IndicatorPublished 28 Jun 2025Updated 29 Jun 2025

type osint · ThreatFox IOCs for 2025-06-28

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 25

legacyshare.ioUnknown RAT botnet C2 domain (confidence level: 100%)
protocol.stakesolv.comUnknown malware botnet C2 domain (confidence level: 100%)
security.fpwereguared.comUnknown malware payload delivery domain (confidence level: 100%)
deopins.comUnknown malware payload delivery domain (confidence level: 100%)
c2.zerotr4ce.onlineHavoc botnet C2 domain (confidence level: 100%)
azelsan.com.trHavoc botnet C2 domain (confidence level: 100%)
hypixelproxy.gooning.shopMirai botnet C2 domain (confidence level: 100%)
federal-jewel.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
held-prozac.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
return-min.gl.at.ply.ggAsyncRAT botnet C2 domain (confidence level: 100%)

URLs 16

https://deopins.com/shield.msiUnknown malware payload delivery URL (confidence level: 100%)
https://plapwf.top/agnbLumma Stealer botnet C2 (confidence level: 75%)
http://109.69.58.22/javascriptjs_testtrackwp.phpDCRat botnet C2 (confidence level: 100%)
http://603646cm.nyashvibe.ru/linehttpcpuprocessorgameserverwindowswordpress.phpDCRat botnet C2 (confidence level: 100%)
http://185.156.72.89/tkwmdb/get.phpUnknown Stealer botnet C2 (confidence level: 100%)
http://freepcgamee.com/000770f6d40a/index.phpAmadey botnet C2 (confidence level: 100%)
https://producesound.xyz/yuts.phpUnknown Loader botnet C2 (confidence level: 100%)
https://sinkchildren.xyz/bin.phpUnknown Loader botnet C2 (confidence level: 100%)
https://arithmeticvest.icu/bin.phpUnknown Loader botnet C2 (confidence level: 100%)
https://giantstruck.icu/bin.phpUnknown Loader botnet C2 (confidence level: 100%)

IP addresses 126

179.43.139.126Cobalt Strike botnet C2 server (confidence level: 100%)
120.26.119.109Cobalt Strike botnet C2 server (confidence level: 100%)
139.185.52.242Cobalt Strike botnet C2 server (confidence level: 100%)
175.178.100.95Cobalt Strike botnet C2 server (confidence level: 100%)
39.106.72.191Cobalt Strike botnet C2 server (confidence level: 100%)
88.214.25.210Cobalt Strike botnet C2 server (confidence level: 100%)
198.12.83.91Remcos botnet C2 server (confidence level: 100%)
35.176.61.134Sliver botnet C2 server (confidence level: 100%)
172.81.132.171Sliver botnet C2 server (confidence level: 100%)
48.210.223.56Unknown malware botnet C2 server (confidence level: 100%)

Hashes 490

c3ce46d40b2893e30bf00fce72c2e1faUnknown malware payload (confidence level: 50%)
d1d5c234f3ea77aeae7b786c6ceb346e17e43e166c9c3eab550b408b7eb02adfAMOS payload (confidence level: 100%)
e49c443bf1167fa65bc8bc91cea45b9f1bff4384b54d5f3183666fce780ab9c5AMOS payload (confidence level: 100%)
27f467fc8458d0d39ab65335817f4fbb419e39886246efa0ce132b3a4d65382dAMOS payload (confidence level: 100%)
30c32592e665fdb7795a2a739ef14aa8c782186f774c1fecf0dddfd50f64416cAMOS payload (confidence level: 100%)
070f9c83a0a131cce3e0a8985742226e4fae016e7352c286630c983e51f4e520AMOS payload (confidence level: 100%)
e6d00da6f1a003b388a2e9a06f1d416f25bfa4910d47563eacd8d2fc3fe329a4AMOS payload (confidence level: 100%)
972c8f267417e0c2fec8604318ab7743361c9eb04d8494d826b68842306642f0AMOS payload (confidence level: 100%)
466b7300a47ef3190cb0daf0f3fc8cf6fb7b812aa746d6faf126d389d7239b18AMOS payload (confidence level: 100%)
da83e1c62301e3c03f0f9cce88a24172f0e4ae8b500b035a9e5131a09da73f57AMOS payload (confidence level: 100%)

Description

ThreatFox IOCs for 2025-06-28

Impact

For European organizations, the impact of this threat is currently limited due to the lack of detailed information and absence of known exploits in the wild. However, the categorization under payload delivery and network activity suggests potential risks of malware infiltration through network vectors, which could lead to data exfiltration, system compromise, or service disruption if exploited. Given the medium severity rating, organizations should remain vigilant, especially those with significant network exposure or those relying on OSINT feeds for threat detection. The lack of patches or specific affected versions means that defensive measures must focus on detection and prevention rather than remediation. European entities involved in critical infrastructure, finance, or government sectors could face elevated risks if this threat evolves or if related malware payloads are deployed targeting their networks.

Defensive guidance

1. Enhance network monitoring to detect unusual payload delivery patterns or suspicious network activity, leveraging advanced intrusion detection systems (IDS) and network traffic analysis tools. 2. Integrate and correlate OSINT threat intelligence feeds, including ThreatFox, into Security Information and Event Management (SIEM) systems to improve early detection capabilities. 3. Conduct regular threat hunting exercises focusing on network-based malware delivery mechanisms, even in the absence of specific IOCs. 4. Implement strict network segmentation and access controls to limit the lateral movement potential of any malware payloads. 5. Maintain up-to-date endpoint protection solutions capable of detecting and blocking unknown or emerging malware threats. 6. Educate security teams on interpreting and operationalizing OSINT feeds to enhance proactive defense measures. 7. Prepare incident response plans that include scenarios involving network-based payload delivery to ensure rapid containment and recovery.

Community reviews

Loading reviews…