IndicatorPublished 2 Jul 2025Updated 3 Jul 2025

type osint · ThreatFox IOCs for 2025-07-02

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 223

ecs-113-45-47-3.compute.hwclouds-dns.comCobalt Strike botnet C2 domain (confidence level: 100%)
m83-189-135-177.cust.tele2.seCobalt Strike botnet C2 domain (confidence level: 100%)
imagoatlowk-58420.portmap.ioXWorm botnet C2 domain (confidence level: 100%)
andre21.ydns.euXWorm botnet C2 domain (confidence level: 100%)
developer1.ydns.euXWorm botnet C2 domain (confidence level: 100%)
sheddinho1122.ddns.netRemcos botnet C2 domain (confidence level: 100%)
j3ru5al3m.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
tel-dv.gl.at.ply.ggDCRat botnet C2 domain (confidence level: 50%)
www.06.topFormbook botnet C2 domain (confidence level: 50%)
www.0z442.clickFormbook botnet C2 domain (confidence level: 50%)

URLs 178

http://cc18300.tw1.ru/4160b747.phpDCRat botnet C2 (confidence level: 100%)
https://impvmg.pics/xanjLumma Stealer botnet C2 (confidence level: 100%)
http://34.64.111.49:8080/Chaos botnet C2 (confidence level: 50%)
http://113.45.238.149:8888/supershell/loginUnknown malware botnet C2 (confidence level: 50%)
http://www.06.top/l36c/Formbook botnet C2 (confidence level: 50%)
http://www.0z442.click/ms14/Formbook botnet C2 (confidence level: 50%)
http://www.2zyo6w.top/l36c/Formbook botnet C2 (confidence level: 50%)
http://www.63bitcoin.info/ms14/Formbook botnet C2 (confidence level: 50%)
http://www.7o.top/ms14/Formbook botnet C2 (confidence level: 50%)
http://www.88.fan/ms14/Formbook botnet C2 (confidence level: 50%)

IP addresses 221

166.88.182.99FAKEUPDATES botnet C2 server (confidence level: 100%)
170.75.160.9Sliver botnet C2 server (confidence level: 100%)
104.168.76.142Sliver botnet C2 server (confidence level: 100%)
18.215.241.71Sliver botnet C2 server (confidence level: 100%)
139.84.210.208ShadowPad botnet C2 server (confidence level: 90%)
119.45.28.152Unknown malware botnet C2 server (confidence level: 100%)
202.55.135.163AsyncRAT botnet C2 server (confidence level: 100%)
128.90.113.160AsyncRAT botnet C2 server (confidence level: 100%)
196.251.69.34AsyncRAT botnet C2 server (confidence level: 100%)
50.18.107.175AsyncRAT botnet C2 server (confidence level: 100%)

Hashes 4

PureLogs Stealer payload (confidence level: 75%)

ab250bb831a9715a47610f89d0998f86
cec53e8df6c115eb7494c9ad7d2963d4
eedc8bb54465bd6720f28b41f7a2acf6
38d29f5ac47583f39a2ff5dc1c366f7d

Description

ThreatFox IOCs for 2025-07-02

Impact

For European organizations, this threat could pose risks primarily through network-based malware delivery mechanisms. Given the medium severity and the lack of known exploits, the immediate impact may be limited but could escalate if the threat actors develop more effective exploitation methods. Potential impacts include unauthorized access, data exfiltration, or disruption of services if the payloads are successfully delivered and executed. Organizations with extensive network exposure or those relying on OSINT for threat detection may be more vulnerable. The absence of patches means that mitigation relies heavily on detection and prevention controls. The threat could affect confidentiality, integrity, and availability depending on the payload's nature. European organizations in critical infrastructure, finance, and government sectors should be particularly vigilant due to the potential for targeted attacks leveraging OSINT-derived intelligence.

Defensive guidance

1. Enhance network monitoring to detect unusual payload delivery patterns, focusing on indicators of compromise related to network activity and OSINT-based reconnaissance. 2. Implement strict egress and ingress filtering to limit exposure to malicious payloads. 3. Employ advanced threat detection solutions that incorporate behavioral analysis to identify anomalous activities potentially linked to this threat. 4. Conduct regular threat intelligence updates and integrate ThreatFox and other OSINT feeds into security operations to improve early detection. 5. Train security teams on recognizing OSINT-related threat tactics and payload delivery methods. 6. Since no patches are available, prioritize segmentation and least privilege principles to minimize potential lateral movement if an infection occurs. 7. Maintain up-to-date endpoint protection and ensure rapid incident response capabilities to contain any detected infections promptly.

Summary

The provided information describes a security threat categorized as malware with a medium severity level, sourced from the ThreatFox MISP feed. The threat is associated with OSINT (Open Source Intelligence) and involves network activity and payload delivery. However, there are no specific affected product versions, no known exploits in the wild, and no patches available. The threat level is indicated as 2 on an unspecified scale, with moderate distribution (3) and minimal analysis (1). The lack of detailed technical indicators, such as specific malware behavior, attack vectors, or vulnerabilities exploited, limits the depth of technical understanding. The threat appears to be related to the delivery of malicious payloads via network activity, potentially leveraging OSINT techniques for reconnaissance or targeting. The absence of known exploits and patches suggests this may be an emerging or low-profile threat, or one primarily used for intelligence gathering rather than widespread exploitation. The TLP (Traffic Light Protocol) white tag indicates that the information is publicly shareable without restriction. Overall, this threat represents a medium-level malware risk involving network-based payload delivery, but with limited actionable technical details at this time.

Community reviews

Loading reviews…