IndicatorPublished 11 Jul 2025Updated 12 Jul 2025

type osint · ThreatFox IOCs for 2025-07-11

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 71

images.mildecommercialrealestate.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
security.fbaregwaurd.comUnknown malware payload delivery domain (confidence level: 100%)
altopew.comUnknown malware payload delivery domain (confidence level: 100%)
getin.topNetSupportManager RAT payload delivery domain (confidence level: 100%)
discoveronline.topNetSupportManager RAT payload delivery domain (confidence level: 100%)
armando.ns.cloudflare.comCobalt Strike botnet C2 domain (confidence level: 75%)
pe40.comCobalt Strike botnet C2 domain (confidence level: 75%)
www.cloudpacket.xyzCobalt Strike botnet C2 domain (confidence level: 75%)
brimaganla.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)
blue.o7lab.meAsyncRAT botnet C2 domain (confidence level: 100%)

URLs 28

http://213.176.73.34/api/ytasodysodisowqsytesodgsotasotusnjusn2qsSmartLoader botnet C2 (confidence level: 75%)
https://images.mildecommercialrealestate.com/viewdashboardFAKEUPDATES botnet C2 (confidence level: 100%)
http://20.2.139.87:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://216.107.136.27:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://getin.top/kll/index.phpNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://getin.top/kll/buf.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://discoveronline.top/kll/buf.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://discoveronline.top/kll/index.phpNetSupportManager RAT payload delivery URL (confidence level: 100%)
http://45.136.15.217:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://38.12.25.18:8877/supershell/login/Unknown malware botnet C2 (confidence level: 100%)

IP addresses 152

23.27.134.202FAKEUPDATES botnet C2 server (confidence level: 100%)
103.214.70.214Cobalt Strike botnet C2 server (confidence level: 100%)
107.149.154.103Cobalt Strike botnet C2 server (confidence level: 100%)
47.96.179.95Ghost RAT botnet C2 server (confidence level: 100%)
104.243.254.103Remcos botnet C2 server (confidence level: 100%)
80.64.19.165Remcos botnet C2 server (confidence level: 100%)
167.160.161.83Remcos botnet C2 server (confidence level: 100%)
143.92.62.30Unknown malware botnet C2 server (confidence level: 100%)
185.196.10.251AsyncRAT botnet C2 server (confidence level: 100%)
217.12.206.21SectopRAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-07-11

Impact

For European organizations, the impact of this threat is currently moderate due to the medium severity rating and the lack of specific exploit details or targeted vulnerabilities. The malware's focus on network activity and payload delivery suggests potential risks of unauthorized access, data exfiltration, or disruption if successfully deployed. However, without known exploits in the wild or detailed indicators, the immediate risk is limited. European entities with extensive network infrastructure and exposure to open-source intelligence feeds may be more vigilant in monitoring for such threats. The broad categorization implies that the malware could be used in various attack scenarios, potentially affecting confidentiality and availability if payloads are delivered successfully. Organizations relying on OSINT for threat detection should consider this information as part of their broader threat landscape monitoring but may not need immediate reactive measures beyond standard network security practices.

Defensive guidance

Given the general nature of this threat and lack of specific exploit details, mitigation should focus on enhancing network monitoring and threat intelligence integration. European organizations should: 1) Integrate ThreatFox and similar OSINT feeds into their Security Information and Event Management (SIEM) systems to detect emerging IOCs promptly. 2) Employ advanced network traffic analysis tools to identify anomalous payload delivery attempts and suspicious network activity. 3) Maintain robust endpoint detection and response (EDR) solutions to detect and isolate potential malware payloads early. 4) Conduct regular threat hunting exercises focusing on network activity patterns consistent with payload delivery mechanisms. 5) Educate security teams on interpreting OSINT data and correlating it with internal telemetry to improve detection accuracy. 6) Implement strict network segmentation and least privilege principles to limit malware propagation if an infection occurs. 7) Continuously update and test incident response plans to address malware infections efficiently. These steps go beyond generic advice by emphasizing proactive OSINT integration, network behavior analysis, and organizational preparedness tailored to the nature of this threat.

Community reviews

Loading reviews…