IndicatorPublished 12 Jul 2025Updated 13 Jul 2025

type osint · ThreatFox IOCs for 2025-07-12

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 38

linkedservlet.proHijackLoader botnet C2 domain (confidence level: 50%)
eyertyn.latLumma Stealer botnet C2 domain (confidence level: 100%)
www.jpchacha.comHijackLoader botnet C2 domain (confidence level: 100%)
ltdvjvr.topLumma Stealer botnet C2 domain (confidence level: 100%)
uponmap.comNetSupportManager RAT botnet C2 domain (confidence level: 100%)
jojo-ent.comNetSupportManager RAT botnet C2 domain (confidence level: 100%)
resutato.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
security.flearengauurd.comUnknown malware payload delivery domain (confidence level: 100%)
haciver.comUnknown malware payload delivery domain (confidence level: 100%)
smithenv.comFAKEUPDATES payload delivery domain (confidence level: 100%)

URLs 30

http://176.46.157.32/files/7234551096/hzhadup.exeHijackLoader payload delivery URL (confidence level: 100%)
http://176.46.157.32/files/5296057416/i8ksmr9.exeStealc payload delivery URL (confidence level: 100%)
http://62.233.53.75/393589217af146c5.phpStealc botnet C2 (confidence level: 100%)
http://66.63.187.164/v999f8.exeVidar payload delivery URL (confidence level: 100%)
http://45.141.233.187/7d1ca61c169b4862.phpStealc botnet C2 (confidence level: 100%)
http://176.46.157.32/testmine/random.exeAmadey payload delivery URL (confidence level: 100%)
https://smithenv.com/5r22q.jsFAKEUPDATES payload delivery URL (confidence level: 100%)
http://91.84.109.91/sign-inAmatera botnet C2 (confidence level: 100%)
http://144403cm.nyash.es/externaljavascriptmultiwp.phpDCRat botnet C2 (confidence level: 100%)
http://841333cm.nyash.es/imagevideo_packetprotectbaselinuxuniversal.phpDCRat botnet C2 (confidence level: 100%)

IP addresses 154

62.233.53.75Stealc botnet C2 server (confidence level: 100%)
185.177.239.63NetSupportManager RAT botnet C2 server (confidence level: 100%)
5.230.226.36Mirai botnet C2 server (confidence level: 100%)
185.212.56.93Cobalt Strike botnet C2 server (confidence level: 100%)
1.197.72.113Sliver botnet C2 server (confidence level: 100%)
128.90.113.220AsyncRAT botnet C2 server (confidence level: 100%)
167.235.213.2Quasar RAT botnet C2 server (confidence level: 100%)
51.81.171.234Havoc botnet C2 server (confidence level: 100%)
209.151.150.4MimiKatz botnet C2 server (confidence level: 100%)
67.220.72.161Xtreme RAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-07-12

Impact

For European organizations, the impact of this threat could manifest primarily through the delivery of malicious payloads via network activity, potentially leading to unauthorized access, data exfiltration, or disruption of services. Given the medium severity and lack of known exploits, the immediate risk may be moderate but could escalate if the malware evolves or is leveraged in targeted campaigns. Organizations relying heavily on OSINT tools or those with extensive network exposure might face increased risk. The absence of patches and known exploits suggests that the threat might be in early stages or under observation, but European entities should not discount the possibility of future exploitation. Potential impacts include compromise of sensitive data, degradation of network performance, and increased incident response costs. The threat's presence in OSINT feeds indicates that it could be used for reconnaissance or as part of a broader attack chain, which could affect confidentiality and integrity of organizational assets.

Defensive guidance

European organizations should enhance their network monitoring capabilities to detect unusual payload delivery patterns and network activity associated with this threat. Implementing advanced threat detection systems that leverage OSINT feeds like ThreatFox can provide early warnings. Regularly updating intrusion detection and prevention systems (IDS/IPS) signatures to include emerging IOCs, even if currently sparse, is advisable. Network segmentation and strict access controls can limit the spread of malware if an infection occurs. Conducting threat hunting exercises focusing on payload delivery mechanisms and unusual network traffic can help identify early signs of compromise. Employee awareness programs should emphasize the risks associated with payload delivery via network vectors. Since no patches are available, organizations should prioritize proactive detection and containment strategies. Collaboration with national cybersecurity centers and sharing threat intelligence can improve collective defense. Finally, maintaining robust backup and recovery procedures will mitigate potential damage from payload execution.

Community reviews

Loading reviews…