IndicatorPublished 24 Jul 2025Updated 25 Jul 2025

type osint · ThreatFox IOCs for 2025-07-24

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 114

kefel.techSPICA botnet C2 domain (confidence level: 50%)
kefel.ioSPICA botnet C2 domain (confidence level: 50%)
s1.kefel.techSPICA botnet C2 domain (confidence level: 50%)
s2.kefel.techSPICA botnet C2 domain (confidence level: 50%)
s3.kefel.techSPICA botnet C2 domain (confidence level: 50%)
s4.kefel.techSPICA botnet C2 domain (confidence level: 50%)
app.kefel.techSPICA botnet C2 domain (confidence level: 50%)
428d09ca103d2593e3555304a2862f873c70ca7dSPICA botnet C2 domain (confidence level: 50%)
delfxus.todayLumma Stealer botnet C2 domain (confidence level: 100%)
jambnwz.topLumma Stealer botnet C2 domain (confidence level: 100%)

URLs 48

http://45.131.64.210/1.shUnknown malware payload delivery URL (confidence level: 75%)
https://jambnwz.top/gakhLumma Stealer botnet C2 (confidence level: 75%)
https://sparklfm.xyz/xoitLumma Stealer botnet C2 (confidence level: 75%)
https://steamcommunity.com/profiles/76561199880530249Vidar botnet C2 (confidence level: 75%)
https://t.me/dz25gzVidar botnet C2 (confidence level: 75%)
https://195.201.251.183Vidar botnet C2 (confidence level: 75%)
https://main.db.review.digitalVidar botnet C2 (confidence level: 75%)
http://kurama.network/loginUnknown malware botnet C2 (confidence level: 100%)
http://43.160.252.15:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://wranglerjeans.shopStealc botnet C2 (confidence level: 100%)

IP addresses 150

43.138.22.149Cobalt Strike botnet C2 server (confidence level: 100%)
43.138.22.149Cobalt Strike botnet C2 server (confidence level: 100%)
85.102.13.26AsyncRAT botnet C2 server (confidence level: 100%)
45.32.187.145SectopRAT botnet C2 server (confidence level: 100%)
54.242.171.49Havoc botnet C2 server (confidence level: 100%)
13.232.71.100NetSupportManager RAT botnet C2 server (confidence level: 100%)
34.229.188.97Empire Downloader botnet C2 server (confidence level: 100%)
207.180.246.14Empire Downloader botnet C2 server (confidence level: 100%)
52.205.143.192Empire Downloader botnet C2 server (confidence level: 100%)
91.92.120.113PureLogs Stealer botnet C2 server (confidence level: 100%)

Hashes 1

Lumma Stealer payload (confidence level: 100%)

b6ee03c1fd8aa335c0b888617594058fa83650a7

Description

ThreatFox IOCs for 2025-07-24

Impact

For European organizations, the impact of this threat is currently moderate due to the medium severity rating and the lack of known active exploits. However, the presence of malware-related IOCs in ThreatFox suggests that organizations should remain vigilant, as these indicators could be used to detect or prevent potential infections. The threat’s focus on payload delivery and network activity implies risks to confidentiality and availability if the malware successfully infiltrates systems, potentially leading to data exfiltration, service disruption, or lateral movement within networks. European entities with significant internet-facing infrastructure or those in critical sectors such as finance, energy, and government could be more susceptible if the malware payloads target these industries. The absence of patches or specific affected versions means that mitigation will rely heavily on detection and response capabilities rather than software updates. Given the public availability of the IOCs, attackers might adapt or evolve their tactics, increasing the risk over time. Therefore, European organizations should consider this threat as a moderate ongoing risk that requires proactive monitoring and incident response preparedness.

Defensive guidance

1. Integrate ThreatFox IOCs into existing Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to enhance detection capabilities for related malware activity. 2. Conduct regular network traffic analysis to identify anomalous payload delivery attempts or suspicious network behaviors consistent with the threat’s profile. 3. Employ advanced threat hunting techniques focusing on the indicators of compromise shared by ThreatFox, even if no specific indicators are currently listed, by monitoring for unusual payload delivery patterns. 4. Maintain up-to-date threat intelligence feeds and collaborate with information sharing groups to receive timely updates on any evolution of this threat. 5. Implement strict network segmentation and least privilege access controls to limit the potential spread of malware if an infection occurs. 6. Conduct regular employee awareness training emphasizing the risks of payload delivery mechanisms such as phishing or malicious downloads. 7. Ensure robust backup and recovery procedures are in place to mitigate potential availability impacts from malware-induced disruptions. 8. Since no patches are available, focus on hardening network defenses and endpoint protections, including application whitelisting and behavioral analytics.

Community reviews

Loading reviews…