IndicatorPublished 10 Aug 2025Updated 11 Aug 2025

type osint · ThreatFox IOCs for 2025-08-10

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 56

trust.scriptobject.comFAKEUPDATES payload delivery domain (confidence level: 100%)
security.flsaregursd.comUnknown malware payload delivery domain (confidence level: 100%)
kopenbal.comUnknown malware payload delivery domain (confidence level: 100%)
ftp.aigirlfriend.altervista.orgUnknown malware botnet C2 domain (confidence level: 100%)
client.hosthlior.comCobalt Strike botnet C2 domain (confidence level: 75%)
ex9.ccCobalt Strike botnet C2 domain (confidence level: 100%)
c2.b1o.itUnknown malware botnet C2 domain (confidence level: 100%)
h90.wpherc.devAres botnet C2 domain (confidence level: 90%)
design-jordan.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
australia-additionally.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)

URLs 12

https://panlos.forum/fudx/apiLumma Stealer botnet C2 (confidence level: 100%)
http://95.217.127.138Stealc botnet C2 (confidence level: 100%)
http://kjt.hu/wp-admin/images/panel/gate.phpPony botnet C2 (confidence level: 100%)
https://xs.sx.polarissonic.biz.idVidar botnet C2 (confidence level: 75%)
https://carasvxz.forum/towi/apiLumma Stealer botnet C2 (confidence level: 100%)
http://201906cm.nyash.es/pipejavascripthttpprocessprocessorflowerasyncwordpresscentraltemporary.phpDCRat botnet C2 (confidence level: 100%)
https://db.polarissonic.biz.idVidar botnet C2 (confidence level: 75%)
http://209.38.214.215:443/bcnjCobalt Strike botnet C2 (confidence level: 75%)
https://quagkmz.top/iwoqLumma Stealer botnet C2 (confidence level: 75%)
https://t.me/fsdfggggdtLumma Stealer botnet C2 (confidence level: 75%)

IP addresses 93

193.42.110.121FAKEUPDATES payload delivery server (confidence level: 100%)
107.175.88.72Remcos botnet C2 server (confidence level: 100%)
216.250.250.246Remcos botnet C2 server (confidence level: 100%)
46.137.225.200FAKEUPDATES botnet C2 server (confidence level: 100%)
195.133.1.120AdaptixC2 botnet C2 server (confidence level: 100%)
58.215.252.68Xtreme RAT botnet C2 server (confidence level: 100%)
147.50.253.17XWorm botnet C2 server (confidence level: 100%)
185.241.208.142XWorm botnet C2 server (confidence level: 100%)
193.161.193.99Quasar RAT botnet C2 server (confidence level: 100%)
185.129.199.75Quasar RAT botnet C2 server (confidence level: 75%)

Hashes 225

57cc201cf4cb5d243cc2bc01e1727f943ba17ac2Quasar RAT payload (confidence level: 95%)
4e56441b9bbd11e64810552965d0f476d3a56e3e1d40e36a763507f33ad69f01Quasar RAT payload (confidence level: 95%)
e3d3988afa329938351c51f0ca31d677Quasar RAT payload (confidence level: 95%)
53241663c11a155b6d047beaffa7dca35b7fe835Typhon Stealer payload (confidence level: 95%)
57860dbded301cb04da8855e742729ca69021a125574a65e37d6c95c027a7cdfTyphon Stealer payload (confidence level: 95%)
eec796f19e80b6ef876217910b434896Typhon Stealer payload (confidence level: 95%)
571bf309ef1af9cf946deb6ce6217c97e4f85d45XWorm payload (confidence level: 95%)
ca046e33fb820cd73683ba49f78a432518072c278187fe46973fbbfbfbea1387XWorm payload (confidence level: 95%)
e34dd1cc798befa9b241f84706327144XWorm payload (confidence level: 95%)
69ae8af0412f94ac0722842b94c94c5cfa508f06XWorm payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-08-10

Impact

For European organizations, the impact of this threat is currently limited due to the lack of specific actionable indicators or known exploits. Since no particular software or hardware is identified as vulnerable, and no active exploitation is reported, the immediate risk is low to medium. However, the presence of IOCs related to payload delivery and network activity suggests that these indicators could be used by security teams to enhance detection capabilities. If these IOCs correspond to emerging malware campaigns, organizations could face risks such as data exfiltration, service disruption, or unauthorized access if they fail to monitor and respond appropriately. The medium severity rating implies a moderate potential for impact, primarily through network-based threats that could affect confidentiality and availability if exploited. European organizations should remain vigilant, especially those in sectors with high exposure to network threats, such as finance, critical infrastructure, and government.

Defensive guidance

Given the nature of this threat as an OSINT IOC update without specific exploit details, mitigation should focus on enhancing detection and response capabilities. Organizations should: 1) Integrate the provided IOCs into their Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to improve monitoring for related malicious activity. 2) Conduct network traffic analysis to identify unusual payload delivery attempts or suspicious network behavior aligned with the IOCs. 3) Maintain up-to-date threat intelligence feeds and collaborate with information sharing groups to receive timely updates. 4) Implement strict network segmentation and access controls to limit potential lateral movement if an infection occurs. 5) Conduct regular security awareness training to reduce the risk of successful payload delivery via phishing or social engineering. 6) Since no patches are available, focus on hardening systems and applying best practices for malware prevention and detection. These steps go beyond generic advice by emphasizing proactive IOC integration and network behavior analysis tailored to the threat's characteristics.

Community reviews

Loading reviews…