IndicatorPublished 8 Aug 2025Updated 9 Aug 2025

type osint · ThreatFox IOCs for 2025-08-08

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 38

security.flaezguered.comUnknown malware payload delivery domain (confidence level: 100%)
neopendas.comUnknown malware payload delivery domain (confidence level: 100%)
ftp.project-w.xyzHavoc botnet C2 domain (confidence level: 100%)
abcdef.886802.xyzCobalt Strike botnet C2 domain (confidence level: 75%)
176-58-109-21.ip.linodeusercontent.comAres botnet C2 domain (confidence level: 90%)
ferrariworldabudhabi.proUnknown Loader payload delivery domain (confidence level: 90%)
banki-ru.proUnknown Loader payload delivery domain (confidence level: 90%)
association-fairfield.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
properties-lf.gl.at.ply.ggRemcos botnet C2 domain (confidence level: 100%)
center-mpeg.gl.at.ply.ggAsyncRAT botnet C2 domain (confidence level: 100%)

URLs 16

http://193.143.1.189Stealc botnet C2 (confidence level: 100%)
http://2.57.241.6:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://cs.xfdaili.com:443/jquery-3.3.1.min.jsCobalt Strike botnet C2 (confidence level: 75%)
http://cs.xfdaili.com:443/jquery-3.3.2.slim.min.jsCobalt Strike botnet C2 (confidence level: 75%)
https://s3.cdn.k22digital.my.idVidar botnet C2 (confidence level: 75%)
http://055871cm.nyash.es/vmpipephphttpupdateauthgameserver.phpDCRat botnet C2 (confidence level: 100%)
https://i1.out.k22digital.my.idVidar botnet C2 (confidence level: 75%)
http://closeddoors.shop/45cc90de006049c9.phpStealc botnet C2 (confidence level: 100%)
https://pattemqr.qpon/lgkdLumma Stealer botnet C2 (confidence level: 100%)
https://t.me/yahherhayLumma Stealer botnet C2 (confidence level: 75%)

IP addresses 431

117.72.209.44Cobalt Strike botnet C2 server (confidence level: 100%)
103.214.172.80Cobalt Strike botnet C2 server (confidence level: 100%)
143.92.37.185Ghost RAT botnet C2 server (confidence level: 100%)
206.123.152.39Remcos botnet C2 server (confidence level: 100%)
45.138.16.131AsyncRAT botnet C2 server (confidence level: 100%)
193.29.13.58SectopRAT botnet C2 server (confidence level: 100%)
45.133.251.1Hook botnet C2 server (confidence level: 100%)
187.201.123.181Quasar RAT botnet C2 server (confidence level: 100%)
187.201.123.181Quasar RAT botnet C2 server (confidence level: 100%)
187.201.123.181Quasar RAT botnet C2 server (confidence level: 100%)

Hashes 184

7142ab4c2a50a9c423200ac493fc32f5e2939a60028f84e75ef7661264c117ebCobalt Strike payload (confidence level: 100%)
58574f2a99d2d951a4f1384a2695d634635d79f68985dafefd69b573a222c6c6Mirai payload (confidence level: 100%)
106897c6d275b67781760a8367bad06f98f3fe8fc00e29f7926afe64fabaafb6Mirai payload (confidence level: 100%)
802b809fd820e3bfdb7ccd1f12e1d67800834563ebed30bf195c7baaf61b6f17Mirai payload (confidence level: 100%)
98f6eb636832e43224c90d5155a81449e55711d58730032b42b2cac6c22fd178Mirai payload (confidence level: 100%)
a2094e890494457c6e8d997fcc1b9461ab8b4e8b4a1b6fff783d6fd8446d4c91Mirai payload (confidence level: 100%)
911b426670513d423cdf8710e673b8d0753ea34ba71b60bf78ac78f834c6c9adMirai payload (confidence level: 100%)
8f0484e010f85acfdffcfb315d89d0a9dfd61635d6e47453261e4bee5efe4359Mirai payload (confidence level: 100%)
58a6181168dd4709e4f5d6a9db8e5ee95d1bc3a33f23b2804bc2a5b1b0de1d0cQuasar RAT payload (confidence level: 100%)
97e949353cae01e601a34f78ca1dea3c847a233438baec338c8084946d76b60dQuasar RAT payload (confidence level: 100%)

Description

ThreatFox IOCs for 2025-08-08

Impact

For European organizations, the impact of this threat is currently ambiguous due to the lack of detailed technical information. However, given the medium severity and the focus on payload delivery and network activity, there is a potential risk of malware infections that could compromise confidentiality, integrity, or availability of systems if the payloads are successfully delivered and executed. The use of OSINT techniques may indicate targeted reconnaissance efforts against organizations, which could precede more sophisticated attacks. European entities involved in critical infrastructure, finance, or government sectors might be at higher risk if attackers leverage these IOCs to tailor attacks. The absence of known exploits in the wild reduces immediate risk but does not eliminate the possibility of future exploitation. Organizations might experience increased network noise or attempts at intrusion that could strain security monitoring resources.

Defensive guidance

Given the general nature of the threat, European organizations should enhance their network monitoring and threat intelligence capabilities to detect and respond to suspicious payload delivery attempts. Specific recommendations include: 1) Integrate the latest ThreatFox IOCs into Security Information and Event Management (SIEM) and Intrusion Detection/Prevention Systems (IDS/IPS) to improve detection accuracy. 2) Conduct regular network traffic analysis focusing on unusual or unauthorized payload delivery patterns, especially those matching OSINT-related reconnaissance behaviors. 3) Employ network segmentation and strict access controls to limit the spread and impact of potential malware infections. 4) Maintain up-to-date endpoint protection solutions capable of detecting and blocking known and unknown malware payloads. 5) Train security teams to recognize and respond to emerging threats indicated by OSINT feeds, emphasizing proactive threat hunting. 6) Collaborate with national and European cybersecurity centers to share intelligence and receive timely updates on evolving threats. These measures go beyond generic advice by focusing on leveraging the specific intelligence feed and enhancing detection and response capabilities tailored to payload delivery and network activity threats.

Community reviews

Loading reviews…