IndicatorPublished 1 Aug 2025Updated 2 Aug 2025

type osint · ThreatFox IOCs for 2025-08-01

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 22

security.florerguaerd.comUnknown malware payload delivery domain (confidence level: 100%)
monchiels.comUnknown malware payload delivery domain (confidence level: 100%)
ec2-56-228-12-2.eu-north-1.compute.amazonaws.comUnknown malware botnet C2 domain (confidence level: 100%)
flexreplicahafailoverserver638889507287292352-r32.postgres.database.azure.comUnknown malware botnet C2 domain (confidence level: 100%)
flexreplicahafailoverserver638889507287292352-r32.rs-8fd10fa7e4b4.postgres.database.azure.comUnknown malware botnet C2 domain (confidence level: 100%)
hexa.dnsframe.comXWorm botnet C2 domain (confidence level: 100%)
late-researcher.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
facilities-arizona.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
demo.softlinko.comVidar botnet C2 domain (confidence level: 75%)
say-domains.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)

URLs 22

http://cq68815.tw1.ru/70807812.phpDCRat botnet C2 (confidence level: 100%)
http://0367384.netsolhost.com/6n0j.exePony payload delivery URL (confidence level: 50%)
http://mlcimaging.com/1ckjvug.exePony payload delivery URL (confidence level: 50%)
http://directgrid.biz/forum/viewtopic.phpPony botnet C2 (confidence level: 50%)
http://directgrid.info/forum/viewtopic.phpPony botnet C2 (confidence level: 50%)
http://directgrid.net/forum/viewtopic.phpPony botnet C2 (confidence level: 50%)
http://cv16139.tw1.ru/f1819877.phpDCRat botnet C2 (confidence level: 100%)
http://113.44.139.80:443/cmbkCobalt Strike botnet C2 (confidence level: 75%)
https://demo.softlinko.comVidar botnet C2 (confidence level: 75%)
https://zxczxczxczxc.twist2katz.com/loginUnknown malware botnet C2 (confidence level: 100%)

IP addresses 159

172.86.123.55BeaverTail botnet C2 server (confidence level: 75%)
172.86.113.18BeaverTail botnet C2 server (confidence level: 75%)
45.61.150.67BeaverTail botnet C2 server (confidence level: 75%)
147.124.213.19BeaverTail botnet C2 server (confidence level: 75%)
67.203.7.205BeaverTail botnet C2 server (confidence level: 75%)
47.109.83.84Cobalt Strike botnet C2 server (confidence level: 100%)
140.143.194.26Cobalt Strike botnet C2 server (confidence level: 100%)
95.111.251.4Cobalt Strike botnet C2 server (confidence level: 100%)
51.68.244.175Remcos botnet C2 server (confidence level: 100%)
172.94.18.114Remcos botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-08-01

Impact

For European organizations, the impact of this threat is currently ambiguous due to the lack of detailed information. Given the medium severity and the involvement of payload delivery and network activity, there is potential for disruption through malware infections that could compromise confidentiality, integrity, or availability of systems. However, without specific affected products or known exploits, the immediate risk appears limited. Organizations relying on OSINT tools or monitoring network traffic for payload delivery mechanisms should be vigilant. The threat could lead to data breaches, unauthorized access, or service interruptions if exploited, but the absence of known exploits and patches suggests it is not actively leveraged in attacks at this time. European entities with critical infrastructure or sensitive data may face increased risk if the threat evolves or if threat actors begin exploiting the identified malware vectors.

Defensive guidance

Given the limited specifics, European organizations should focus on enhancing network monitoring and threat intelligence capabilities to detect unusual payload delivery or network activity patterns. Implementing advanced endpoint detection and response (EDR) solutions that can identify suspicious OSINT-related malware behaviors is advisable. Regularly updating and hardening network defenses, including firewalls and intrusion detection/prevention systems (IDS/IPS), can help mitigate potential exploitation. Organizations should also maintain robust incident response plans tailored to malware infections and ensure staff are trained to recognize phishing or social engineering attempts that could facilitate payload delivery. Collaboration with threat intelligence sharing platforms, including MISP feeds like ThreatFox, will improve situational awareness. Finally, conducting regular security audits and penetration testing focused on network and payload delivery vectors will help identify and remediate vulnerabilities proactively.

Community reviews

Loading reviews…