IndicatorPublished 4 Aug 2025Updated 5 Aug 2025

type osint · ThreatFox IOCs for 2025-08-04

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 111

security.flhurgyard.comUnknown malware payload delivery domain (confidence level: 100%)
nenziop.comUnknown malware payload delivery domain (confidence level: 100%)
ty.softlinko.comVidar botnet C2 domain (confidence level: 75%)
ec2-47-129-44-166.ap-southeast-1.compute.amazonaws.comCobalt Strike botnet C2 domain (confidence level: 100%)
ec2-54-244-199-31.us-west-2.compute.amazonaws.comUnknown malware botnet C2 domain (confidence level: 100%)
wealthyblessed.minhaempresa.tvXWorm botnet C2 domain (confidence level: 100%)
union-victor.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
flipbaker-35783.portmap.hostXWorm botnet C2 domain (confidence level: 100%)
similar-meta.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
hawkeye.v6.navyQuasar RAT botnet C2 domain (confidence level: 75%)

URLs 101

http://206.82.6.254:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://ty.softlinko.comVidar botnet C2 (confidence level: 75%)
http://116.205.245.113:8029/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://47.99.159.237:18088/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://oby2349.giize.com:3049/is-readyHoudini botnet C2 (confidence level: 100%)
https://helloworldcyber.live/webpanel/panel/login.phpUnknown malware botnet C2 (confidence level: 100%)
http://176.123.2.48/1.shUnknown malware payload delivery URL (confidence level: 75%)
https://goethjmr.asia/lkiq/apiLumma Stealer botnet C2 (confidence level: 75%)
https://server9.nisdably.com/Glupteba botnet C2 (confidence level: 50%)
https://server5.localstats.org/Glupteba botnet C2 (confidence level: 50%)

IP addresses 293

217.60.38.209Cobalt Strike botnet C2 server (confidence level: 100%)
172.105.24.242Cobalt Strike botnet C2 server (confidence level: 100%)
38.47.120.26Cobalt Strike botnet C2 server (confidence level: 100%)
154.201.76.184Cobalt Strike botnet C2 server (confidence level: 100%)
154.36.161.225Ghost RAT botnet C2 server (confidence level: 100%)
107.175.148.101Remcos botnet C2 server (confidence level: 100%)
27.102.127.136Remcos botnet C2 server (confidence level: 100%)
89.46.65.114Sliver botnet C2 server (confidence level: 100%)
181.235.10.10AsyncRAT botnet C2 server (confidence level: 100%)
202.55.135.163AsyncRAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-08-04

Impact

For European organizations, the impact of this threat depends largely on the nature of the malware payloads delivered and the network activity patterns involved. Since the threat involves payload delivery and network activity, it could lead to unauthorized access, data exfiltration, lateral movement within networks, or disruption of services if the malware is designed for such purposes. The medium severity suggests that while the threat is not currently causing widespread critical damage, it could facilitate espionage, data theft, or serve as a foothold for more advanced attacks. European entities with significant network exposure, such as financial institutions, critical infrastructure providers, and large enterprises, may be at risk of targeted or opportunistic attacks leveraging these IOCs. The lack of known exploits in the wild and absence of patches indicates that this threat may be emerging or under observation, requiring vigilance but not immediate emergency response. The open sharing of these IOCs allows organizations to proactively monitor network traffic and endpoints for signs of compromise, potentially mitigating impact before exploitation escalates.

Defensive guidance

Given the nature of this threat as OSINT-based malware indicators related to payload delivery and network activity, European organizations should implement targeted threat hunting and network monitoring using the provided IOCs once available. Specific mitigations include: 1) Deploy and update advanced network intrusion detection and prevention systems (IDS/IPS) to identify suspicious payload delivery patterns and anomalous network traffic; 2) Integrate ThreatFox IOCs into Security Information and Event Management (SIEM) platforms to enable real-time alerting and correlation; 3) Conduct regular endpoint detection and response (EDR) scans focusing on unusual payload execution or persistence mechanisms; 4) Enforce strict network segmentation to limit lateral movement if an infection occurs; 5) Educate security teams on emerging malware delivery tactics and encourage proactive threat intelligence sharing within European cybersecurity communities; 6) Maintain up-to-date backups and incident response plans tailored to malware containment and eradication; 7) Since no patches are available, emphasize hardening of network defenses and minimizing attack surface through least privilege and zero trust principles. These steps go beyond generic advice by focusing on leveraging the specific IOCs and network activity patterns associated with this threat feed.

Community reviews

Loading reviews…