IndicatorPublished 27 Jun 2025Updated 28 Jun 2025

type osint · ThreatFox IOCs for 2025-06-27

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 96

analyticznodec.comUnknown malware payload delivery domain (confidence level: 100%)
security.frarenguaced.comUnknown malware payload delivery domain (confidence level: 100%)
kapefex.comUnknown malware payload delivery domain (confidence level: 100%)
jobs.qtelcloud.comCobalt Strike botnet C2 domain (confidence level: 75%)
212-83-148-39.rev.poneytelecom.euUnknown malware botnet C2 domain (confidence level: 100%)
chat.svc.picsCobalt Strike botnet C2 domain (confidence level: 50%)
acc3nturefederal.comDarkComet botnet C2 domain (confidence level: 50%)
www.-dealt.sbFormbook botnet C2 domain (confidence level: 50%)
www.10s4life.comFormbook botnet C2 domain (confidence level: 50%)
www.65way.comFormbook botnet C2 domain (confidence level: 50%)

URLs 91

https://kapefex.com/shield.msiUnknown malware payload delivery URL (confidence level: 100%)
http://5.182.39.168/RecordBreaker botnet C2 (confidence level: 100%)
http://45.76.61.214/Hook botnet C2 (confidence level: 50%)
http://www.10s4life.com/hx344/Formbook botnet C2 (confidence level: 50%)
http://www.65way.com/hx344/Formbook botnet C2 (confidence level: 50%)
http://www.6n8c.com/hx344/Formbook botnet C2 (confidence level: 50%)
http://www.a88a888.com/hx344/Formbook botnet C2 (confidence level: 50%)
http://www.afromystique.com/hx344/Formbook botnet C2 (confidence level: 50%)
http://www.alluklifeinsurancesok.live/hx344/Formbook botnet C2 (confidence level: 50%)
http://www.artbymarigold.com/hx344/Formbook botnet C2 (confidence level: 50%)

IP addresses 176

66.63.187.190Rhadamanthys botnet C2 server (confidence level: 100%)
185.163.45.30NetSupportManager RAT botnet C2 server (confidence level: 100%)
157.230.218.246Cobalt Strike botnet C2 server (confidence level: 100%)
117.72.102.110Cobalt Strike botnet C2 server (confidence level: 100%)
101.201.83.222Unknown malware botnet C2 server (confidence level: 100%)
16.171.61.189AsyncRAT botnet C2 server (confidence level: 100%)
128.90.106.191AsyncRAT botnet C2 server (confidence level: 100%)
91.242.229.83Unknown malware botnet C2 server (confidence level: 100%)
34.176.213.31Unknown malware botnet C2 server (confidence level: 100%)
67.205.141.81Unknown malware botnet C2 server (confidence level: 100%)

Hashes 1

BKA Trojaner payload (confidence level: 50%)

869f22d468ec657048d8c963d0c379fe

Description

ThreatFox IOCs for 2025-06-27

Impact

For European organizations, the impact of this threat is currently assessed as moderate due to the medium severity rating and the nature of the threat involving network activity and payload delivery. If exploited, such malware could lead to unauthorized access, data exfiltration, or disruption of services. However, the absence of known exploits in the wild and lack of detailed indicators suggest that immediate risk is limited. European entities that rely heavily on networked infrastructure and have exposure to OSINT-related attack vectors could be at risk if the threat evolves or if attackers leverage these IOCs in targeted campaigns. The potential impact includes compromise of confidentiality through data leakage, integrity through unauthorized modifications, and availability if payloads disrupt services. Given the lack of patches and specific affected versions, organizations may face challenges in applying direct fixes, emphasizing the importance of proactive detection and network defense measures.

Defensive guidance

Given the limited technical details and absence of patches, European organizations should focus on enhancing network monitoring and threat detection capabilities to identify suspicious network activity and payload delivery attempts. Implementing advanced intrusion detection and prevention systems (IDS/IPS) with updated threat intelligence feeds, including the latest IOCs from ThreatFox and MISP, is critical. Network segmentation can limit lateral movement if an infection occurs. Organizations should also conduct regular threat hunting exercises using available OSINT and network activity indicators to detect early signs of compromise. Employee awareness training on phishing and social engineering, common delivery methods for malware, remains essential. Since no patches are available, maintaining up-to-date endpoint protection solutions and applying general security best practices, such as least privilege access and multi-factor authentication, will help reduce attack surface and potential impact.

Community reviews

Loading reviews…