IndicatorPublished 14 Sep 2025Updated 15 Sep 2025

type osint · ThreatFox IOCs for 2025-09-14

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 87

good.tatyziu58.ruClearFake payload delivery domain (confidence level: 100%)
wow.kuvuboa29.ruClearFake payload delivery domain (confidence level: 100%)
left.kuvuboa29.ruClearFake payload delivery domain (confidence level: 100%)
pit.kuvuboa29.ruClearFake payload delivery domain (confidence level: 100%)
wear.kuvuboa29.ruClearFake payload delivery domain (confidence level: 100%)
1-password.proUnknown Loader payload delivery domain (confidence level: 90%)
adspower.proUnknown Loader payload delivery domain (confidence level: 90%)
clickstime.proUnknown Loader payload delivery domain (confidence level: 90%)
ssn-verify.proUnknown Loader payload delivery domain (confidence level: 90%)
make.nugawye78.ruClearFake payload delivery domain (confidence level: 100%)

URLs 25

https://wbm.amajed.comVidar botnet C2 (confidence level: 75%)
https://wbm.schermgebroken.nlVidar botnet C2 (confidence level: 75%)
https://hoobow.asia/aoozLumma Stealer botnet C2 (confidence level: 75%)
https://t.me/kalinkaopalsqeweLumma Stealer botnet C2 (confidence level: 75%)
http://114.132.169.168:80/faogCobalt Strike botnet C2 (confidence level: 75%)
https://jackaw.asia/xjaoLumma Stealer botnet C2 (confidence level: 100%)
https://genpyb.asia/qweoLumma Stealer botnet C2 (confidence level: 100%)
https://openai-diversifies-with-ai.com:6343/gateway/8k9xlxs5.vtcl8Rhadamanthys botnet C2 (confidence level: 100%)
http://178.16.53.243:6343/gateway/3mh6oe84.n0756Rhadamanthys botnet C2 (confidence level: 100%)
http://178.128.219.58:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)

IP addresses 207

154.205.9.53Cobalt Strike botnet C2 server (confidence level: 100%)
114.132.245.97Cobalt Strike botnet C2 server (confidence level: 100%)
108.187.6.165Ghost RAT botnet C2 server (confidence level: 100%)
206.123.152.34Remcos botnet C2 server (confidence level: 100%)
108.129.219.36Havoc botnet C2 server (confidence level: 100%)
194.87.238.216DCRat botnet C2 server (confidence level: 100%)
157.175.166.224NetSupportManager RAT botnet C2 server (confidence level: 100%)
38.146.28.85Unknown malware botnet C2 server (confidence level: 100%)
154.36.175.172AdaptixC2 botnet C2 server (confidence level: 100%)
147.93.177.187XWorm botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-09-14

Impact

For European organizations, the impact of this threat intelligence update is primarily in enhancing situational awareness and improving detection capabilities against malware-related network activity and payload delivery attempts. Since no specific exploit or vulnerability is described, the direct risk to confidentiality, integrity, or availability is not immediately quantifiable. However, organizations that fail to integrate such threat intelligence into their security monitoring may miss early warning signs of malware campaigns or network intrusions. The medium severity rating suggests a moderate risk level, implying that while the threat is not currently critical, it could facilitate or indicate ongoing or emerging malicious activities. European entities with mature security operations centers (SOCs) and threat intelligence teams can leverage these IOCs to strengthen defenses, whereas less-prepared organizations might face increased exposure to malware infections or data breaches if they do not act on this intelligence.

Defensive guidance

To effectively mitigate risks associated with this threat intelligence, European organizations should: 1) Integrate the provided IOCs into existing security information and event management (SIEM) systems and intrusion detection/prevention systems (IDS/IPS) to enable automated detection and alerting on related malicious activity. 2) Conduct regular network traffic analysis focusing on payload delivery mechanisms and anomalous network behaviors that align with the indicators. 3) Enhance endpoint detection and response (EDR) capabilities to identify and contain malware infections early. 4) Maintain updated threat intelligence feeds and ensure timely dissemination of relevant IOCs to all security teams. 5) Conduct targeted user awareness training emphasizing phishing and social engineering tactics that often serve as initial infection vectors for malware payload delivery. 6) Perform periodic threat hunting exercises using the IOCs to proactively identify potential compromises. These steps go beyond generic advice by emphasizing operational integration of threat intelligence and proactive detection strategies tailored to the nature of the provided data.

Community reviews

Loading reviews…