IndicatorPublished 23 Jun 2025Updated 24 Jun 2025

type osint · ThreatFox IOCs for 2025-06-23

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 30

app2.symphoniabags.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
photo.suziestuder.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
static.161.152.69.159.clients.your-server.deHavoc botnet C2 domain (confidence level: 100%)
onmolatori.icuUnknown RAT botnet C2 domain (confidence level: 100%)
security.flinaregaozrd.comUnknown malware payload delivery domain (confidence level: 100%)
faospe.comUnknown malware payload delivery domain (confidence level: 100%)
f3.xo.mastermaths.com.sgVidar botnet C2 domain (confidence level: 100%)
surfshark.pwUnknown Loader payload delivery domain (confidence level: 90%)
shallowrepurpose.topHavoc botnet C2 domain (confidence level: 100%)
search.2y3rn846.comCobalt Strike botnet C2 domain (confidence level: 75%)

URLs 17

https://app2.symphoniabags.com/FAKEUPDATES botnet C2 (confidence level: 100%)
https://photo.suziestuder.com/viewdashboardFAKEUPDATES botnet C2 (confidence level: 100%)
https://myinetverif.cloud/f5l.dofLumma Stealer payload delivery URL (confidence level: 50%)
https://fangvessel.icu/bin.phpUnknown Loader botnet C2 (confidence level: 100%)
https://faospe.com/shield.msiUnknown malware payload delivery URL (confidence level: 100%)
https://steamcommunity.com/profiles/76561199869630181Vidar botnet C2 (confidence level: 100%)
https://t.me/l07tpVidar botnet C2 (confidence level: 100%)
https://116.202.176.52/Vidar botnet C2 (confidence level: 100%)
https://f3.xo.mastermaths.com.sg/Vidar botnet C2 (confidence level: 100%)
http://185.156.72.89/nzcwzue/login.phpUnknown malware botnet C2 (confidence level: 100%)

IP addresses 143

23.27.134.21FAKEUPDATES botnet C2 server (confidence level: 100%)
77.110.115.191FAKEUPDATES botnet C2 server (confidence level: 100%)
39.105.169.190Cobalt Strike botnet C2 server (confidence level: 100%)
23.226.54.63Cobalt Strike botnet C2 server (confidence level: 100%)
43.162.114.79Sliver botnet C2 server (confidence level: 100%)
157.230.178.249Unknown malware botnet C2 server (confidence level: 100%)
34.61.138.114Unknown malware botnet C2 server (confidence level: 100%)
185.167.234.157Hook botnet C2 server (confidence level: 100%)
73.234.3.3Quasar RAT botnet C2 server (confidence level: 100%)
46.19.46.99Havoc botnet C2 server (confidence level: 100%)

Hashes 3

4575ddc65497f954a1c2d8c085b53a7dc6de1ed3e5a8817505cf595abd3f16a7Unknown malware payload (confidence level: 50%)
d821b01e64a0a34b786e282112039412130c78bf92c5ebf8bf6629c199673525Unknown malware payload (confidence level: 50%)
699cd1a833827a701c589ae0655bc9191fa39daff94d011ca5a1b62b0ce8a9f0Unknown malware payload (confidence level: 100%)

Description

ThreatFox IOCs for 2025-06-23

Impact

For European organizations, the impact of this threat is primarily indirect but significant in terms of enhancing situational awareness and improving detection capabilities. Since the threat entry does not describe a direct exploit or vulnerability but rather provides IOCs and intelligence related to malware payload delivery, its main value lies in enabling organizations to identify and mitigate potential malware infections early. Failure to incorporate such intelligence could lead to delayed detection of malware campaigns, increasing the risk of data breaches, operational disruptions, or lateral movement within networks. Given the medium severity rating and absence of known exploits, the immediate risk to confidentiality, integrity, and availability is moderate. However, organizations that do not leverage this intelligence may face higher exposure to evolving malware threats. The threat's focus on network activity and payload delivery suggests that organizations with extensive network infrastructure and internet-facing services are more susceptible to related attacks if they lack adequate monitoring and response capabilities.

Defensive guidance

1. Integrate the provided IOCs from the ThreatFox feed into existing Security Information and Event Management (SIEM) and Intrusion Detection/Prevention Systems (IDS/IPS) to enhance detection of related malware activity. 2. Regularly update threat intelligence platforms with feeds like ThreatFox to maintain current awareness of emerging malware payload delivery techniques. 3. Conduct network traffic analysis focusing on anomalous payload delivery patterns and suspicious network activity that align with the indicators provided. 4. Implement strict network segmentation and enforce least privilege principles to limit the potential spread of malware if payload delivery attempts succeed. 5. Train security operations teams to recognize and respond to the specific network behaviors and payload delivery methods highlighted by the intelligence. 6. Employ endpoint detection and response (EDR) solutions capable of identifying and mitigating malware payloads based on behavioral indicators. 7. Since no patches are available, emphasize proactive detection and containment rather than reliance on vulnerability remediation. 8. Collaborate with information sharing communities to exchange insights and validate the relevance of the IOCs within the European threat landscape.

Community reviews

Loading reviews…