IndicatorPublished 19 Jul 2025Updated 20 Jul 2025

type osint · ThreatFox IOCs for 2025-07-19

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 157

rose-pole-chip.pages.devUnknown malware payload delivery domain (confidence level: 100%)
sugarpotfun.fly.storage.tigris.devUnknown malware payload delivery domain (confidence level: 100%)
vendictio.comUnknown malware payload delivery domain (confidence level: 50%)
manwithedhelp.topFAKEUPDATES payload delivery domain (confidence level: 100%)
jiezishijie.topFAKEUPDATES payload delivery domain (confidence level: 100%)
security.gwardfilaer.comUnknown malware payload delivery domain (confidence level: 100%)
hopeldo.comUnknown malware payload delivery domain (confidence level: 100%)
security.flmesecgaurd.comUnknown malware payload delivery domain (confidence level: 100%)
fermigz.comUnknown malware payload delivery domain (confidence level: 100%)
security.falagyrarde.comUnknown malware payload delivery domain (confidence level: 100%)

URLs 143

https://eventpiggy.com/work/downloader.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
https://clickgotheshears.com/work/downloader.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
https://synergeahealthcentre.com/work/downloader.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
https://royallinefrenchies.com/work/downloader.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
https://kortojura.com/work/downloader.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
https://kevinleeart.com/work/downloader.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
https://digitaj.com/work/downloader.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
https://coursecomrade.com/work/downloader.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
https://cliniquemedicalerichelieu.com/work/downloader.phpFAKEUPDATES payload delivery URL (confidence level: 100%)
https://bellevillepaddlingclub.com/work/downloader.phpFAKEUPDATES payload delivery URL (confidence level: 100%)

IP addresses 176

159.203.30.200Cobalt Strike botnet C2 server (confidence level: 100%)
137.220.232.142Cobalt Strike botnet C2 server (confidence level: 100%)
1.13.187.97Cobalt Strike botnet C2 server (confidence level: 100%)
176.65.149.160Sliver botnet C2 server (confidence level: 100%)
89.110.96.140Sliver botnet C2 server (confidence level: 100%)
95.216.78.61AsyncRAT botnet C2 server (confidence level: 100%)
172.94.9.85AsyncRAT botnet C2 server (confidence level: 100%)
45.81.23.42AsyncRAT botnet C2 server (confidence level: 100%)
172.105.121.80Unknown malware botnet C2 server (confidence level: 100%)
188.226.220.215Havoc botnet C2 server (confidence level: 100%)

Hashes 29

Lumma Stealer payload (confidence level: 100%)

08269846bf389efe2f5a58d4fc2cd48538aab5e0fa868ff1205524bcfa7e6d64
badbf65775ddf265a3dd2eeb5dae28d29b13158a0a5f153bc6b80320eaae9766
8d6b78d770af35d4622a72ad847121ec531042ae5642df9ac4fbd8b85199a581
166c79e0d3ea6319d4b1c4d12154e271c6d9bb87e174ff7fbc5a4d6faccd1e30
8702f84bdf875fa7f1bfcbcdf11c2c4097dc2c93aecf9a12008a2fd3c8b53fde
9478d10fb87adcced07561c8aa4ee8bb6ae857f65d0c1a630c1afa1abce37e86
e60414d67ff81e1f95a3bf0b416471371c8a461e9d3e017c0a0850d0ad2b5852
d6a421eb706f7b3318475541756fbb4254cc0831d795c3fb76807139f3991e06
a4654cbbf7f64af65a452dc70a05dbd32359406d4e9b0195826e9615715c999a
9099761b716865dbca9b3973c68b904df16372e12cbdcd75d15a48749478ae9e

Description

ThreatFox IOCs for 2025-07-19

Impact

For European organizations, the impact of this threat depends largely on the nature of the malware payload and its delivery mechanism, which are not detailed here. Given the association with OSINT and network activity, there is potential for targeted reconnaissance and subsequent payload delivery that could lead to data breaches, espionage, or disruption of services. Medium severity suggests moderate risk, possibly affecting confidentiality and availability. Organizations relying heavily on networked infrastructure and those involved in sensitive sectors such as finance, government, and critical infrastructure could face increased risk if the malware payload enables lateral movement or data exfiltration. The lack of known exploits in the wild reduces immediate risk but does not preclude future exploitation. The absence of patches means mitigation must focus on detection and prevention rather than remediation of a known vulnerability.

Defensive guidance

Given the lack of specific affected products or versions, mitigation should focus on enhancing network security and threat detection capabilities. European organizations should: 1) Implement robust network monitoring to detect unusual payload delivery or network activity patterns associated with malware. 2) Utilize threat intelligence feeds, including ThreatFox, to update detection signatures and IOC databases regularly. 3) Conduct regular OSINT monitoring to identify potential targeting or reconnaissance activities against their infrastructure. 4) Enforce strict access controls and network segmentation to limit malware propagation. 5) Employ endpoint detection and response (EDR) solutions capable of identifying and isolating suspicious payloads. 6) Train security teams to recognize and respond to emerging threats indicated by OSINT sources. 7) Maintain up-to-date backups and incident response plans to mitigate impact if infection occurs. These steps go beyond generic advice by emphasizing proactive intelligence integration and network behavior analysis tailored to OSINT-related malware threats.

Community reviews

Loading reviews…