IndicatorPublished 24 Jun 2025Updated 25 Jun 2025

type osint · ThreatFox IOCs for 2025-06-24

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 43

webdatacache.comFAKEUPDATES payload delivery domain (confidence level: 100%)
devindicator.devKongTuke payload delivery domain (confidence level: 100%)
security.fhqreagurard.comUnknown malware payload delivery domain (confidence level: 100%)
dovlica.comUnknown malware payload delivery domain (confidence level: 100%)
ecs-1-94-41-160.compute.hwclouds-dns.comCobalt Strike botnet C2 domain (confidence level: 100%)
imap.dkairsystems.comCobalt Strike botnet C2 domain (confidence level: 100%)
arni110.painhealingcenter.comCobalt Strike botnet C2 domain (confidence level: 100%)
ec2-100-25-215-41.compute-1.amazonaws.comUnknown malware botnet C2 domain (confidence level: 100%)
eyeagreement.infoUnknown Loader botnet C2 domain (confidence level: 100%)
rem.aaahorneswll.comRemcos botnet C2 domain (confidence level: 100%)

URLs 17

http://95.164.53.45/api/ytasodysodisowqsytesodgsotasotusnjusn2qsSmartLoader botnet C2 (confidence level: 75%)
http://77.105.164.178/api/ytasodysodisowqsytesodgsotasotusnjusn2qsSmartLoader botnet C2 (confidence level: 75%)
https://swedrent.com/3c7b.jsKongTuke payload delivery URL (confidence level: 100%)
https://swedrent.com/js.phpKongTuke payload delivery URL (confidence level: 100%)
https://devindicator.dev/webgl.wavKongTuke payload delivery URL (confidence level: 100%)
https://jswebcloud.com/sync.adv.min.jsFAKEUPDATES payload delivery URL (confidence level: 100%)
https://leatherbook.org/sr0ymlwkoocyizuxcrfr3hwgupyipamxa-glcdabjewFAKEUPDATES payload delivery URL (confidence level: 100%)
http://185.157.213.40/ver/0622/dat1/dtbeuj.pdfPureCrypter botnet C2 (confidence level: 75%)
http://195.82.146.92/23be681439654a60.phpStealc botnet C2 (confidence level: 100%)
https://dovlica.com/shield.msiUnknown malware payload delivery URL (confidence level: 100%)

IP addresses 145

195.82.146.92Stealc botnet C2 server (confidence level: 100%)
77.232.41.51Mirai botnet C2 server (confidence level: 100%)
77.232.41.51Mirai botnet C2 server (confidence level: 100%)
194.68.225.195Mirai botnet C2 server (confidence level: 100%)
77.232.41.51Mirai botnet C2 server (confidence level: 100%)
31.59.185.111Cobalt Strike botnet C2 server (confidence level: 100%)
115.190.74.103Cobalt Strike botnet C2 server (confidence level: 100%)
62.234.153.73Cobalt Strike botnet C2 server (confidence level: 100%)
47.102.209.177Cobalt Strike botnet C2 server (confidence level: 100%)
113.45.148.46Cobalt Strike botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-06-24

Impact

For European organizations, the impact of this threat is currently limited but should not be underestimated. Since the threat involves OSINT and network activity related to payload delivery, it could be used as a precursor to more targeted attacks such as phishing, malware deployment, or lateral movement within networks. Organizations relying heavily on open-source intelligence for decision-making or those with extensive network exposure could be at risk of reconnaissance and subsequent exploitation attempts. The absence of known exploits and patches means that the threat is likely in an early stage, but the medium severity rating indicates potential for escalation. If leveraged effectively by threat actors, this could lead to confidentiality breaches, integrity compromises, or availability disruptions, especially if payload delivery results in malware infections. European entities in sectors with high network interconnectivity or those targeted by advanced persistent threats (APTs) should remain vigilant. The lack of specific IOCs limits immediate detection capabilities, increasing the risk of undetected reconnaissance and initial compromise.

Defensive guidance

Given the nature of this threat, European organizations should adopt a proactive and layered defense approach beyond generic advice. Specific recommendations include: 1) Enhance network monitoring to detect unusual outbound or inbound traffic patterns that may indicate OSINT-driven reconnaissance or payload delivery attempts. 2) Implement strict segmentation and micro-segmentation to limit lateral movement if initial compromise occurs. 3) Employ threat intelligence sharing platforms to rapidly update and disseminate any emerging IOCs related to this threat. 4) Conduct regular employee training focused on recognizing social engineering and phishing attempts that may be facilitated by OSINT activities. 5) Utilize advanced endpoint detection and response (EDR) tools capable of identifying anomalous payload delivery behaviors. 6) Harden external-facing services and minimize exposed attack surfaces to reduce the effectiveness of network-based reconnaissance. 7) Regularly review and update incident response plans to incorporate scenarios involving OSINT-enabled payload delivery. These targeted measures will help mitigate the risk posed by this evolving threat vector.

Community reviews

Loading reviews…