IndicatorPublished 29 Jun 2025Updated 30 Jun 2025

type osint · ThreatFox IOCs for 2025-06-29

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 28

abtsi.comUnknown malware payload delivery domain (confidence level: 100%)
leexsirzz.safepanel.my.idHavoc botnet C2 domain (confidence level: 100%)
hcyp.shebeib.comCobalt Strike botnet C2 domain (confidence level: 100%)
hcypapiprod.shebeib.comCobalt Strike botnet C2 domain (confidence level: 100%)
jiuweida.comCobalt Strike botnet C2 domain (confidence level: 100%)
static.login.microsoftonline.1ms.zipUnknown malware botnet C2 domain (confidence level: 100%)
login.1ms.zipUnknown malware botnet C2 domain (confidence level: 100%)
entoiz.comUnknown malware payload delivery domain (confidence level: 100%)
yourself-snowboard.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
rockstar.dnsframe.comXWorm botnet C2 domain (confidence level: 100%)

URLs 17

http://124.221.175.251/11.shUnknown malware payload delivery URL (confidence level: 100%)
http://124.221.175.251/start.shUnknown malware payload delivery URL (confidence level: 100%)
https://abtsi.com/4c2v.jsUnknown malware payload delivery URL (confidence level: 100%)
http://ct75800.tw1.ru/24e1bab6.phpDCRat botnet C2 (confidence level: 100%)
https://t.me/onepepkaLumma Stealer botnet C2 (confidence level: 75%)
https://unlfee.xyz/raosLumma Stealer botnet C2 (confidence level: 75%)
https://renoex.top/lzakLumma Stealer botnet C2 (confidence level: 100%)
https://lighri.top/xkjaLumma Stealer botnet C2 (confidence level: 100%)
https://abtsi.com/js.phpUnknown malware payload delivery URL (confidence level: 100%)
https://thicpl.lat/xpakLumma Stealer botnet C2 (confidence level: 75%)

IP addresses 132

124.221.175.251Unknown malware payload delivery server (confidence level: 100%)
31.43.185.30Amadey botnet C2 server (confidence level: 50%)
147.45.124.47Cobalt Strike botnet C2 server (confidence level: 100%)
47.122.1.243Cobalt Strike botnet C2 server (confidence level: 100%)
107.175.76.49Cobalt Strike botnet C2 server (confidence level: 100%)
172.94.9.231Remcos botnet C2 server (confidence level: 100%)
196.251.84.103Remcos botnet C2 server (confidence level: 100%)
91.92.120.109Remcos botnet C2 server (confidence level: 100%)
5.255.115.140Sliver botnet C2 server (confidence level: 100%)
146.56.216.152Unknown malware botnet C2 server (confidence level: 100%)

Hashes 5

30c74ff0e03d41dcf43257fe54467a02Akira payload (confidence level: 50%)
a9b65e5f48e5a03080aa2599d2f43c05Akira payload (confidence level: 50%)
b58814c0d3e05a164e26674647f331d5Akira payload (confidence level: 50%)
b9ab530d16e94ead2c87e3db86b0f1b2ba5323417e0dcfd1b4f147b67ff8a8ecAsyncRAT payload (confidence level: 100%)
893e25a855b3e64be7411b460f87d2825405783afbf9edd553f3f09b910cbc04Unknown Stealer payload (confidence level: 100%)

Description

ThreatFox IOCs for 2025-06-29

Impact

For European organizations, the impact of this threat is currently limited due to the lack of concrete exploit details or active attacks. The medium severity suggests a potential for payload delivery and network activity that could lead to unauthorized access or data exfiltration if exploited. However, without specific affected products or vulnerabilities, the immediate risk remains low. Organizations relying heavily on OSINT feeds for threat detection may benefit from integrating these IOCs into their monitoring systems to enhance situational awareness. The threat could potentially evolve, and early awareness allows for proactive defense measures. The absence of known exploits and patches indicates that this threat is not currently causing widespread harm but should be monitored for future developments.

Defensive guidance

Given the limited technical details, mitigation should focus on enhancing general network and endpoint security posture. European organizations should: 1) Integrate the provided IOCs into their Security Information and Event Management (SIEM) and threat intelligence platforms to enable detection of related activity. 2) Maintain robust network segmentation and monitoring to detect unusual payload delivery or network traffic patterns. 3) Employ strict access controls and multi-factor authentication to limit the impact of potential payload execution. 4) Conduct regular threat hunting exercises focusing on OSINT-derived indicators and anomalous network behaviors. 5) Keep all systems and security tools updated to defend against emerging threats. 6) Collaborate with information sharing groups to receive timely updates on any evolution of this threat. These steps go beyond generic advice by emphasizing proactive integration of threat intelligence and active monitoring tailored to OSINT-related malware activity.

Community reviews

Loading reviews…