IndicatorPublished 14 Jul 2025Updated 15 Jul 2025

type osint · ThreatFox IOCs for 2025-07-14

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 39

security.fralegwaard.comUnknown malware payload delivery domain (confidence level: 100%)
kopewv.comUnknown malware payload delivery domain (confidence level: 100%)
1302498057-jifjeq2q25.na-siliconvalley.tencentscf.comCobalt Strike botnet C2 domain (confidence level: 75%)
gd-gd.topCobalt Strike botnet C2 domain (confidence level: 75%)
shipcg.topCobalt Strike botnet C2 domain (confidence level: 100%)
ecs-121-36-27-251.compute.hwclouds-dns.comCobalt Strike botnet C2 domain (confidence level: 100%)
ec2-34-221-83-3.us-west-2.compute.amazonaws.comCobalt Strike botnet C2 domain (confidence level: 100%)
ec2-3-85-192-21.compute-1.amazonaws.comHavoc botnet C2 domain (confidence level: 100%)
baby-technological.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
allinline.localto.netXWorm botnet C2 domain (confidence level: 100%)

URLs 37

http://94.156.177.41/mrc/five/pvqdq929bsx_a_d_m1n_a.phpLokiBot botnet C2 (confidence level: 100%)
https://62.233.53.75/393589217af146c5.phpStealc botnet C2 (confidence level: 50%)
https://www.t.minewise.xyzVidar botnet C2 (confidence level: 75%)
https://sckfs.pics/tqiwLumma Stealer botnet C2 (confidence level: 100%)
https://odwvzn.shop/ajntLumma Stealer botnet C2 (confidence level: 100%)
https://banirv.top/zqiwLumma Stealer botnet C2 (confidence level: 100%)
http://94.130.34.158Stealc botnet C2 (confidence level: 100%)
https://cpanel.quantumconcretecoatings.com/viewdashboardFAKEUPDATES botnet C2 (confidence level: 100%)
https://genxsy.top/tmnjLumma Stealer botnet C2 (confidence level: 75%)
https://greqjfu.xyz/uhbfLumma Stealer botnet C2 (confidence level: 75%)

IP addresses 167

34.131.183.13Cobalt Strike botnet C2 server (confidence level: 100%)
47.122.119.55Cobalt Strike botnet C2 server (confidence level: 100%)
192.3.176.155Remcos botnet C2 server (confidence level: 100%)
128.90.106.135AsyncRAT botnet C2 server (confidence level: 100%)
56.228.12.2Unknown malware botnet C2 server (confidence level: 100%)
83.217.209.92Hook botnet C2 server (confidence level: 100%)
45.150.34.112Hook botnet C2 server (confidence level: 100%)
148.66.21.236DCRat botnet C2 server (confidence level: 100%)
3.96.210.38NetSupportManager RAT botnet C2 server (confidence level: 100%)
52.47.127.136NetSupportManager RAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-07-14

Impact

For European organizations, the impact of this threat primarily lies in the potential for malware infections that could lead to unauthorized access, data exfiltration, or disruption of network services. Given the lack of specific affected products or vulnerabilities, the threat is more generalized and would affect organizations that do not have robust network monitoring and threat detection capabilities. The medium severity suggests a moderate risk of operational impact if these IOCs correspond to malware payloads that can evade existing defenses. European entities in sectors with high exposure to network-based attacks, such as finance, critical infrastructure, and government, could face increased risk if these IOCs are linked to targeted campaigns.

Defensive guidance

European organizations should integrate these IOCs into their existing security information and event management (SIEM) systems and intrusion detection/prevention systems (IDS/IPS) to enhance detection of related network activity and payload delivery attempts. Specific mitigation steps include: 1) Regularly updating threat intelligence feeds and ensuring automated ingestion of ThreatFox IOCs; 2) Conducting network traffic analysis to identify anomalies or communications matching the IOCs; 3) Implementing strict email filtering and endpoint protection to reduce the risk of payload delivery via phishing or malicious downloads; 4) Enhancing user awareness training focused on recognizing social engineering tactics that could lead to malware infection; 5) Employing network segmentation to limit lateral movement if an infection occurs; 6) Performing regular threat hunting exercises using these IOCs to proactively identify potential compromises. Since no patches are available, reliance on detection and containment is critical. Additionally, organizations should collaborate with national cybersecurity centers to share findings and receive updated intelligence.

Community reviews

Loading reviews…