IndicatorPublished 2 Sep 2025Updated 3 Sep 2025

type osint · ThreatFox IOCs for 2025-09-02

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 152

sbv.gevicii.ruClearFake payload delivery domain (confidence level: 100%)
ung.sewumoa.ruClearFake payload delivery domain (confidence level: 100%)
teb.rilefoo8.ruClearFake payload delivery domain (confidence level: 100%)
cso.burydyu0.ruClearFake payload delivery domain (confidence level: 100%)
nuu.qacacoe3.ruClearFake payload delivery domain (confidence level: 100%)
re.qacacoe3.ruClearFake payload delivery domain (confidence level: 100%)
vc.rogosie4.ruClearFake payload delivery domain (confidence level: 100%)
lm.rogosie4.ruClearFake payload delivery domain (confidence level: 100%)
x-vape.caUnknown malware payload delivery domain (confidence level: 100%)
kl.xoreniu7.ruClearFake payload delivery domain (confidence level: 100%)

URLs 100

http://85.209.129.105:2020/test112KongTuke payload delivery URL (confidence level: 100%)
http://188.245.167.86/second.htmlKongTuke payload delivery URL (confidence level: 100%)
http://discord.com/is-readyHoudini botnet C2 (confidence level: 100%)
http://coffeinoffice.xyz/cup/wish.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)
http://www.kitchenaria.com/modules/gateway2/protx/response.phpPony botnet C2 (confidence level: 100%)
http://134.122.207.42:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://ph.safofoe5.ruUnknown malware payload delivery URL (confidence level: 50%)
https://avast.cucy.ruUnknown malware payload delivery URL (confidence level: 50%)
https://cyber-v10getcyber.live/webpanel/Unknown Stealer botnet C2 (confidence level: 100%)
https://uhcprovider.com.content-provider.temp-perform.top/XWorm botnet C2 (confidence level: 50%)

IP addresses 355

67.220.85.157SparkRAT botnet C2 server (confidence level: 100%)
8.135.13.184Cobalt Strike botnet C2 server (confidence level: 100%)
134.122.189.164Ghost RAT botnet C2 server (confidence level: 100%)
172.245.95.32Remcos botnet C2 server (confidence level: 100%)
195.177.94.33Remcos botnet C2 server (confidence level: 100%)
167.172.190.13Sliver botnet C2 server (confidence level: 100%)
172.94.59.38AsyncRAT botnet C2 server (confidence level: 100%)
194.165.16.8SectopRAT botnet C2 server (confidence level: 100%)
197.224.235.75Unknown malware botnet C2 server (confidence level: 100%)
18.158.94.111Unknown malware botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-09-02

Impact

For European organizations, the impact of this threat is currently uncertain due to the lack of detailed technical information and confirmed exploitation. However, if the malware leverages OSINT for payload delivery and network activity, it could pose risks such as unauthorized data access, network infiltration, or lateral movement within corporate networks. Medium severity suggests a moderate risk level, potentially affecting confidentiality and integrity if successful. The absence of known exploits and patches implies that organizations may not yet be targeted or that detection and prevention measures are still effective. Nonetheless, organizations relying heavily on networked systems and sensitive data could face operational disruptions or data breaches if the threat evolves or is weaponized. The broad TLP:white classification means the information is widely shareable, facilitating community awareness but also potentially alerting adversaries. European entities should remain vigilant, especially those in sectors with high exposure to network-based attacks or those that utilize OSINT tools extensively.

Defensive guidance

Given the limited specifics, mitigation should focus on enhancing network security monitoring and threat intelligence integration. Organizations should: 1) Implement and regularly update network intrusion detection and prevention systems (IDS/IPS) to identify anomalous payload delivery and network activity patterns. 2) Leverage threat intelligence feeds, including ThreatFox and MISP, to update detection signatures and IOC databases promptly. 3) Conduct regular OSINT hygiene reviews to minimize exposure of sensitive information that could be exploited for payload delivery. 4) Enforce strict network segmentation and least privilege access controls to limit lateral movement if compromise occurs. 5) Train security teams to recognize early signs of emerging malware campaigns and encourage information sharing within trusted communities. 6) Maintain up-to-date endpoint protection solutions capable of detecting unknown or emerging malware behaviors. 7) Prepare incident response plans that include procedures for handling OSINT-based payload delivery threats. These measures go beyond generic advice by focusing on proactive intelligence integration, network behavior analysis, and operational readiness tailored to OSINT-related malware threats.

Community reviews

Loading reviews…