IndicatorPublished 17 Jul 2025Updated 18 Jul 2025

type osint · ThreatFox IOCs for 2025-07-17

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 49

lumen.radium.lolUnknown RAT botnet C2 domain (confidence level: 100%)
security.fcolareguaard.comUnknown malware payload delivery domain (confidence level: 100%)
wemoips.comUnknown malware payload delivery domain (confidence level: 100%)
ec2-35-73-179-148.ap-northeast-1.compute.amazonaws.comHavoc botnet C2 domain (confidence level: 100%)
us10.killall.shMintsLoader botnet C2 domain (confidence level: 100%)
7fsnaewwwq6r3.cfc-execute.bj.baidubce.comCobalt Strike botnet C2 domain (confidence level: 75%)
news.kaspersky.icuCobalt Strike botnet C2 domain (confidence level: 75%)
yiyiscrm.comCobalt Strike botnet C2 domain (confidence level: 100%)
pakistan-itsupport.serveblog.netHavoc botnet C2 domain (confidence level: 100%)
www.amazonlivenews.comShadowPad botnet C2 domain (confidence level: 95%)

URLs 46

http://5.199.173.205:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://ci33128.tw1.ru/2ea29716.phpDCRat botnet C2 (confidence level: 100%)
http://5.252.155.81/auth/login/Matanbuchus botnet C2 (confidence level: 100%)
http://193.105.134.245/auth/login/Matanbuchus botnet C2 (confidence level: 100%)
http://179.60.149.213/auth/login/Matanbuchus botnet C2 (confidence level: 100%)
http://185.39.19.164/auth/login/Matanbuchus botnet C2 (confidence level: 100%)
https://laughslip.xyz/bin.phpUnknown Loader botnet C2 (confidence level: 100%)
https://hovve.top/qiwdLumma Stealer botnet C2 (confidence level: 75%)
https://t.me/ahfdsdrywLumma Stealer botnet C2 (confidence level: 75%)
http://sleevesleeve.shopStealc botnet C2 (confidence level: 100%)

IP addresses 186

5.199.173.205Unknown malware botnet C2 server (confidence level: 100%)
111.229.151.200Cobalt Strike botnet C2 server (confidence level: 100%)
42.193.4.115Cobalt Strike botnet C2 server (confidence level: 100%)
8.138.167.123Cobalt Strike botnet C2 server (confidence level: 100%)
128.90.106.114AsyncRAT botnet C2 server (confidence level: 100%)
18.60.200.175NetSupportManager RAT botnet C2 server (confidence level: 100%)
13.246.43.90NetSupportManager RAT botnet C2 server (confidence level: 100%)
130.162.225.47Chaos botnet C2 server (confidence level: 100%)
179.61.253.86Bashlite botnet C2 server (confidence level: 100%)
147.45.252.41MimiKatz botnet C2 server (confidence level: 100%)

Hashes 1

NetSupportManager RAT payload (confidence level: 100%)

6ddffa4af59a8fa171c42b2419882a7b1fec01c184444314686deb155c5dc479

Description

ThreatFox IOCs for 2025-07-17

Impact

For European organizations, the impact of this threat is currently assessed as medium, consistent with the provided severity rating. Given the lack of detailed exploit information or known active campaigns, the immediate risk to confidentiality, integrity, and availability is moderate. However, the involvement of payload delivery and network activity categories suggests potential risks such as unauthorized access, data exfiltration, or service disruption if the malware were to be deployed effectively. European entities with extensive networked infrastructure or those relying on OSINT feeds for threat intelligence might be more exposed. The absence of patches and known exploits indicates that mitigation relies heavily on detection and prevention rather than remediation. If the malware evolves or gains wider distribution, the impact could escalate, particularly for sectors critical to European economies and public services.

Defensive guidance

Given the limited technical details, mitigation should focus on enhancing network security monitoring and threat intelligence integration. European organizations should: 1) Continuously update and correlate threat intelligence feeds, including ThreatFox and other OSINT sources, to detect emerging IOCs promptly. 2) Implement advanced network traffic analysis and anomaly detection systems to identify unusual payload delivery attempts or suspicious network activity. 3) Enforce strict segmentation and least privilege access controls to limit malware propagation if an infection occurs. 4) Conduct regular employee awareness training focused on recognizing phishing and social engineering tactics that could facilitate payload delivery. 5) Maintain up-to-date endpoint protection solutions capable of heuristic and behavior-based detection to identify unknown malware variants. 6) Establish incident response plans that include procedures for handling malware infections without available patches. These steps go beyond generic advice by emphasizing proactive intelligence integration and network behavior monitoring tailored to the threat's characteristics.

Community reviews

Loading reviews…