IndicatorPublished 27 Aug 2025Updated 28 Aug 2025

type osint · ThreatFox IOCs for 2025-08-27

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 70

macpro.offers-special.comUnknown malware payload delivery domain (confidence level: 100%)
iphone.offers-special.comUnknown malware payload delivery domain (confidence level: 100%)
tdcegypt.comUnknown malware payload delivery domain (confidence level: 100%)
bernnaum.comKongTuke payload delivery domain (confidence level: 100%)
balamand.netAsyncRAT botnet C2 domain (confidence level: 100%)
proxy.messager.myUnknown malware botnet C2 domain (confidence level: 100%)
code.xinzyun.cnCobalt Strike botnet C2 domain (confidence level: 100%)
ec2-3-131-91-218.us-east-2.compute.amazonaws.comCobalt Strike botnet C2 domain (confidence level: 100%)
650c4138-96f4e-80104-9167-81hate8c91b4-671c6hj.comVenom RAT botnet C2 domain (confidence level: 100%)
streetwisecre.duckdns.orgRemcos botnet C2 domain (confidence level: 100%)

URLs 36

http://14.183.132.37:13069/.iUnknown malware payload delivery URL (confidence level: 75%)
https://bernnaum.com/3e2w.jsKongTuke payload delivery URL (confidence level: 100%)
https://bernnaum.com/js.phpKongTuke payload delivery URL (confidence level: 100%)
http://cz57985.tw1.ru/f6b37dd5.phpDCRat botnet C2 (confidence level: 100%)
http://103.176.20.59/ssh.shUnknown malware payload delivery URL (confidence level: 75%)
http://45.230.66.113:11201/mozi.aMozi payload delivery URL (confidence level: 100%)
http://117.216.191.12:56415/mozi.mMozi payload delivery URL (confidence level: 100%)
https://climjuw.top/qodzLumma Stealer botnet C2 (confidence level: 100%)
https://t.me/yahromaaLumma Stealer botnet C2 (confidence level: 75%)
http://212.22.86.82:2020/19KongTuke payload delivery URL (confidence level: 100%)

IP addresses 162

47.109.178.168Cobalt Strike botnet C2 server (confidence level: 100%)
23.158.24.11Cobalt Strike botnet C2 server (confidence level: 100%)
118.178.184.25Cobalt Strike botnet C2 server (confidence level: 100%)
178.16.53.14Remcos botnet C2 server (confidence level: 100%)
142.147.97.158Remcos botnet C2 server (confidence level: 100%)
193.26.115.110Remcos botnet C2 server (confidence level: 100%)
78.40.193.114Sliver botnet C2 server (confidence level: 100%)
84.21.171.168Sliver botnet C2 server (confidence level: 100%)
75.180.193.33Sliver botnet C2 server (confidence level: 100%)
206.123.145.132AsyncRAT botnet C2 server (confidence level: 100%)

Hashes 220

ee6e06262d4c34bf3195c5530bdb206fb900e72ed5ab6cfce83966f3e4d816f3Unknown Stealer payload (confidence level: 100%)
acfeccf79182b40cade0a93497bb90cf9e51e26fValleyRAT payload (confidence level: 95%)
b34998b5835cd4ae700f598e1f6f04de187b7961c70d6ab0bcb739e445511664ValleyRAT payload (confidence level: 95%)
ff814f53d2a408e28374568374aaf261ValleyRAT payload (confidence level: 95%)
6b95bfd57825eaded6dbdc10f832e9bba621395bLoki Password Stealer (PWS) payload (confidence level: 95%)
52490cd234f8c843caff07c58f0a7a3436b45cc8fc6cb02d90acf81292c2fe56Loki Password Stealer (PWS) payload (confidence level: 95%)
1a07cd6143dceb3a60755332483db83bLoki Password Stealer (PWS) payload (confidence level: 95%)
352efe38841ffce8bc004aac1d963b00021b6bceFormbook payload (confidence level: 95%)
43b7af364ccc7ea2429a97efa9be4a191f779668fa39e6bd840efd815d500d30Formbook payload (confidence level: 95%)
c535c66b52cdebbb85dd349f135cc803Formbook payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-08-27

Impact

For European organizations, the impact of this threat could manifest primarily through network-based malware infections that may lead to unauthorized payload delivery. Given the lack of specific affected products or versions, the threat could potentially target a broad range of systems, especially those relying on open-source intelligence tools or network services susceptible to payload delivery attacks. The medium severity indicates a moderate risk to confidentiality, integrity, and availability, with possible disruptions in network operations or data compromise if exploited. The absence of known exploits in the wild reduces immediate risk but does not eliminate the potential for future exploitation. European entities involved in critical infrastructure, government, or sectors heavily reliant on network communications and OSINT tools should be vigilant. The threat could facilitate espionage, data exfiltration, or service disruption if leveraged by adversaries, impacting operational continuity and data security within the region.

Defensive guidance

Given the lack of specific patches or detailed technical indicators, European organizations should adopt a layered defense strategy focusing on network monitoring and threat intelligence integration. Practical steps include: 1) Enhancing network traffic analysis to detect unusual payload delivery patterns or anomalous network activity associated with OSINT tools. 2) Integrating ThreatFox and other MISP feeds into Security Information and Event Management (SIEM) systems to stay updated on emerging IOCs. 3) Conducting regular threat hunting exercises focusing on network-based malware delivery vectors. 4) Implementing strict access controls and network segmentation to limit the spread of potential infections. 5) Ensuring endpoint protection solutions are configured to detect and block unknown or suspicious payloads. 6) Training security teams on recognizing OSINT-related threat patterns and maintaining readiness for emerging malware threats. These measures go beyond generic advice by emphasizing proactive network defense and intelligence-driven detection tailored to the threat’s characteristics.

Community reviews

Loading reviews…