IndicatorPublished 3 Sep 2025Updated 4 Sep 2025

type osint · ThreatFox IOCs for 2025-09-03

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 75

rt.tygilyo.ruClearFake payload delivery domain (confidence level: 100%)
tp.sewumoa.ruClearFake payload delivery domain (confidence level: 100%)
hlc.sewumoa.ruClearFake payload delivery domain (confidence level: 100%)
tqx.sewedau.ruClearFake payload delivery domain (confidence level: 100%)
loi.sewumoa.ruClearFake payload delivery domain (confidence level: 100%)
sc.tygilyo.ruClearFake payload delivery domain (confidence level: 100%)
wg.gevicii.ruClearFake payload delivery domain (confidence level: 100%)
gicaway3.ruClearFake payload delivery domain (confidence level: 100%)
erq.vuzojiu9.ruClearFake payload delivery domain (confidence level: 100%)
drg.kidizue6.ruClearFake payload delivery domain (confidence level: 100%)

URLs 18

https://laevuun.top/pqoeLumma Stealer botnet C2 (confidence level: 75%)
https://starexs.bet/tskxLumma Stealer botnet C2 (confidence level: 75%)
https://despisedmny.store/apiLumma Stealer botnet C2 (confidence level: 100%)
http://libertyquality.shopStealc botnet C2 (confidence level: 100%)
https://t.me/romalabs2Lumma Stealer botnet C2 (confidence level: 75%)
http://94.154.35.25:80/di9ku38f/index.phpAmadey botnet C2 (confidence level: 100%)
http://77.83.240.93/wget_telnet.shUnknown malware payload delivery URL (confidence level: 75%)
http://94.154.35.25:80/di9ku38f/login.phpAmadey botnet C2 (confidence level: 100%)
https://louglas.com/4r2w.jsKongTuke payload delivery URL (confidence level: 100%)
https://louglas.com/js.phpKongTuke payload delivery URL (confidence level: 100%)

IP addresses 154

107.148.52.35Cobalt Strike botnet C2 server (confidence level: 100%)
49.234.26.82Sliver botnet C2 server (confidence level: 100%)
109.199.98.37AsyncRAT botnet C2 server (confidence level: 100%)
45.141.215.69AsyncRAT botnet C2 server (confidence level: 100%)
44.244.111.160Havoc botnet C2 server (confidence level: 100%)
198.55.98.77RedLine Stealer botnet C2 server (confidence level: 100%)
121.89.84.19Cobalt Strike botnet C2 server (confidence level: 75%)
69.67.172.235Cobalt Strike botnet C2 server (confidence level: 75%)
178.16.53.7AsyncRAT botnet C2 server (confidence level: 75%)
178.16.53.7AsyncRAT botnet C2 server (confidence level: 75%)

Hashes 214

b17574f674953ca24db6183c90c7c3826ccb1701XWorm payload (confidence level: 95%)
cf51d6c002f3888d63d0acc98231e21468f96bb68264f05c2014e3a9e588e6f0XWorm payload (confidence level: 95%)
8141913d4e30312bb3388c9d991064a9XWorm payload (confidence level: 95%)
41469cc035336c6593ae3dd6049a474ce2444007XWorm payload (confidence level: 95%)
8727308a32fe5bc544074066b76ff9ffd8b47d49c387bf23a471f51c068c7f58XWorm payload (confidence level: 95%)
cdf4a2737fa4555658befb077d941b70XWorm payload (confidence level: 95%)
2f0fcd356817d449d9896ac0e5dc5a1be0be0b19StrelaStealer payload (confidence level: 95%)
3327c66297fef40ab4c8fc527d4100069b01ac665e45bd2683dca2528e915f03StrelaStealer payload (confidence level: 95%)
b84b137b62d19d9020f55615dfa8b320StrelaStealer payload (confidence level: 95%)
15db8f6f375259964547f10eb492683478748b46XWorm payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-09-03

Impact

For European organizations, the potential impact of this threat is moderate but should not be underestimated. Malware associated with payload delivery and network activity can lead to unauthorized access, data exfiltration, disruption of services, or lateral movement within networks. Although no active exploits are currently known, the presence of such IOCs indicates that threat actors may be preparing or testing delivery mechanisms that could be leveraged in targeted attacks. European entities with extensive network infrastructure, especially those in critical sectors such as finance, energy, healthcare, and government, could face risks if the malware payloads evolve or are integrated into more sophisticated campaigns. The absence of patches or specific vulnerable versions means that standard endpoint and network security controls are crucial to detect and prevent infection. Additionally, the open-source nature of the intelligence allows defenders to proactively hunt for related indicators, potentially reducing impact through early detection. However, the medium severity suggests that while the threat is notable, it does not currently pose an immediate high-risk scenario for widespread disruption or data breach.

Defensive guidance

Given the nature of this threat, European organizations should implement targeted mitigation strategies beyond generic advice: 1. Enhance network monitoring to detect unusual payload delivery patterns and network activity, leveraging threat intelligence feeds such as ThreatFox to identify emerging IOCs. 2. Deploy and regularly update endpoint detection and response (EDR) solutions capable of identifying malware behaviors associated with payload delivery and lateral movement. 3. Conduct proactive threat hunting exercises using the latest OSINT data to identify potential compromises early. 4. Implement strict network segmentation to limit malware propagation and restrict command and control communications. 5. Educate security teams on the evolving threat landscape and ensure rapid incident response capabilities are in place to contain infections. 6. Collaborate with national and European cybersecurity information sharing organizations to stay informed about any escalation or new exploit developments related to this threat. 7. Since no patches are available, focus on hardening configurations, applying principle of least privilege, and ensuring robust backup and recovery processes to mitigate potential impacts.

Community reviews

Loading reviews…