IndicatorPublished 5 Aug 2025Updated 6 Aug 2025

type osint · ThreatFox IOCs for 2025-08-05

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 47

meadotdk.qponLumma Stealer botnet C2 domain (confidence level: 100%)
yrokistorii.ruLumma Stealer botnet C2 domain (confidence level: 100%)
security.flaxergaurds.comUnknown malware payload delivery domain (confidence level: 100%)
temopix.comUnknown malware payload delivery domain (confidence level: 100%)
royalmail.com.rx.ns2.nameMimiKatz botnet C2 domain (confidence level: 100%)
aws.micsoloft.infoCobalt Strike botnet C2 domain (confidence level: 100%)
172-233-97-159.ip.linodeusercontent.comUnknown malware botnet C2 domain (confidence level: 100%)
update-office.comHavoc botnet C2 domain (confidence level: 100%)
he-purchased.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
activities-essays.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)

URLs 19

http://pavlovski3.temp.swtest.ru/b067f351.phpDCRat botnet C2 (confidence level: 100%)
https://steamcommunity.com/profiles/76561199884432485Vidar botnet C2 (confidence level: 100%)
https://t.me/ty5e4qVidar botnet C2 (confidence level: 100%)
https://49.13.37.70/Vidar botnet C2 (confidence level: 100%)
https://116.203.167.110/Vidar botnet C2 (confidence level: 100%)
https://my.cp.payoopoint.lk/Vidar botnet C2 (confidence level: 100%)
https://yrokistorii.ru/uqya/apiLumma Stealer botnet C2 (confidence level: 75%)
https://94.130.191.126Vidar botnet C2 (confidence level: 75%)
https://up.qp.payoopoint.lkVidar botnet C2 (confidence level: 75%)
https://glycmikv.lol/xakg/apiLumma Stealer botnet C2 (confidence level: 75%)

IP addresses 188

124.198.131.144Nanocore RAT botnet C2 server (confidence level: 75%)
101.201.75.136Cobalt Strike botnet C2 server (confidence level: 100%)
103.176.197.34Ghost RAT botnet C2 server (confidence level: 100%)
142.202.188.223Remcos botnet C2 server (confidence level: 100%)
202.61.137.217Sliver botnet C2 server (confidence level: 100%)
212.193.57.188Sliver botnet C2 server (confidence level: 100%)
78.128.113.222SectopRAT botnet C2 server (confidence level: 100%)
51.75.38.2Unknown malware botnet C2 server (confidence level: 100%)
187.212.217.91Quasar RAT botnet C2 server (confidence level: 100%)
187.212.217.91Quasar RAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-08-05

Impact

For European organizations, the impact of this threat intelligence update is primarily in enhancing situational awareness and detection capabilities rather than immediate operational risk. Since no specific vulnerabilities or exploits are identified, the direct risk to confidentiality, integrity, or availability is low at this stage. However, the dissemination of these IOCs can improve the ability of security teams to identify malicious network activity or payload delivery attempts, potentially reducing the window of exposure to malware infections. Organizations relying on threat intelligence feeds can integrate these IOCs into their security monitoring tools to strengthen defenses. The medium severity rating suggests that while the threat is not critical, ignoring these indicators could allow malware campaigns to go undetected, leading to potential data breaches or service disruptions if the underlying malware is active in the wild. Therefore, the impact is more preventative and intelligence-driven rather than reactive to an ongoing attack.

Defensive guidance

Given the nature of this threat intelligence update, practical mitigation steps include: 1) Integrate the provided IOCs into existing Security Information and Event Management (SIEM) systems, intrusion detection/prevention systems (IDS/IPS), and endpoint detection and response (EDR) tools to enhance detection capabilities. 2) Conduct regular threat hunting exercises using these IOCs to identify any signs of compromise within the network. 3) Maintain up-to-date threat intelligence feeds and ensure that security teams are trained to interpret and act on OSINT-derived indicators. 4) Implement network segmentation and strict egress filtering to limit the impact of potential payload delivery attempts. 5) Continuously monitor network traffic for anomalies that match the IOC patterns, even if no active exploit is currently known. 6) Collaborate with information sharing groups such as national CERTs or industry ISACs to contextualize these IOCs within broader threat landscapes. These steps go beyond generic advice by focusing on operationalizing the intelligence to detect and respond to potential malware activity proactively.

Community reviews

Loading reviews…