IndicatorPublished 22 Jun 2025Updated 23 Jun 2025

type osint · ThreatFox IOCs for 2025-06-22

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 27

ns1.basicvitals.comBrute Ratel C4 botnet C2 domain (confidence level: 100%)
security.gyredoflzares.comUnknown malware payload delivery domain (confidence level: 100%)
gowqpaz.comUnknown malware payload delivery domain (confidence level: 100%)
test.manageenglne.comUnknown Loader payload delivery domain (confidence level: 90%)
ecs-113-44-139-80.compute.hwclouds-dns.comCobalt Strike botnet C2 domain (confidence level: 100%)
elgg.santutxuht.eusUnknown malware botnet C2 domain (confidence level: 100%)
www.dulcidora.com.brHavoc botnet C2 domain (confidence level: 100%)
justhk.saoken.meUnknown malware botnet C2 domain (confidence level: 100%)
trezor-io-start.typedream.appUnknown malware botnet C2 domain (confidence level: 100%)
regional-evaluate.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)

URLs 15

http://147.45.45.156:51000/challengeHavoc botnet C2 (confidence level: 100%)
http://147.45.45.156:51000/fetchHavoc botnet C2 (confidence level: 100%)
https://147.45.45.156/Havoc botnet C2 (confidence level: 100%)
https://147.45.45.156:51000/fetchHavoc botnet C2 (confidence level: 100%)
https://147.45.45.156:51000/challengeHavoc botnet C2 (confidence level: 100%)
https://gowqpaz.com/shield.msiUnknown malware payload delivery URL (confidence level: 100%)
https://vuelaviajero.com/wp-includes/images/belashrt.phpKoi Loader botnet C2 (confidence level: 100%)
https://www.vuelaviajero.com/wp-includes/images/belashrt.phpKoi Loader botnet C2 (confidence level: 100%)
https://vuelaviajero.com/wp-includes/images/berylinewh.phpKoi Loader botnet C2 (confidence level: 100%)
https://www.vuelaviajero.com/wp-includes/images/berylinewh.phpKoi Loader botnet C2 (confidence level: 100%)

IP addresses 105

147.45.45.156Havoc botnet C2 server (confidence level: 100%)
196.251.117.41Cobalt Strike botnet C2 server (confidence level: 100%)
157.230.218.246Cobalt Strike botnet C2 server (confidence level: 100%)
77.73.131.91SectopRAT botnet C2 server (confidence level: 100%)
154.61.80.43Hook botnet C2 server (confidence level: 100%)
185.72.199.116Quasar RAT botnet C2 server (confidence level: 100%)
179.113.39.3Venom RAT botnet C2 server (confidence level: 100%)
204.13.236.238Venom RAT botnet C2 server (confidence level: 100%)
102.46.109.60DCRat botnet C2 server (confidence level: 100%)
23.94.99.5DCRat botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-06-22

Impact

For European organizations, the impact of this threat could manifest primarily through the compromise of networked systems via payload delivery mechanisms informed by OSINT. This could lead to unauthorized access, data exfiltration, or disruption of services depending on the payload's nature. Given the medium severity and lack of known exploits, immediate widespread disruption is unlikely; however, targeted attacks could leverage this threat to gain footholds in critical infrastructure, corporate networks, or government systems. The use of OSINT suggests attackers may be tailoring payloads based on publicly available information about targets, increasing the risk for organizations with significant online exposure or those operating in sectors with high-value data. The absence of patches and the lack of detailed IOCs complicate detection and response efforts, potentially allowing attackers to operate undetected for longer periods. European entities with extensive networked environments and reliance on open-source intelligence for threat modeling should be particularly vigilant.

Defensive guidance

Given the limited technical details and absence of patches, mitigation should focus on enhancing network monitoring and threat detection capabilities. Organizations should implement advanced network traffic analysis tools capable of identifying anomalous payload delivery patterns, especially those informed by OSINT-derived tactics. Employing threat intelligence sharing platforms to gather updated IOCs and behavioral indicators related to this threat will improve situational awareness. Network segmentation and strict access controls can limit lateral movement if a payload is successfully delivered. Additionally, organizations should conduct regular OSINT assessments on their digital footprint to understand what information is publicly available that could be leveraged by attackers. Employee training on recognizing phishing or social engineering attempts tied to OSINT-derived campaigns will reduce the risk of initial compromise. Finally, deploying endpoint detection and response (EDR) solutions with heuristic and behavioral analysis can help identify and contain unknown malware variants associated with this threat.

Community reviews

Loading reviews…