IndicatorPublished 18 Sep 2025Updated 19 Sep 2025

type osint · ThreatFox IOCs for 2025-09-18

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 102

retiregenz.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
c.l8o6.ruClearFake payload delivery domain (confidence level: 100%)
bd.j2e6.ruClearFake payload delivery domain (confidence level: 100%)
safecs.iqiyi.qponCobalt Strike botnet C2 domain (confidence level: 75%)
zoe.aztu.edu.azVidar botnet C2 domain (confidence level: 75%)
zoe.demoserviciopcmendoza.com.arVidar botnet C2 domain (confidence level: 75%)
m.j2e6.ruClearFake payload delivery domain (confidence level: 100%)
bb.j2e6.ruClearFake payload delivery domain (confidence level: 100%)
sanercat.comCobalt Strike botnet C2 domain (confidence level: 100%)
k.j2e6.ruClearFake payload delivery domain (confidence level: 100%)

URLs 73

http://144.31.221.122:6060/capcha9856KongTuke payload delivery URL (confidence level: 100%)
http://144.31.221.122:6060/19KongTuke payload delivery URL (confidence level: 100%)
https://vitambio.shop/xakdLumma Stealer botnet C2 (confidence level: 100%)
https://retiregenz.com/d.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://everyday2gether.info/res/ethicsNetSupportManager RAT payload delivery URL (confidence level: 100%)
http://210.56.48.32:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://zoe.aztu.edu.azVidar botnet C2 (confidence level: 75%)
https://zoe.demoserviciopcmendoza.com.arVidar botnet C2 (confidence level: 75%)
https://porsasystem.com/6m9x.jsKongTuke payload delivery URL (confidence level: 100%)
https://porsasystem.com/js.phpKongTuke payload delivery URL (confidence level: 100%)

IP addresses 1,292

45.241.132.125XWorm botnet C2 server (confidence level: 100%)
45.241.132.125XWorm botnet C2 server (confidence level: 100%)
89.213.174.225Mirai botnet C2 server (confidence level: 100%)
45.143.222.10Loki Password Stealer (PWS) botnet C2 server (confidence level: 75%)
202.181.24.76Cobalt Strike botnet C2 server (confidence level: 100%)
1.15.174.189Cobalt Strike botnet C2 server (confidence level: 100%)
8.138.0.44Cobalt Strike botnet C2 server (confidence level: 100%)
212.83.139.101Remcos botnet C2 server (confidence level: 100%)
20.206.242.70Remcos botnet C2 server (confidence level: 100%)
89.40.104.163Unknown RAT botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-09-18

Impact

For European organizations, the impact of this threat is currently ambiguous due to the lack of detailed technical information and absence of known active exploitation. However, given its classification as malware involving network activity and payload delivery, there is a potential risk of unauthorized access, data exfiltration, or disruption of services if the malware were to be deployed effectively. The medium severity suggests a moderate risk level, which could translate into operational disruptions or confidentiality breaches if targeted. European organizations that rely heavily on OSINT tools or have exposure to network-based threats should remain vigilant. The lack of known exploits in the wild reduces immediate risk, but the potential for future exploitation exists, especially if threat actors leverage OSINT to tailor attacks. The impact could be more pronounced in sectors with high-value data or critical infrastructure, where payload delivery malware could cause significant damage.

Defensive guidance

Given the limited specifics, mitigation should focus on enhancing network security monitoring and OSINT tool usage policies. Organizations should: 1) Implement robust network traffic analysis to detect unusual payload delivery attempts, 2) Employ threat intelligence feeds, including ThreatFox, to stay updated on emerging IOCs and adapt defenses accordingly, 3) Harden OSINT tools and restrict their use to trusted personnel to minimize exposure, 4) Conduct regular security awareness training emphasizing the risks of payload delivery malware and social engineering, 5) Utilize endpoint detection and response (EDR) solutions to identify and contain suspicious activities promptly, and 6) Maintain a proactive incident response plan that includes procedures for malware containment and eradication. Since no patches are available, prevention and detection are critical. Additionally, organizations should collaborate with national cybersecurity centers to share intelligence and receive tailored guidance.

Community reviews

Loading reviews…