IndicatorPublished 1 Jul 2025Updated 2 Jul 2025

type osint · ThreatFox IOCs for 2025-07-01

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 68

web-rabby.orgUnknown malware botnet C2 domain (confidence level: 100%)
security.fsealengurrad.comUnknown malware payload delivery domain (confidence level: 100%)
poqers.comUnknown malware payload delivery domain (confidence level: 100%)
accounts.podform.siteUnknown malware botnet C2 domain (confidence level: 100%)
360sec-dns.comCobalt Strike botnet C2 domain (confidence level: 75%)
susni-swap.netUnknown malware botnet C2 domain (confidence level: 75%)
dexsceerner.orgUnknown malware botnet C2 domain (confidence level: 75%)
play.rubyhall.in.netUnknown malware botnet C2 domain (confidence level: 100%)
win2officialgray.winUnknown malware botnet C2 domain (confidence level: 100%)
along-rid.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)

URLs 11

http://66.63.187.70/pages/login.phpUnknown malware botnet C2 (confidence level: 50%)
https://pastebin.com/raw/ufpdhea9AsyncRAT botnet C2 (confidence level: 50%)
http://172.86.75.38/e5b309d293924536.phpStealc botnet C2 (confidence level: 100%)
http://ct83204.tw1.ru/3bce0858.phpDCRat botnet C2 (confidence level: 100%)
https://0.x.exifit.eu.orgVidar botnet C2 (confidence level: 75%)
https://cpanel.thekooljack.com/viewdashboardFAKEUPDATES botnet C2 (confidence level: 100%)
https://bibigigatrols.com/work/Latrodectus botnet C2 (confidence level: 75%)
https://larioiokolid.com/work/Latrodectus botnet C2 (confidence level: 75%)
https://shop.aeroboutiquepanama.com/selectra_planilla/sistemax.phpUnknown Stealer botnet C2 (confidence level: 100%)
http://a1120527.xsph.ru/l1nc0in.phpDCRat botnet C2 (confidence level: 100%)

IP addresses 180

27.17.150.148Cobalt Strike botnet C2 server (confidence level: 100%)
66.63.162.161Cobalt Strike botnet C2 server (confidence level: 100%)
43.139.11.123Cobalt Strike botnet C2 server (confidence level: 100%)
196.251.117.230Remcos botnet C2 server (confidence level: 100%)
77.83.207.163Remcos botnet C2 server (confidence level: 100%)
35.170.185.100Sliver botnet C2 server (confidence level: 100%)
49.113.78.135Unknown malware botnet C2 server (confidence level: 100%)
196.251.115.156AsyncRAT botnet C2 server (confidence level: 100%)
172.111.150.118AsyncRAT botnet C2 server (confidence level: 100%)
128.90.113.179AsyncRAT botnet C2 server (confidence level: 100%)

Hashes 13

14f6a3a80b44d687c589dbd428a0599b4c04ce5c0f796345cbfba23697667b1aStealc payload (confidence level: 100%)
325d05c3c2895ddf394ff109ac7622b286f56b1383d39904f3a6739ec9b2e4a8Stealc payload (confidence level: 100%)
829df7d978774486998cd130487396654c4486536e37ee0ad92c5b355f27e10dStealc payload (confidence level: 100%)
87192f75948a2407cfd3b126c3f13a0dbe4eb5579ce4683b1e2a007b17ccfc9aStealc payload (confidence level: 100%)
56233bac07f4f9c43585e485e70b6169Unknown malware payload (confidence level: 50%)
a523bf5dca0f2a4ace0cf766d9225343Unknown malware payload (confidence level: 50%)
ad6104a503b46bf6ea505fe8b3182970Unknown malware payload (confidence level: 50%)
bf795a376233032d05766a396b3d6e08Unknown malware payload (confidence level: 50%)
fc6ac85fc9367c51b678fe77ad2d94d3AMOS payload (confidence level: 100%)
6d55dda53e21bee4d6a005d2a886a0c1AMOS payload (confidence level: 100%)

Description

ThreatFox IOCs for 2025-07-01

Impact

For European organizations, the impact of this threat is currently moderate due to the lack of known exploits and specific affected systems. However, the presence of network activity and payload delivery components indicates a risk of unauthorized data collection or initial compromise attempts. If leveraged effectively by threat actors, this could lead to data breaches, espionage, or foothold establishment within networks. European entities with significant digital infrastructure, especially those in critical sectors such as finance, energy, and government, could face increased risk if the threat evolves. The absence of patches or mitigations means organizations must rely on detection and prevention strategies. The medium severity suggests that while immediate disruption or damage is unlikely, the threat could be part of a broader attack campaign or reconnaissance phase preceding more severe attacks. Therefore, vigilance and proactive monitoring are essential to mitigate potential impacts on confidentiality, integrity, and availability of systems.

Defensive guidance

Given the nature of this threat, European organizations should implement enhanced network monitoring to detect unusual network activity indicative of reconnaissance or payload delivery attempts. Deploying advanced threat detection tools that leverage behavioral analytics and threat intelligence feeds, including the ThreatFox IOCs once available, will improve early detection capabilities. Network segmentation and strict access controls can limit lateral movement if initial compromise occurs. Regularly updating and tuning intrusion detection/prevention systems (IDS/IPS) to recognize emerging patterns associated with this threat is critical. Organizations should also conduct threat hunting exercises focused on OSINT-related indicators and suspicious payload delivery mechanisms. Employee awareness training on phishing and social engineering can reduce the risk of initial infection vectors. Since no patches are available, reliance on layered security controls, including endpoint detection and response (EDR) solutions, firewalls, and network anomaly detection, is vital. Collaboration with national cybersecurity centers and sharing threat intelligence within industry sectors can enhance collective defense.

Community reviews

Loading reviews…