IndicatorPublished 25 Jun 2025Updated 26 Jun 2025

type osint · ThreatFox IOCs for 2025-06-25

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 35

mctannask-waiiet.io-ex1.xyz/enUnknown malware botnet C2 domain (confidence level: 100%)
security.fjaregarads.comUnknown malware payload delivery domain (confidence level: 100%)
oswyka.comUnknown malware payload delivery domain (confidence level: 100%)
phamtom.com.op-v4.world/enUnknown malware botnet C2 domain (confidence level: 100%)
mujust.fenmila.meUnknown malware botnet C2 domain (confidence level: 100%)
huxpurak.xjslsd.comCobalt Strike botnet C2 domain (confidence level: 100%)
barniclespine.comCobalt Strike botnet C2 domain (confidence level: 100%)
www2.rubyhall.in.netUnknown malware botnet C2 domain (confidence level: 100%)
fls-na.rubyhall.in.netUnknown malware botnet C2 domain (confidence level: 100%)
ogs.accounts.rubyhall.in.netUnknown malware botnet C2 domain (confidence level: 100%)

URLs 11

https://oswyka.com/shield.msiUnknown malware payload delivery URL (confidence level: 100%)
http://anymeshes.pro/cUnknown Stealer botnet C2 (confidence level: 100%)
https://b1.cornmealjustly.lat/ujs/ACR Stealer botnet C2 (confidence level: 100%)
https://b1.cornmealjustly.lat/up/pACR Stealer botnet C2 (confidence level: 100%)
https://b1.cornmealjustly.lat/up/bACR Stealer botnet C2 (confidence level: 100%)
https://b1.cornmealjustly.lat/up/gACR Stealer botnet C2 (confidence level: 100%)
https://b1.cornmealjustly.lat/up/fACR Stealer botnet C2 (confidence level: 100%)
http://85.209.2.63/image_pollgametrack.phpDCRat botnet C2 (confidence level: 100%)
https://cpanel.productdevelopmentplan.com/viewdashboardFAKEUPDATES botnet C2 (confidence level: 100%)
https://www.sitesgpt.com/?em&serid=email_auth&sessionid=nmhvovtikbruddLatrodectus payload delivery URL (confidence level: 95%)

IP addresses 156

179.43.186.223Cobalt Strike botnet C2 server (confidence level: 100%)
185.241.208.247Cobalt Strike botnet C2 server (confidence level: 100%)
38.165.20.186Cobalt Strike botnet C2 server (confidence level: 100%)
43.248.128.103Ghost RAT botnet C2 server (confidence level: 100%)
185.125.50.72SectopRAT botnet C2 server (confidence level: 100%)
34.176.213.31Unknown malware botnet C2 server (confidence level: 100%)
43.205.192.238NetSupportManager RAT botnet C2 server (confidence level: 100%)
154.0.170.61Unknown malware botnet C2 server (confidence level: 100%)
103.171.35.150AdaptixC2 botnet C2 server (confidence level: 100%)
47.239.119.126ValleyRAT botnet C2 server (confidence level: 100%)

Hashes 45

b328ae69291cef117df2d3bfba83e2a2BianLian payload (confidence level: 50%)
4d0c2ba892fd166f6e9001b5adf61022BianLian payload (confidence level: 50%)
f3a04246ae21015bb91269c68690dbbcBianLian payload (confidence level: 50%)
1d9feae452cf392ca417d6f3617848bcBianLian payload (confidence level: 50%)
b77e3902bd93e320e01d8df1d3a858fbBianLian payload (confidence level: 50%)
a31e7d2550535d43cb8a27919734b23cBianLian payload (confidence level: 50%)
146229561a3746053f85aa8a11559eacBianLian payload (confidence level: 50%)
68d8a369cdf2e92c0f7ac2310f633b45BianLian payload (confidence level: 50%)
609554db75e2068d1e1d49b202ae92daBianLian payload (confidence level: 50%)
752a495b34b244acc86aba16b6353343BianLian payload (confidence level: 50%)

Description

ThreatFox IOCs for 2025-06-25

Impact

For European organizations, the primary impact of this threat lies in its potential to facilitate unauthorized network reconnaissance and subsequent payload delivery, which could lead to data breaches, espionage, or disruption of services. Given the OSINT and network activity categorization, attackers may leverage this threat to gather sensitive information about organizational infrastructure, employee details, or security posture. This intelligence can then be used to craft more sophisticated attacks such as spear-phishing, ransomware deployment, or supply chain compromises. The medium severity rating suggests that while immediate damage might be limited, the threat could significantly increase risk exposure if combined with other attack vectors. European entities with extensive digital footprints or those operating in critical infrastructure sectors may face heightened risks due to the strategic value of their data and services. Additionally, the lack of known exploits and patches means organizations must rely heavily on detection and prevention strategies rather than remediation post-compromise.

Defensive guidance

To mitigate this threat effectively, European organizations should implement advanced network monitoring solutions capable of detecting anomalous OSINT-related activities and unusual payload delivery attempts. Deploying behavioral analytics and threat hunting teams can help identify early indicators of reconnaissance and payload staging. Organizations should also enforce strict network segmentation to limit lateral movement in case of initial compromise. Employee training focused on recognizing social engineering and phishing attempts is critical, as payload delivery often leverages these vectors. Utilizing threat intelligence feeds, including ThreatFox, to update detection signatures and IOC databases will enhance proactive defense. Additionally, organizations should conduct regular external and internal penetration testing to identify and remediate potential reconnaissance opportunities. Implementing zero-trust network architectures and multi-factor authentication can further reduce the risk of unauthorized access stemming from OSINT-driven attacks.

Community reviews

Loading reviews…