IndicatorPublished 12 Sep 2025Updated 13 Sep 2025

type osint · ThreatFox IOCs for 2025-09-12

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 148

g.kilut4ou8.ruClearFake payload delivery domain (confidence level: 100%)
pink.kuryc7yy1.ruClearFake payload delivery domain (confidence level: 100%)
tiny.kuryc7yy1.ruClearFake payload delivery domain (confidence level: 100%)
vast.kuryc7yy1.ruClearFake payload delivery domain (confidence level: 100%)
neat.kuryc7yy1.ruClearFake payload delivery domain (confidence level: 100%)
ftifiles.work.gdUnknown malware payload delivery domain (confidence level: 100%)
dear.kuryc7yy1.ruClearFake payload delivery domain (confidence level: 100%)
rich.jibiw8aa5.ruClearFake payload delivery domain (confidence level: 100%)
cute.jibiw8aa5.ruClearFake payload delivery domain (confidence level: 100%)
lean.jibiw8aa5.ruClearFake payload delivery domain (confidence level: 100%)

URLs 56

https://realty.yourpgcountyliving.com/pixel.pngFAKEUPDATES botnet C2 (confidence level: 100%)
http://47.99.193.179:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://8.138.155.217:18888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://suctso.asia/xozaLumma Stealer botnet C2 (confidence level: 100%)
https://leauab.asia/xakdLumma Stealer botnet C2 (confidence level: 75%)
https://t.me/romalabs4Lumma Stealer botnet C2 (confidence level: 75%)
https://tot.vumarifa.comVidar botnet C2 (confidence level: 75%)
https://195.201.45.150Vidar botnet C2 (confidence level: 75%)
http://91.208.197.196/ohshit.shUnknown malware payload delivery URL (confidence level: 75%)
http://413426cm.nyash.es/protectflowerdownloads.phpDCRat botnet C2 (confidence level: 100%)

IP addresses 145

157.254.167.144FAKEUPDATES botnet C2 server (confidence level: 100%)
124.221.237.102Cobalt Strike botnet C2 server (confidence level: 100%)
45.66.11.61Remcos botnet C2 server (confidence level: 100%)
216.144.226.242Unknown malware botnet C2 server (confidence level: 100%)
207.154.205.11Unknown malware botnet C2 server (confidence level: 100%)
31.129.42.36Havoc botnet C2 server (confidence level: 100%)
103.20.102.130DCRat botnet C2 server (confidence level: 100%)
185.221.215.43DCRat botnet C2 server (confidence level: 100%)
46.246.84.12DCRat botnet C2 server (confidence level: 100%)
46.246.84.12DCRat botnet C2 server (confidence level: 100%)

Hashes 2

1341bdc1465fdec9d644c23affc85c9a3483e3adaa92739760e920ff7e7cb230Houdini payload (confidence level: 100%)
77f54192232041a16afdc1fac62c2dcf063cd35c6bf4eece9bb214726710f9a8Unknown Stealer payload (confidence level: 100%)

Description

ThreatFox IOCs for 2025-09-12

Impact

For European organizations, the impact of this threat is primarily related to the potential for malware infections that could disrupt network operations or lead to data exfiltration. Given the medium severity and absence of known exploits, immediate critical impact is unlikely; however, the presence of payload delivery and network activity indicators means organizations could face increased risk of malware infiltration if they do not maintain robust network monitoring and endpoint defenses. The lack of specific affected software versions or exploit details means the threat could be broad and opportunistic, targeting common network services or endpoints. European entities in sectors with high exposure to network-based threats, such as finance, telecommunications, and critical infrastructure, may experience operational disruptions or data confidentiality risks if the malware payloads are successfully delivered and executed. The threat intelligence can help organizations enhance detection capabilities and prepare incident response plans to mitigate potential infections.

Defensive guidance

1. Enhance network monitoring to detect unusual payload delivery attempts and anomalous network activity, leveraging threat intelligence feeds including ThreatFox IOCs. 2. Implement strict egress and ingress filtering to limit unauthorized network communications that could facilitate malware command and control. 3. Employ endpoint detection and response (EDR) solutions capable of identifying and blocking malware payloads based on behavioral analysis rather than relying solely on signature-based detection. 4. Conduct regular threat hunting exercises using the latest OSINT and IOC data to proactively identify potential infections. 5. Maintain up-to-date security awareness training for employees to recognize and report suspicious activities that could lead to malware delivery. 6. Since no patches are available, focus on hardening network and endpoint defenses and applying general best practices for malware prevention and containment. 7. Collaborate with national and European cybersecurity centers to share intelligence and receive timely alerts about emerging threats.

Community reviews

Loading reviews…