IndicatorPublished 30 Aug 2025Updated 31 Aug 2025

type osint · ThreatFox IOCs for 2025-08-30

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 87

butizio6.ruClearFake payload delivery domain (confidence level: 100%)
pufunyo3.ruClearFake payload delivery domain (confidence level: 100%)
kimmenkiz.ruLumma Stealer botnet C2 domain (confidence level: 100%)
dabafuo6.ruClearFake payload delivery domain (confidence level: 100%)
zupbyupmlh.duckdns.orgAgent Tesla botnet C2 domain (confidence level: 75%)
dewuhou7.ruClearFake payload delivery domain (confidence level: 100%)
kerubuo3.ruClearFake payload delivery domain (confidence level: 100%)
jumivue6.ruClearFake payload delivery domain (confidence level: 100%)
gysehiy1.ruClearFake payload delivery domain (confidence level: 100%)
musicoo1.ruClearFake payload delivery domain (confidence level: 100%)

URLs 22

https://103.245.231.209/gateway/xhko7xq5.hlhhcRhadamanthys botnet C2 (confidence level: 100%)
https://37.101.voltexpressdelivery.comVidar botnet C2 (confidence level: 75%)
http://185.176.94.6/1.shUnknown malware payload delivery URL (confidence level: 75%)
http://193.38.248.139Stealc botnet C2 (confidence level: 100%)
http://87.120.126.205Stealc botnet C2 (confidence level: 100%)
http://a1163093.xsph.ru/fa795482.phpDCRat botnet C2 (confidence level: 100%)
http://a1163887.xsph.ru/9487a7ef.phpDCRat botnet C2 (confidence level: 100%)
https://limcuz.ru/wotrLumma Stealer botnet C2 (confidence level: 100%)
https://52.64.voltexpressdelivery.comVidar botnet C2 (confidence level: 75%)
http://tinarox.com:1337Unknown Stealer botnet C2 (confidence level: 100%)

IP addresses 188

185.157.160.198XWorm botnet C2 server (confidence level: 100%)
103.245.231.209Rhadamanthys botnet C2 server (confidence level: 100%)
179.43.186.243Cobalt Strike botnet C2 server (confidence level: 100%)
43.255.158.38Cobalt Strike botnet C2 server (confidence level: 100%)
39.101.176.177Cobalt Strike botnet C2 server (confidence level: 100%)
39.101.176.177Cobalt Strike botnet C2 server (confidence level: 100%)
178.16.53.117Latrodectus botnet C2 server (confidence level: 100%)
118.128.151.57Ghost RAT botnet C2 server (confidence level: 100%)
114.66.59.242Ghost RAT botnet C2 server (confidence level: 100%)
185.240.104.83DarkComet botnet C2 server (confidence level: 100%)

Hashes 240

ec53ba9e3842881124551006f72bebb9635d92ebPony payload (confidence level: 95%)
1c2b79b3d719dc91f95394c2dbfe8149610ffa668eadec4c491000882dc3b761Pony payload (confidence level: 95%)
2522ee98eb3ea294c9813948111b938bPony payload (confidence level: 95%)
15ce055a242d22181ae4a9111c2bacdb5711555eXWorm payload (confidence level: 95%)
409cc38509aea03c908ff157969a2b948b3a1bd06dac2a9b1014b20fc6ea7139XWorm payload (confidence level: 95%)
5153fac08ad155a42bf04f2a86496d05XWorm payload (confidence level: 95%)
eb271a329a05553c8b62aacdd82345af52de65c4Luca Stealer payload (confidence level: 95%)
4d41b9535a137609d278d8ee3c5cc73e9afa024b9aa2441e0ec8d89cd4a3a234Luca Stealer payload (confidence level: 95%)
347f3ffcaa8ddb9d91bb1bd263ae7639Luca Stealer payload (confidence level: 95%)
85bdec3711afd6bf0bbac5a9cc74d681cc39505bVIP Keylogger payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-08-30

Impact

For European organizations, the impact of this threat is currently moderate due to the lack of detailed exploitation data or known active campaigns. The potential risks include unauthorized network activity and payload delivery that could lead to malware infections, data exfiltration, or disruption of services. Given the OSINT classification, attackers might leverage publicly available information to tailor attacks, increasing the risk of targeted phishing or social engineering campaigns. However, without specific exploit details or known active use, the immediate operational impact is limited. Organizations in sectors with high exposure to network-based threats or those handling sensitive data should remain vigilant, as the threat could evolve or be part of broader reconnaissance efforts preceding more severe attacks.

Defensive guidance

European organizations should enhance monitoring of network traffic for unusual activity, especially focusing on payload delivery mechanisms and suspicious connections that could indicate malware communication. Implementing advanced threat detection solutions that integrate OSINT feeds can help identify emerging indicators early. Regularly updating threat intelligence platforms and correlating with internal logs will improve detection capabilities. Since no patches are available, emphasis should be placed on network segmentation, strict access controls, and user awareness training to reduce the risk of successful payload delivery and lateral movement. Additionally, organizations should validate the integrity of incoming data and employ sandboxing techniques to analyze suspicious payloads before execution. Proactive incident response planning and threat hunting exercises focusing on OSINT-driven attack vectors will further strengthen defenses.

Community reviews

Loading reviews…