IndicatorPublished 18 Aug 2025Updated 19 Aug 2025

type osint · ThreatFox IOCs for 2025-08-18

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 43

admiring-newton.86-54-42-217.plesk.pageHavoc botnet C2 domain (confidence level: 100%)
cukurukuk.funHavoc botnet C2 domain (confidence level: 100%)
imgs2.messager.myUnknown malware botnet C2 domain (confidence level: 100%)
acm.messager.myUnknown malware botnet C2 domain (confidence level: 100%)
openapi.messager.myUnknown malware botnet C2 domain (confidence level: 100%)
avatars.messager.myUnknown malware botnet C2 domain (confidence level: 100%)
id.rootvk.messager.myUnknown malware botnet C2 domain (confidence level: 100%)
cloud.defenderblt.comCobalt Strike botnet C2 domain (confidence level: 75%)
autodiscover.box.livrocentauros.cfdCobalt Strike botnet C2 domain (confidence level: 100%)
autoconfig.box.livrocentauros.cfdCobalt Strike botnet C2 domain (confidence level: 100%)

URLs 24

http://213.209.150.166/g7hen3xxf/login.phpAmadey botnet C2 (confidence level: 100%)
https://dimijrw.top/xkjdLumma Stealer botnet C2 (confidence level: 75%)
https://t.me/hdjajfjwjfuajLumma Stealer botnet C2 (confidence level: 75%)
http://103.245.231.188/vtubers.shUnknown malware payload delivery URL (confidence level: 75%)
https://type.plex.nameVidar botnet C2 (confidence level: 75%)
http://a1139089.xsph.ru/9bb5ecd9.phpDCRat botnet C2 (confidence level: 100%)
http://cu08926.tw1.ru/d777d38d.phpDCRat botnet C2 (confidence level: 100%)
https://t.dev.drakeinternationalagency.comVidar botnet C2 (confidence level: 75%)
https://certificado.vouserpai.com.br/wp-content/plugins/wp-nasa-registry/index.php?r=bd1odhrwczovl2rxcmridi5jb20vLatrodectus payload delivery URL (confidence level: 95%)
https://www.verdeta.it/wp-content/plugins/wp-open-multinetworked/?r=bd1odhrwczovl2rxcmridi5jb20vLatrodectus payload delivery URL (confidence level: 95%)

IP addresses 137

172.94.9.175Remcos botnet C2 server (confidence level: 100%)
134.122.207.42Unknown malware botnet C2 server (confidence level: 100%)
185.208.159.71AsyncRAT botnet C2 server (confidence level: 100%)
38.180.222.190SectopRAT botnet C2 server (confidence level: 100%)
45.134.26.131Havoc botnet C2 server (confidence level: 100%)
13.48.106.87Havoc botnet C2 server (confidence level: 100%)
102.100.55.208NetSupportManager RAT botnet C2 server (confidence level: 100%)
62.60.226.57Unknown malware botnet C2 server (confidence level: 100%)
52.83.247.39Xtreme RAT botnet C2 server (confidence level: 100%)
121.36.206.156Xtreme RAT botnet C2 server (confidence level: 100%)

Hashes 222

0b68909bb64e7375ca87368182037b9010526ae7XWorm payload (confidence level: 95%)
6566cf90850e894917dfea4674f4bc9d8ef10e667cb9b981ed27dca073b0771eXWorm payload (confidence level: 95%)
0b7082399ec0ab2a8f1bdff01a602f6dXWorm payload (confidence level: 95%)
e36829ac9ab9906ce542d05ff0e7ebc81bb8a807KrakenKeylogger payload (confidence level: 95%)
d3bdfd3d8cf142a243fcecb73a15f683c87e6d1969e559a158c6b3705ed1d4fbKrakenKeylogger payload (confidence level: 95%)
b0bebe8b8e499abfef3b02ff7e0e9f85KrakenKeylogger payload (confidence level: 95%)
ff467712b26a05c0078d7ddcb95b1e4250822bf1Cobalt Strike payload (confidence level: 95%)
951f28fa3b1668bdb2b300dac35138c35776d57955f17031d46fc6802ab14fb4Cobalt Strike payload (confidence level: 95%)
331af0393b908473a004ceaf3e3a78f9Cobalt Strike payload (confidence level: 95%)
32239a96fc8c72c90cef300ed8d33a0f1d37df56Agent Tesla payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-08-18

Impact

For European organizations, the impact of this threat intelligence update is primarily in enhancing situational awareness and improving detection capabilities rather than mitigating an immediate active threat. Since no specific exploit or malware campaign is detailed, the direct risk to confidentiality, integrity, or availability is low at this stage. However, the indicators could be associated with emerging or ongoing threat actor infrastructure used for payload delivery or network reconnaissance. Organizations that incorporate these IOCs into their security monitoring tools can better detect suspicious network activity or payload delivery attempts, potentially preventing future compromise. The medium severity rating suggests that while the threat is not critical, it should not be ignored, especially by organizations with high-value assets or those in sectors frequently targeted by cybercriminals or nation-state actors. The lack of known exploits in the wild reduces immediate urgency but does not preclude future exploitation. Therefore, the impact is more preventive and intelligence-driven rather than reactive to an active incident.

Defensive guidance

Given the nature of this threat as an OSINT IOC update without a specific exploit, mitigation should focus on leveraging the intelligence effectively: 1. Integrate the provided IOCs into existing security information and event management (SIEM) systems, intrusion detection/prevention systems (IDS/IPS), and endpoint detection and response (EDR) tools to enhance detection of related network activity or payload delivery attempts. 2. Conduct regular threat hunting exercises using these IOCs to identify any signs of compromise or suspicious activity within the network. 3. Maintain up-to-date network segmentation and strict access controls to limit the potential impact of any payload delivery or network-based attacks. 4. Ensure robust incident response plans are in place to quickly investigate and respond to alerts triggered by these IOCs. 5. Continuously monitor threat intelligence feeds like ThreatFox to stay informed about evolving threats and update detection rules accordingly. 6. Educate security teams on interpreting and operationalizing OSINT-based IOCs to maximize their utility in proactive defense. These steps go beyond generic advice by emphasizing the operational integration of threat intelligence and proactive threat hunting tailored to the nature of the provided data.

Community reviews

Loading reviews…