IndicatorPublished 26 Jun 2025Updated 27 Jun 2025

type osint · ThreatFox IOCs for 2025-06-26

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 174

security.fgewrgoald.comUnknown malware payload delivery domain (confidence level: 100%)
kerewz.comUnknown malware payload delivery domain (confidence level: 100%)
dev-testprvpgfextext2bdc1c5-pg1.postgres.database.azure.comHook botnet C2 domain (confidence level: 100%)
mythic.mustansirg.inUnknown malware botnet C2 domain (confidence level: 100%)
pub-0d6190b2679343a7816c69b4460b0c0c.r2.devUnknown RAT payload delivery domain (confidence level: 50%)
pub-dd31af7a3b8d488ea6d842df5958ec46.r2.devUnknown RAT payload delivery domain (confidence level: 50%)
pub-24faabfae89041cda3b7cdd7318e9acb.r2.devUnknown RAT payload delivery domain (confidence level: 50%)
2025.ip138.comGhost RAT botnet C2 domain (confidence level: 100%)
11.c.mastermaths.com.sgVidar botnet C2 domain (confidence level: 100%)
112.ip-37-59-108.euHavoc botnet C2 domain (confidence level: 100%)

URLs 125

https://kerewz.com/shield.msiUnknown malware payload delivery URL (confidence level: 100%)
https://reallr.shop/taoxLumma Stealer botnet C2 (confidence level: 100%)
https://castcp.lat/axiwLumma Stealer botnet C2 (confidence level: 100%)
https://silvyg.xyz/bybiLumma Stealer botnet C2 (confidence level: 100%)
https://b1.encountergulf.world/ujs/ACR Stealer botnet C2 (confidence level: 100%)
https://b1.encountergulf.world/upACR Stealer botnet C2 (confidence level: 100%)
https://b1.encountergulf.world/up/bACR Stealer botnet C2 (confidence level: 100%)
https://b1.encountergulf.world/up/gACR Stealer botnet C2 (confidence level: 100%)
https://b1.encountergulf.world/up/fACR Stealer botnet C2 (confidence level: 100%)
http://46.175.147.105/05e05895631848b8.phpStealc botnet C2 (confidence level: 100%)

IP addresses 226

176.126.85.26Cobalt Strike botnet C2 server (confidence level: 100%)
121.41.91.64Cobalt Strike botnet C2 server (confidence level: 100%)
121.36.73.30Cobalt Strike botnet C2 server (confidence level: 100%)
45.88.186.161Remcos botnet C2 server (confidence level: 100%)
94.72.109.180Remcos botnet C2 server (confidence level: 100%)
104.243.254.99Remcos botnet C2 server (confidence level: 100%)
144.172.114.220Sliver botnet C2 server (confidence level: 100%)
140.238.178.68Sliver botnet C2 server (confidence level: 100%)
213.139.50.179Sliver botnet C2 server (confidence level: 100%)
140.238.178.68Sliver botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-06-26

Impact

For European organizations, the impact of this threat is currently ambiguous due to the lack of detailed technical information and specific targeting data. However, malware involving payload delivery and network activity can lead to unauthorized access, data exfiltration, disruption of services, or further compromise of internal systems. The medium severity rating suggests that while the threat is not currently critical, it could pose risks to confidentiality, integrity, and availability if exploited. Organizations relying on OSINT tools or those with network exposure could be at risk, especially if the malware leverages common network protocols or vulnerabilities. The absence of known exploits in the wild and patches indicates that the threat might be emerging or under observation, but European entities should remain vigilant given the potential for rapid evolution or targeted campaigns.

Defensive guidance

Given the limited information, European organizations should adopt a proactive and layered defense approach. Specific recommendations include: 1) Enhance network monitoring to detect unusual payload delivery or network activity patterns, leveraging advanced threat detection tools capable of analyzing OSINT-related traffic. 2) Implement strict segmentation and access controls to limit the spread of malware if initial compromise occurs. 3) Regularly update and audit OSINT tools and related software to ensure they are secure and not susceptible to exploitation. 4) Conduct threat hunting exercises focusing on indicators related to payload delivery and network anomalies, even if no explicit IOCs are currently available. 5) Educate security teams on emerging OSINT-related threats and encourage sharing of threat intelligence within trusted communities to improve situational awareness. 6) Prepare incident response plans that include scenarios involving malware payload delivery via network vectors, ensuring rapid containment and remediation capabilities.

Community reviews

Loading reviews…