IndicatorPublished 21 Aug 2025Updated 22 Aug 2025

type osint · ThreatFox IOCs for 2025-08-21

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 46

mail.messager.myUnknown malware botnet C2 domain (confidence level: 100%)
favicon.messager.myUnknown malware botnet C2 domain (confidence level: 100%)
sefaword.commagecart credit card skimming domain (confidence level: 100%)
bbs.blyyzs.comCobalt Strike botnet C2 domain (confidence level: 100%)
www.ueuser.comCobalt Strike botnet C2 domain (confidence level: 100%)
devhdfcbank.comHavoc botnet C2 domain (confidence level: 100%)
rootyas.messager.myUnknown malware botnet C2 domain (confidence level: 100%)
kws4-1.messager.myUnknown malware botnet C2 domain (confidence level: 100%)
kws2.messager.myUnknown malware botnet C2 domain (confidence level: 100%)
too-decorating.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)

URLs 26

https://185.10.17.38/#/loginGOTROJ botnet C2 (confidence level: 50%)
https://theisfjr.top/qiirLumma Stealer botnet C2 (confidence level: 50%)
https://t.me/modifyxzLumma Stealer botnet C2 (confidence level: 100%)
http://ca33575.tw1.ru/4a2b4413.phpDCRat botnet C2 (confidence level: 100%)
http://cx98298.tw1.ru/bd9bf15c.phpDCRat botnet C2 (confidence level: 100%)
https://designtitle.xyz/mxi.phpUnknown Loader botnet C2 (confidence level: 100%)
http://cg95189.tw1.ru/94eb6e28.phpDCRat botnet C2 (confidence level: 100%)
https://bee496bd.pythonanywhere.com/static/systemui.jpgLumma Stealer payload delivery URL (confidence level: 100%)
https://94.142.138.179/518893e599328c52.phpStealc botnet C2 (confidence level: 50%)
http://110.164.93.43/attivita/index.phpAmadey botnet C2 (confidence level: 50%)

IP addresses 396

178.16.55.53Cobalt Strike botnet C2 server (confidence level: 100%)
185.243.115.127Unknown RAT botnet C2 server (confidence level: 100%)
23.239.17.165Sliver botnet C2 server (confidence level: 100%)
20.42.107.78Unknown malware botnet C2 server (confidence level: 100%)
178.17.57.11Hook botnet C2 server (confidence level: 100%)
193.58.121.7Hook botnet C2 server (confidence level: 100%)
187.201.97.119Quasar RAT botnet C2 server (confidence level: 100%)
187.201.97.119Quasar RAT botnet C2 server (confidence level: 100%)
187.201.97.119Quasar RAT botnet C2 server (confidence level: 100%)
187.201.97.119Quasar RAT botnet C2 server (confidence level: 100%)

Hashes 3

f1b11dc83c398b1d7c606f7f5a181b8b76cd54dcce88bbec3fafb108bf04809cBroomstick payload (confidence level: 100%)
e0b465d3bd1ec5e95aee016951d55640XenoRAT payload (confidence level: 100%)
5ab23ac79ede02166d6f5013d89738f9XenoRAT payload (confidence level: 100%)

Description

ThreatFox IOCs for 2025-08-21

Impact

For European organizations, the impact of this threat depends largely on the nature of the payloads delivered and the network activity involved. Since the threat involves payload delivery and network activity, it could potentially lead to unauthorized access, data exfiltration, or disruption of services if the payloads are successfully executed. However, the absence of known exploits in the wild and the medium severity rating suggest that immediate risk is moderate. Organizations with extensive network exposure or those operating critical infrastructure could face increased risk if attackers leverage these IOCs to facilitate targeted attacks. The lack of patch availability indicates that mitigation may rely on detection and response capabilities rather than straightforward software updates. European organizations should be aware that such OSINT-based threat intelligence can signal emerging tactics or campaigns that may evolve into more severe threats, especially in sectors with high-value data or critical operational technology.

Defensive guidance

Given the nature of this threat as an OSINT-derived set of IOCs related to network activity and payload delivery, European organizations should focus on enhancing their detection and response capabilities. Specific recommendations include: 1) Integrate the provided IOCs into existing Security Information and Event Management (SIEM) and Endpoint Detection and Response (EDR) systems to improve detection of suspicious network traffic and payload delivery attempts. 2) Conduct network segmentation to limit the lateral movement potential of any payloads that may be delivered. 3) Employ strict egress and ingress filtering to reduce exposure to malicious network activity. 4) Regularly update and tune intrusion detection and prevention systems (IDS/IPS) to recognize emerging threat patterns. 5) Train security teams to analyze and respond to OSINT feeds proactively, correlating them with internal telemetry. 6) Maintain robust incident response plans that include procedures for handling payload delivery and network intrusion scenarios. 7) Since no patches are available, emphasize preventive controls such as application whitelisting and least privilege principles to reduce the impact of any successful payload execution.

Community reviews

Loading reviews…