IndicatorPublished 15 Aug 2025Updated 16 Aug 2025

type osint · ThreatFox IOCs for 2025-08-15

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 484

documents-here.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
security.flaegrudad.comUnknown malware payload delivery domain (confidence level: 100%)
henzelvab.comUnknown malware payload delivery domain (confidence level: 100%)
dd.death-angel.shopVidar botnet C2 domain (confidence level: 75%)
4kdownload.proUnknown Loader payload delivery domain (confidence level: 90%)
login.infodatasinc.comCobalt Strike botnet C2 domain (confidence level: 75%)
m2th3k.topCobalt Strike botnet C2 domain (confidence level: 75%)
panel.infodatasinc.comCobalt Strike botnet C2 domain (confidence level: 75%)
prod.infodatasinc.comCobalt Strike botnet C2 domain (confidence level: 75%)
channel-expectations.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)

URLs 160

https://srwznongqnbatpxubcqlc.fv/gateway/ka1y74vi.gomspRhadamanthys botnet C2 (confidence level: 100%)
http://telamtykina.live/b9kdj3s3c1/login.phpAmadey botnet C2 (confidence level: 100%)
https://domainweel.com/ajax/pixi.min.jsUnknown malware payload delivery URL (confidence level: 100%)
https://psee.io/7zxg9hUnknown malware payload delivery URL (confidence level: 100%)
https://menslaks.top/wwwap/sunnydayUnknown malware payload delivery URL (confidence level: 100%)
https://dd.death-angel.shopVidar botnet C2 (confidence level: 75%)
http://213.202.208.237/panel/login.phpMars botnet C2 (confidence level: 100%)
https://drespi.top/xdjsLumma Stealer botnet C2 (confidence level: 100%)
http://sskyokker256.bit.md-89.webhostbox.net/wp-content/themes/twentyfuve/au26/gate.phpAzorult botnet C2 (confidence level: 100%)
https://demo.shop.plex.nameVidar botnet C2 (confidence level: 75%)

IP addresses 319

45.144.53.137ResolverRAT botnet C2 server (confidence level: 99%)
106.13.67.162Cobalt Strike botnet C2 server (confidence level: 100%)
3.1.211.57Cobalt Strike botnet C2 server (confidence level: 100%)
72.68.192.55Remcos botnet C2 server (confidence level: 100%)
185.196.10.10Havoc botnet C2 server (confidence level: 100%)
15.237.144.163NetSupportManager RAT botnet C2 server (confidence level: 100%)
118.174.154.230NetSupportManager RAT botnet C2 server (confidence level: 100%)
13.247.58.212NetSupportManager RAT botnet C2 server (confidence level: 100%)
13.247.58.212NetSupportManager RAT botnet C2 server (confidence level: 100%)
43.154.165.170ERMAC botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-08-15

Impact

Given the limited technical details and absence of specific affected systems or exploits, the direct impact on European organizations is difficult to quantify precisely. However, as the threat involves malware with network activity and payload delivery capabilities, there is a potential risk of unauthorized access, data exfiltration, or disruption of services if the malware were to be deployed successfully. European organizations that rely heavily on open-source intelligence tools or networked environments could be at risk if targeted. The medium severity suggests a moderate risk level, possibly indicating that the malware could be used in targeted attacks or campaigns but is not currently widespread or highly destructive. The lack of known exploits in the wild reduces immediate urgency but does not eliminate future risk. Organizations in sectors with high exposure to OSINT tools or those involved in intelligence, defense, or critical infrastructure could face more significant consequences if targeted by such malware.

Defensive guidance

To mitigate this threat effectively, European organizations should enhance their threat intelligence capabilities by integrating feeds like ThreatFox into their security operations centers (SOCs) to detect emerging IOCs promptly. Network monitoring should be intensified to identify unusual payload delivery or network activity patterns associated with OSINT-related malware. Endpoint detection and response (EDR) solutions should be configured to detect suspicious behaviors typical of malware payload delivery. Since no patches are available, organizations should focus on hardening network perimeters, enforcing strict access controls, and applying the principle of least privilege to limit malware propagation. Regular employee training on recognizing phishing or social engineering attempts that could serve as initial infection vectors is also critical. Finally, organizations should establish incident response plans tailored to malware infections involving network activity and payload delivery to minimize impact if an infection occurs.

Community reviews

Loading reviews…