IndicatorPublished 4 Jul 2025Updated 5 Jul 2025

type osint · ThreatFox IOCs for 2025-07-04

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 179

mobatek.proUnknown Loader payload delivery domain (confidence level: 90%)
nas.gddsw.topCobalt Strike botnet C2 domain (confidence level: 75%)
mer.b2b.9zt.hkUnknown malware botnet C2 domain (confidence level: 100%)
68.227.0.34.bc.googleusercontent.comUnknown malware botnet C2 domain (confidence level: 100%)
dsasinject-58214.portmap.ioXWorm botnet C2 domain (confidence level: 100%)
mailing-iv.gl.at.ply.ggAsyncRAT botnet C2 domain (confidence level: 100%)
pulsa2ndrdplogs.duckdns.orgQuasar RAT botnet C2 domain (confidence level: 75%)
pulsaratlogs.duckdns.orgQuasar RAT botnet C2 domain (confidence level: 75%)
myaccount.secured-authentication.ruHavoc botnet C2 domain (confidence level: 100%)
updatemsdnserver.comStrelaStealer botnet C2 domain (confidence level: 100%)

URLs 11

http://89.35.130.147:5810/3dc7f62e.phpDCRat botnet C2 (confidence level: 100%)
http://updatemsdnserver.com/server.phpStrelaStealer botnet C2 (confidence level: 100%)
https://1c.exifit.eu.orgVidar botnet C2 (confidence level: 75%)
https://drive.google.com/uc?export=download&id=1aqo6iwyu8fxe7qnee8mrzmluznvbdgioUnknown Loader payload delivery URL (confidence level: 50%)
http://regalscoin.co/admin/panel/five/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 50%)
http://clubdemadrespompiglos.com/sse/panelnew/gate.phpPony botnet C2 (confidence level: 50%)
https://xt.exifit.eu.orgVidar botnet C2 (confidence level: 75%)
https://boytheory.xyz/bin.phpUnknown Loader botnet C2 (confidence level: 100%)
http://sonplane.info/fki.phpUnknown Loader botnet C2 (confidence level: 100%)
https://feedback.bigsightsystems.com/viewdashboardFAKEUPDATES botnet C2 (confidence level: 100%)

IP addresses 200

83.229.120.98Cobalt Strike botnet C2 server (confidence level: 100%)
43.139.210.38Cobalt Strike botnet C2 server (confidence level: 100%)
104.207.138.98NjRAT botnet C2 server (confidence level: 100%)
60.204.245.37Cobalt Strike botnet C2 server (confidence level: 100%)
31.6.7.154Remcos botnet C2 server (confidence level: 100%)
91.92.46.250Remcos botnet C2 server (confidence level: 100%)
123.163.206.142Sliver botnet C2 server (confidence level: 100%)
128.90.106.224AsyncRAT botnet C2 server (confidence level: 100%)
84.200.77.140SectopRAT botnet C2 server (confidence level: 100%)
141.98.11.22SectopRAT botnet C2 server (confidence level: 100%)

Hashes 3

Nitrogen Loader payload (confidence level: 50%)

88826c773788a68300b0dd78a92af12a
e14d7baf640bfb479e186d0281a27179
a4b24c189f63204efd2b36ce5ab3aaaa

Description

ThreatFox IOCs for 2025-07-04

Impact

For European organizations, the impact of this threat is currently uncertain due to the lack of detailed technical information and absence of known active exploitation. However, given its classification as malware involving payload delivery and network activity, there is a potential risk to confidentiality, integrity, and availability of systems if the malware were to be deployed successfully. European organizations that rely heavily on networked infrastructure and open-source intelligence for operational or strategic purposes could be targeted for reconnaissance or payload delivery. The medium severity rating suggests a moderate risk level, implying that while immediate widespread damage is unlikely, targeted attacks could disrupt operations or lead to data compromise. The absence of patches and known exploits means organizations should remain vigilant and proactive in monitoring network traffic and threat intelligence feeds to detect any emerging indicators related to this threat. The potential impact is heightened for sectors with critical infrastructure or sensitive data, where even moderate malware infections can have significant operational consequences.

Defensive guidance

Given the limited details, mitigation should focus on strengthening network security and enhancing threat detection capabilities. European organizations should: 1) Implement advanced network monitoring and anomaly detection systems to identify unusual payload delivery or network activity patterns associated with malware. 2) Maintain updated threat intelligence feeds, including OSINT sources, to quickly incorporate any emerging IOCs related to this threat. 3) Enforce strict access controls and segmentation to limit malware propagation within networks. 4) Conduct regular security awareness training emphasizing the risks of payload delivery mechanisms and the importance of recognizing suspicious network behavior. 5) Employ endpoint detection and response (EDR) solutions capable of identifying and isolating malware payloads. 6) Prepare incident response plans tailored to malware infections involving network vectors. 7) Since no patches are available, focus on preventive controls and rapid detection rather than remediation through software updates. These measures will help mitigate the risk posed by this threat despite the current lack of detailed exploit information.

Community reviews

Loading reviews…