IndicatorPublished 16 Aug 2025Updated 17 Aug 2025

type osint · ThreatFox IOCs for 2025-08-16

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 94

storage.givescash.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
security.flqaergwaard.comUnknown malware payload delivery domain (confidence level: 100%)
bonzevud.comUnknown malware payload delivery domain (confidence level: 100%)
api.signatureofdocs.cfdUnknown Stealer botnet C2 domain (confidence level: 100%)
cdoventures.comUnknown malware payload delivery domain (confidence level: 100%)
cwcstudios.comUnknown malware payload delivery domain (confidence level: 100%)
laceyanns.comUnknown malware payload delivery domain (confidence level: 100%)
stefanchik.comUnknown malware payload delivery domain (confidence level: 100%)
smtp.mx.plex.nameVidar botnet C2 domain (confidence level: 75%)
gitcompay.comCobalt Strike botnet C2 domain (confidence level: 75%)

URLs 145

https://global-weekends.net/res/inchcherryUnknown malware payload delivery URL (confidence level: 100%)
https://pub-b680817c5e87467b9602e0c8aed50af2.r2.dev/hubsign.exeUnknown Stealer payload delivery URL (confidence level: 100%)
https://smtp.mx.plex.nameVidar botnet C2 (confidence level: 75%)
https://hannuxb.top/qpwdLumma Stealer botnet C2 (confidence level: 100%)
http://wseveneleven.shopStealc botnet C2 (confidence level: 100%)
http://a1155962.xsph.ru/e012a92b.phpDCRat botnet C2 (confidence level: 100%)
https://ai.api.plex.nameVidar botnet C2 (confidence level: 75%)
https://www.urua.fedor-turin.ru/loginLumma Stealer botnet C2 (confidence level: 50%)
https://market-lumma.ru/loginLumma Stealer botnet C2 (confidence level: 50%)
https://www.wwwdemo.sasha-solzhenicyn.ru/loginLumma Stealer botnet C2 (confidence level: 50%)

IP addresses 188

123.129.11.33Loki Password Stealer (PWS) botnet C2 server (confidence level: 75%)
134.122.129.114Ghost RAT botnet C2 server (confidence level: 100%)
8.149.232.114Ghost RAT botnet C2 server (confidence level: 100%)
49.113.73.134Unknown malware botnet C2 server (confidence level: 100%)
160.176.103.2AsyncRAT botnet C2 server (confidence level: 100%)
45.74.10.38AsyncRAT botnet C2 server (confidence level: 100%)
78.138.9.69Unknown malware botnet C2 server (confidence level: 100%)
95.112.32.154Unknown malware botnet C2 server (confidence level: 100%)
187.201.123.181Quasar RAT botnet C2 server (confidence level: 100%)
187.34.182.161Venom RAT botnet C2 server (confidence level: 100%)

Hashes 6

c755b506126884848311acb4a1afbf8c7f982fa676d98d087543d22d783aa65dUnknown malware payload (confidence level: 100%)
18197329585578ec9ecd532e26d6ce125eda995aeafc731348cb6ab6e67ed269Unknown malware payload (confidence level: 100%)
552a06384a906e80ea286b939f115b11da9e05766b7c36a6c0c1514acaa446f5Unknown Stealer payload (confidence level: 100%)
f788cb3d8e4196bb14c0519514e4bcf8a6a7a927a9bde076fb37f7791f81c786Unknown Stealer payload (confidence level: 100%)
9eb455f5cb11524b029606e363114516fb1b1b163dd2c2d7dd13924da7f6c9b5Unknown Stealer payload (confidence level: 100%)
f1aab0e549cfc55334adc4e527a74d607b6f1fd38289ed88ece3db2c24da6654Unknown Stealer payload (confidence level: 100%)

Description

ThreatFox IOCs for 2025-08-16

Impact

For European organizations, the impact of this threat is currently assessed as moderate due to the medium severity rating and lack of known active exploitation. The malware's payload delivery and network activity components could potentially lead to unauthorized access, data exfiltration, or disruption if successfully deployed. However, the absence of detailed exploit information and known active campaigns reduces immediate risk. European entities involved in critical infrastructure, finance, or government sectors should remain vigilant, as these sectors are often targeted by malware campaigns. The threat's distribution level suggests it could spread across networks, potentially affecting multiple organizations if leveraged in future attacks. The lack of patches implies that if exploitation methods become known, remediation might require alternative defensive measures. Overall, the threat represents a moderate risk that could escalate if further technical details or active exploitation emerge.

Defensive guidance

Given the limited technical details and absence of patches, European organizations should implement layered defensive strategies beyond generic advice. Specifically, they should: 1) Enhance network monitoring to detect unusual payload delivery and network activity patterns, leveraging threat intelligence feeds such as ThreatFox for updated IOCs. 2) Employ advanced endpoint detection and response (EDR) solutions capable of identifying suspicious behaviors associated with malware payload delivery. 3) Conduct regular threat hunting exercises focusing on network anomalies and potential malware indicators, even in the absence of known IOCs. 4) Maintain strict network segmentation to limit lateral movement in case of infection. 5) Ensure timely application of security updates for all software and systems to reduce exposure to potential exploitation vectors that may be revealed later. 6) Train staff on recognizing phishing and social engineering tactics that often serve as initial infection vectors for malware. 7) Collaborate with national cybersecurity centers and information sharing organizations to receive timely alerts and mitigation guidance as more information becomes available.

Community reviews

Loading reviews…