IndicatorPublished 3 Aug 2025Updated 4 Aug 2025

type osint · ThreatFox IOCs for 2025-08-03

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 28

security.flerfgurda.comUnknown malware payload delivery domain (confidence level: 100%)
venciols.comUnknown malware payload delivery domain (confidence level: 100%)
sece.verifiedaccesssecure.icuAsyncRAT botnet C2 domain (confidence level: 100%)
play.verifiedaccesssecure.icuAsyncRAT botnet C2 domain (confidence level: 100%)
apis.verifiedaccesssecure.icuAsyncRAT botnet C2 domain (confidence level: 100%)
camptesting.updays.topCobalt Strike botnet C2 domain (confidence level: 100%)
ecs-120-46-72-74.compute.hwclouds-dns.comCobalt Strike botnet C2 domain (confidence level: 100%)
camp.updays.topCobalt Strike botnet C2 domain (confidence level: 100%)
conditions-ripe.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
block-reset.gl.at.ply.ggQuasar RAT botnet C2 domain (confidence level: 100%)

URLs 21

https://clients.lamusicana.com/dologoutFAKEUPDATES botnet C2 (confidence level: 100%)
http://207.244.199.222/wget.shUnknown malware payload delivery URL (confidence level: 75%)
http://196.251.115.36/1.shUnknown malware payload delivery URL (confidence level: 75%)
http://003659cm.nyash.es/javascriptjsrequesthttpprocessormultitempdownloadstemporary.phpDCRat botnet C2 (confidence level: 100%)
https://pastebin.com/raw/jtpcx3rcXWorm botnet C2 (confidence level: 50%)
https://pastebin.com/raw/gm8awbzgXWorm botnet C2 (confidence level: 50%)
https://pastebin.com/raw/wd2c8tx0XWorm botnet C2 (confidence level: 50%)
http://cm41241.tw1.ru/7b4a24ad.phpDCRat botnet C2 (confidence level: 100%)
https://ww.softlinko.comVidar botnet C2 (confidence level: 75%)
https://ukrposhttem.top/apiLumma Stealer botnet C2 (confidence level: 100%)

IP addresses 179

43.248.78.104Cobalt Strike botnet C2 server (confidence level: 100%)
111.231.23.22Cobalt Strike botnet C2 server (confidence level: 100%)
43.251.116.137Ghost RAT botnet C2 server (confidence level: 100%)
194.26.192.176Remcos botnet C2 server (confidence level: 100%)
38.60.217.107Remcos botnet C2 server (confidence level: 100%)
125.25.103.36NetSupportManager RAT botnet C2 server (confidence level: 100%)
40.192.99.189NetSupportManager RAT botnet C2 server (confidence level: 100%)
54.207.216.190NetSupportManager RAT botnet C2 server (confidence level: 100%)
45.153.34.54MooBot botnet C2 server (confidence level: 100%)
23.83.114.228MooBot botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-08-03

Impact

For European organizations, the impact of this threat intelligence update is primarily in the realm of situational awareness rather than immediate operational risk. Since no active exploits or vulnerabilities are identified, the direct risk to confidentiality, integrity, or availability is low at this stage. However, the dissemination of new IOCs related to network activity and payload delivery could signal emerging tactics or infrastructure used by threat actors, which may eventually lead to targeted attacks. Organizations relying on OSINT for threat detection and response can benefit from integrating these IOCs into their security monitoring tools to enhance detection capabilities. The medium severity rating suggests that while there is no immediate critical threat, vigilance is warranted to prevent potential exploitation as threat actors evolve their methods. European entities with significant network exposure or those in sectors frequently targeted by malware campaigns (e.g., finance, critical infrastructure, government) should consider this intelligence as part of their broader threat landscape monitoring.

Defensive guidance

Given the nature of this intelligence update, mitigation should focus on proactive threat hunting and enhanced monitoring rather than patching or direct remediation. Specific recommendations include: 1) Integrate the provided IOCs into SIEM (Security Information and Event Management) and IDS/IPS (Intrusion Detection/Prevention Systems) to detect any related network activity or payload delivery attempts. 2) Conduct regular threat hunting exercises using these IOCs to identify any early signs of compromise within the network. 3) Enhance OSINT capabilities to continuously monitor for updates from ThreatFox and similar feeds to stay ahead of emerging threats. 4) Educate security teams on the importance of contextualizing threat intelligence and correlating it with internal logs and alerts. 5) Maintain robust network segmentation and strict access controls to limit the impact of any potential payload delivery. 6) Employ behavioral analytics to detect anomalous network activity that may not match known signatures. These steps go beyond generic advice by emphasizing intelligence integration, proactive detection, and continuous monitoring tailored to the nature of the threat intelligence provided.

Community reviews

Loading reviews…