IndicatorPublished 26 Aug 2025Updated 27 Aug 2025

type osint · ThreatFox IOCs for 2025-08-26

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 90

cpanel.kickstartyourcakebiz.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
cloudshielders.comUnknown malware payload delivery domain (confidence level: 100%)
g-o-f-y-s-e-l-f.fooUnknown Stealer botnet C2 domain (confidence level: 100%)
madys.netUnknown Stealer botnet C2 domain (confidence level: 100%)
winapi.shopUnknown Stealer botnet C2 domain (confidence level: 100%)
objective-morse.45-138-16-249.plesk.pageHook botnet C2 domain (confidence level: 100%)
highwaytolline.sbsCobalt Strike botnet C2 domain (confidence level: 100%)
cloud.xinzyun.cnCobalt Strike botnet C2 domain (confidence level: 100%)
portal.messager.myUnknown malware botnet C2 domain (confidence level: 100%)
al-touring.gl.at.ply.ggNjRAT botnet C2 domain (confidence level: 50%)

URLs 17

https://cyber-r7jwnkqlrorjs.live/webpanel/panel/login.phpUnknown malware botnet C2 (confidence level: 100%)
https://web-server.x10.mx/webpanel/login.phpUnknown malware botnet C2 (confidence level: 100%)
https://8.218.138.77:8888/Unknown malware botnet C2 (confidence level: 50%)
https://128.199.113.162/cc/index.phpAmadey botnet C2 (confidence level: 50%)
https://nwinsinas.siteKimsuky botnet C2 (confidence level: 50%)
https://cdn.discordapp.com/attachments/1205300519510351957/1227058883047194724/usbdeview.exe?ex=662706a3&is=661491a3&hm=62abfe85378dbd5f36987d76c66d68e760ed392de9efdec1185636781cff1b6f&Unknown Loader payload delivery URL (confidence level: 50%)
https://cdn.discordapp.com/attachments/1396578733489524816/1404180107941253221/1754852376276.png?ex=689a4022&is=6898eea2&hm=a734d08642555af96c70df6f9dfc720ee375e90bb4a4ef41fe0b5de76a0521ce&Unknown Loader payload delivery URL (confidence level: 50%)
https://age-of-wonders-06-2019.com:1888/gateway/87ewrkt3.6uv9wRhadamanthys botnet C2 (confidence level: 100%)
https://nexus-cloud-360.com:1888/gateway/87ewrkt3.6uv9wRhadamanthys botnet C2 (confidence level: 100%)
https://anondrop.net/1409832249968562361/.binXWorm payload delivery URL (confidence level: 100%)

IP addresses 181

45.207.193.76Cobalt Strike botnet C2 server (confidence level: 100%)
8.155.164.40Cobalt Strike botnet C2 server (confidence level: 100%)
69.10.45.244Remcos botnet C2 server (confidence level: 100%)
185.174.101.106Remcos botnet C2 server (confidence level: 100%)
154.205.145.190Remcos botnet C2 server (confidence level: 100%)
209.38.62.126Sliver botnet C2 server (confidence level: 100%)
159.255.36.142Sliver botnet C2 server (confidence level: 100%)
34.132.178.245Unknown malware botnet C2 server (confidence level: 100%)
130.193.41.75Havoc botnet C2 server (confidence level: 100%)
93.140.234.26Chaos botnet C2 server (confidence level: 100%)

Hashes 215

ec2ddc26b9659c708606c83ab342691a48c5c1d0d4183b1facb4791eb02ecd11Unknown Stealer payload (confidence level: 100%)
155bccbd11066ce5bf117537d140b920f9b98eaa0d3b86bdc8a04ac702a7a1efUnknown malware payload (confidence level: 100%)
15d024631277f72df40427b8c50e354b340fac38b468f34826cc613b4650e74cUnknown malware payload (confidence level: 100%)
2c7bc0ebbbfa282fc3ed3598348d361914fecfea027712f47c4f6cfcc705690fUnknown malware payload (confidence level: 100%)
36b065f19f1ac2642c041002bc3e28326bec0aa08d288ca8a2d5c0d7a82b56e6Unknown malware payload (confidence level: 100%)
4dcff9a3a71633d89a887539e5d7a3dd6cc239761e9a42f64f42c5c4209d2829Unknown malware payload (confidence level: 100%)
71dec9789fef835975a209f6bc1a736c4f591e5eeab20bdff63809553085b192Unknown malware payload (confidence level: 100%)
81c1a8e624306c8a66a44bfe341ec70c6e3a3c9e70ac15c7876fcbbe364d01cdUnknown malware payload (confidence level: 100%)
83b27e52c420b6132f8034e7a0fd9943b1f4af3bdb06cdbb873c80360e1e5419Unknown malware payload (confidence level: 100%)
d39e177261ce9a354b4712f820ada3ee8cd84a277f173ecfbd1bf6b100ddb713Unknown malware payload (confidence level: 100%)

Description

ThreatFox IOCs for 2025-08-26

Impact

For European organizations, the impact of this threat is primarily related to the potential for malware infections facilitated through network activity and payload delivery mechanisms. Given the medium severity and lack of known exploits in the wild, the immediate risk of widespread compromise is limited. However, organizations that rely heavily on OSINT tools or have extensive network exposure could face risks of targeted malware delivery attempts. The threat could lead to unauthorized access, data exfiltration, or disruption if payloads are successfully delivered and executed. The lack of patches indicates that mitigation relies on detection and prevention controls rather than software updates. European entities in sectors with high-value data or critical infrastructure could be more sensitive to such threats, especially if attackers leverage these IOCs to craft targeted campaigns.

Defensive guidance

European organizations should enhance their network monitoring capabilities to detect suspicious activities associated with the provided IOCs. Deploying and regularly updating intrusion detection and prevention systems (IDS/IPS) with the latest threat intelligence feeds, including ThreatFox data, is critical. Network segmentation and strict egress filtering can limit the spread and impact of payload delivery attempts. Endpoint detection and response (EDR) solutions should be tuned to identify anomalous behaviors indicative of malware execution. Since no patches are available, organizations must focus on proactive threat hunting and user awareness training to recognize phishing or social engineering attempts that could deliver payloads. Additionally, integrating OSINT-derived IOCs into security information and event management (SIEM) systems will improve early detection. Regular backups and incident response planning remain essential to mitigate potential damage from successful infections.

Community reviews

Loading reviews…