL (confidence level: 100%)

IP addresses 134

83.229.87.221Mirai botnet C2 server (confidence level: 100%)
185.64.106.73BazarBackdoor botnet C2 server (confidence level: 100%)
38.54.15.75Mirai botnet C2 server (confidence level: 100%)
38.54.15.75Mirai botnet C2 server (confidence level: 100%)
195.2.78.159Mirai botnet C2 server (confidence level: 100%)
8.137.98.198Cobalt Strike botnet C2 server (confidence level: 100%)
47.101.187.219Cobalt Strike botnet C2 server (confidence level: 100%)
142.54.190.74Cobalt Strike botnet C2 server (confidence level: 100%)
177.255.89.100Remcos botnet C2 server (confidence level: 100%)
82.205.83.111AsyncRAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-06-21

Impact

For European organizations, the impact of this threat could manifest primarily through increased exposure to malware infections initiated via network-based payload delivery methods informed by OSINT reconnaissance. Given the generic nature of the threat and absence of specific targeted vulnerabilities, the risk is more aligned with opportunistic attacks rather than highly targeted intrusions. Potential impacts include unauthorized access, data exfiltration, disruption of network services, and compromise of endpoint integrity. Organizations with extensive network exposure, especially those relying on open-source intelligence for operational purposes or those with less mature network monitoring capabilities, may face elevated risks. The medium severity suggests that while the threat is not immediately critical, it could serve as a precursor to more advanced attacks if left unmitigated. The lack of patches or known exploits indicates that traditional patch management will not mitigate this threat, emphasizing the need for proactive detection and network defense strategies.

Defensive guidance

1. Enhance network monitoring to detect anomalous payload delivery patterns and suspicious OSINT-related reconnaissance activities, leveraging behavioral analytics rather than relying solely on signature-based detection. 2. Implement strict network segmentation to limit the lateral movement potential of any malware introduced via network payloads. 3. Employ threat intelligence sharing platforms to stay updated on emerging IOCs related to this threat as they become available, enabling timely detection and response. 4. Conduct regular employee training focused on recognizing social engineering and phishing attempts that may serve as initial infection vectors, especially those leveraging OSINT-derived information. 5. Utilize advanced endpoint detection and response (EDR) solutions capable of identifying and isolating suspicious payload execution. 6. Review and harden firewall and intrusion detection/prevention system (IDS/IPS) configurations to block known malicious network traffic patterns associated with payload delivery. 7. Since no patches are available, prioritize incident response readiness and establish clear procedures for containment and eradication upon detection of related activity.

Community reviews

Loading reviews…