IndicatorPublished 29 Jul 2025Updated 30 Jul 2025

type osint · ThreatFox IOCs for 2025-07-29

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 89

server-cd2.bipewi2747.workers.devSMOKEDHAM botnet C2 domain (confidence level: 100%)
ex-02.ankk.ukUnknown Loader payload delivery domain (confidence level: 100%)
security.fluargueds.comUnknown malware payload delivery domain (confidence level: 100%)
menpogisa.comUnknown malware payload delivery domain (confidence level: 100%)
monclerjackets.topNetSupportManager RAT payload delivery domain (confidence level: 100%)
logrecovery.comAmadey botnet C2 domain (confidence level: 50%)
edufinder.irCobalt Strike botnet C2 domain (confidence level: 75%)
test111-1302872009.cos.ap-shanghai.myqcloud.comCobalt Strike botnet C2 domain (confidence level: 75%)
ec2-3-19-222-192.us-east-2.compute.amazonaws.comCobalt Strike botnet C2 domain (confidence level: 100%)
previous-vietnamese.gl.at.ply.ggNanocore RAT botnet C2 domain (confidence level: 50%)

URLs 46

https://monclerjackets.top/tweet/view_l.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://monclerjackets.top/tweet/index.phpNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://yikpspbi.my/xwij/apiLumma Stealer botnet C2 (confidence level: 75%)
https://185.92.74.43/pages/login.phpUnknown malware botnet C2 (confidence level: 50%)
https://www.ruwa.fedor-turin.ru/loginLumma Stealer botnet C2 (confidence level: 50%)
https://rururustaging.fedor-turin.ru/Lumma Stealer botnet C2 (confidence level: 50%)
https://server8.cdneurops.health/Glupteba botnet C2 (confidence level: 50%)
https://cyberdarkduck.live/webpanel/panel/index.phpUnknown Stealer botnet C2 (confidence level: 50%)
https://discord.com/channels/1051851191438549012/1051889403322187796/1399588399341506622XWorm botnet C2 (confidence level: 50%)
https://bittsgly.my/atop/apiLumma Stealer botnet C2 (confidence level: 100%)

IP addresses 208

103.176.197.40Ghost RAT botnet C2 server (confidence level: 100%)
103.176.197.14Ghost RAT botnet C2 server (confidence level: 100%)
103.176.197.22Ghost RAT botnet C2 server (confidence level: 100%)
43.226.17.23Ghost RAT botnet C2 server (confidence level: 100%)
103.176.197.6Ghost RAT botnet C2 server (confidence level: 100%)
149.88.86.89Ghost RAT botnet C2 server (confidence level: 100%)
43.226.17.26Ghost RAT botnet C2 server (confidence level: 100%)
143.92.49.232Unknown malware botnet C2 server (confidence level: 100%)
83.143.112.163AsyncRAT botnet C2 server (confidence level: 100%)
20.171.81.135Unknown malware botnet C2 server (confidence level: 100%)

Hashes 59

d9d78320352f15730774221c1b323badUnknown malware payload (confidence level: 50%)
26b7a5d87d56034486b4f29cf7a44defUnknown malware payload (confidence level: 50%)
da8ca8da179421288a989d7733822c1eUnknown malware payload (confidence level: 50%)
815c70afeacd13f4c4b89c2ad65265f2Unknown malware payload (confidence level: 50%)
e807d6a39004f115f10a671b2b39b715Unknown malware payload (confidence level: 50%)
0176178320d60f6dfe2cd46dfb3eb2f6Unknown malware payload (confidence level: 50%)
9a578a7646202d704f9c2bbc802658e4Unknown malware payload (confidence level: 50%)
9d3f17172657186dc8dad6221ffc0618Unknown malware payload (confidence level: 50%)
921b6c8615db433c7843aca5cd82d06aUnknown malware payload (confidence level: 50%)
1bb3616096e43df935dfaf1ac29411e6Unknown malware payload (confidence level: 50%)

Description

ThreatFox IOCs for 2025-07-29

Impact

For European organizations, the impact of these IOCs depends largely on their ability to integrate and act upon the intelligence. Since the threat involves network activity and payload delivery, there is a risk of initial compromise leading to malware infection, data exfiltration, or lateral movement within networks. Organizations lacking robust network monitoring, threat detection, and incident response capabilities may be more vulnerable to undetected intrusion attempts. The medium severity suggests that while the threat is not immediately critical, failure to recognize and respond to these indicators could enable attackers to establish footholds, potentially leading to confidentiality breaches or operational disruptions. The absence of known exploits in the wild reduces immediate risk but does not eliminate the possibility of future exploitation or targeted attacks leveraging these IOCs. European entities in sectors with high exposure to external network traffic, such as finance, critical infrastructure, and government, may face elevated risks if these indicators correspond to active threat actor campaigns.

Defensive guidance

European organizations should prioritize the integration of these IOCs into their existing security monitoring tools, such as SIEMs, IDS/IPS, and endpoint detection and response (EDR) systems, to enhance detection capabilities. Specific actions include: 1) Updating threat intelligence feeds regularly to incorporate the latest IOCs from ThreatFox and similar sources. 2) Conducting network traffic analysis to identify anomalous patterns or connections matching the provided indicators. 3) Enhancing email and web gateway defenses to detect and block payload delivery attempts. 4) Performing targeted threat hunting exercises using these IOCs to uncover potential undetected compromises. 5) Ensuring incident response teams are prepared to investigate and remediate infections related to these indicators. 6) Implementing network segmentation and least privilege principles to limit the impact of any successful payload delivery. 7) Training staff on recognizing phishing and social engineering tactics that may be used to deliver payloads associated with these IOCs. These measures go beyond generic advice by focusing on actionable intelligence integration and proactive detection tailored to the nature of the threat.

Community reviews

Loading reviews…