IndicatorPublished 15 Jul 2025Updated 16 Jul 2025

type osint · ThreatFox IOCs for 2025-07-15

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 37

security.guaerdflfare.comUnknown malware payload delivery domain (confidence level: 100%)
jemriz.comUnknown malware payload delivery domain (confidence level: 100%)
pre-order.sodakconcretecoatings.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
ecs-124-71-152-57.compute.hwclouds-dns.comCobalt Strike botnet C2 domain (confidence level: 100%)
rdlaw.mywire.orgAsyncRAT botnet C2 domain (confidence level: 50%)
abremeh.topLumma Stealer botnet C2 domain (confidence level: 50%)
alcapulco.duckdns.orgXWorm botnet C2 domain (confidence level: 50%)
still-ie.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 50%)
b3kylyu7z.localto.netSpyNote botnet C2 domain (confidence level: 100%)
hwsrv-1285168.hostwindsdns.comHavoc botnet C2 domain (confidence level: 100%)

URLs 52

http://172.245.253.10:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://143.92.62.30:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://github.com/cryptsniper/sniperchek/releases/download/1%2c0/gmbh_2.2.zipLumma Stealer payload delivery URL (confidence level: 100%)
https://lebensversicherungvergleich.top/jjj/index.phpNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://lebensversicherungvergleich.top/jjj/include.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://pre-order.sodakconcretecoatings.com/viewdashboardFAKEUPDATES botnet C2 (confidence level: 100%)
http://lumma-market.ru/loginLumma Stealer botnet C2 (confidence level: 100%)
http://144.172.96.106/loginLumma Stealer botnet C2 (confidence level: 100%)
https://falsiu.shop/zpahLumma Stealer botnet C2 (confidence level: 75%)
http://a1071370.xsph.ru/l1nc0in.phpDCRat botnet C2 (confidence level: 100%)

IP addresses 155

172.245.253.10Unknown malware botnet C2 server (confidence level: 100%)
23.133.88.221FAKEUPDATES botnet C2 server (confidence level: 100%)
38.207.176.60Cobalt Strike botnet C2 server (confidence level: 100%)
8.130.191.106Cobalt Strike botnet C2 server (confidence level: 100%)
154.222.24.236Ghost RAT botnet C2 server (confidence level: 100%)
38.54.1.115Unknown malware botnet C2 server (confidence level: 100%)
206.82.6.166Unknown malware botnet C2 server (confidence level: 100%)
114.215.175.221Unknown malware botnet C2 server (confidence level: 100%)
5.231.220.79AsyncRAT botnet C2 server (confidence level: 100%)
177.255.88.14AsyncRAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-07-15

Impact

For European organizations, the impact of this threat is currently limited due to the lack of detailed information and absence of known active exploitation. However, the involvement of OSINT and network activity implies potential risks related to data confidentiality and network integrity if the malware successfully delivers payloads or facilitates unauthorized data collection. Organizations engaged in sensitive sectors such as finance, government, critical infrastructure, and technology could face increased risks if this threat evolves into a more active or targeted campaign. The medium severity rating suggests moderate potential for disruption or data compromise, but without specific exploit details or affected products, the immediate operational impact is likely low. Nonetheless, the presence of such malware in the threat landscape underscores the need for vigilance in monitoring network traffic and payload delivery mechanisms to preempt escalation.

Defensive guidance

Given the limited technical details, mitigation should focus on enhancing network monitoring and threat intelligence integration. European organizations should implement advanced network traffic analysis tools capable of detecting anomalous payload delivery and reconnaissance activities typical of OSINT-related malware. Employing intrusion detection and prevention systems (IDPS) with updated threat signatures from feeds like ThreatFox can help identify emerging threats early. Organizations should also enforce strict network segmentation to limit lateral movement and potential payload spread. Regularly updating and patching all systems remains critical, even though no specific patches are available for this threat, to reduce the attack surface. Additionally, fostering information sharing within industry-specific ISACs (Information Sharing and Analysis Centers) and leveraging publicly available threat intelligence can improve preparedness. Conducting employee awareness training on recognizing suspicious network behaviors and potential phishing attempts that could serve as initial infection vectors is also advisable.

Summary

The provided information describes a security threat categorized as malware with a medium severity level, sourced from the ThreatFox MISP feed dated July 15, 2025. The threat is associated with OSINT (Open Source Intelligence) and involves network activity and payload delivery. The threat level is indicated as 2 on an unspecified scale, with analysis and distribution metrics provided but without further elaboration. The lack of CWE identifiers and absence of technical details about the malware's behavior, infection vectors, or payload specifics limits the depth of technical understanding. The classification under OSINT and network activity suggests that this threat might involve reconnaissance or data gathering activities, potentially as a precursor to more targeted attacks or as part of a broader malware campaign delivering malicious payloads over the network. Given the absence of known exploits and patches, this threat appears to be in an early or observational stage rather than an active widespread attack. The TLP (Traffic Light Protocol) white tag indicates that the information is publicly shareable without restriction, suggesting that the threat intelligence is intended for broad dissemination and awareness rather than immediate emergency response.

Community reviews

Loading reviews…