IndicatorPublished 20 Sep 2025Updated 21 Sep 2025

type osint · ThreatFox IOCs for 2025-09-20

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 97

anticybercrime.netUnknown malware botnet C2 domain (confidence level: 50%)
k.391-g.ruClearFake payload delivery domain (confidence level: 100%)
xo.v-96-g.ruClearFake payload delivery domain (confidence level: 100%)
m2.391-g.ruClearFake payload delivery domain (confidence level: 100%)
q.n9t6m.ruClearFake payload delivery domain (confidence level: 100%)
qz7.391-g.ruClearFake payload delivery domain (confidence level: 100%)
t.340-k.ruClearFake payload delivery domain (confidence level: 100%)
ax.r3l1x.ruClearFake payload delivery domain (confidence level: 100%)
b9c.340-k.ruClearFake payload delivery domain (confidence level: 100%)
ak.g7r7s.ruClearFake payload delivery domain (confidence level: 100%)

URLs 7

http://176.46.152.89/1.shUnknown malware payload delivery URL (confidence level: 75%)
http://103.77.241.144/cat.shUnknown malware payload delivery URL (confidence level: 75%)
http://a1165381.xsph.ru/174c693f.phpDCRat botnet C2 (confidence level: 100%)
http://a1168949.xsph.ru/695b0c81.phpDCRat botnet C2 (confidence level: 100%)
http://mi.unbuttonrudder.com/kawt2qxfppuenm/index.phpAmadey botnet C2 (confidence level: 100%)
http://89.46.222.42/wealth/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)
https://195.3.223.126:4287/9d0dc091285eb9fbf2e/o8f3c8oj.8rdifRhadamanthys botnet C2 (confidence level: 100%)

IP addresses 141

91.99.185.176ACR Stealer botnet C2 server (confidence level: 100%)
135.181.250.152ACR Stealer botnet C2 server (confidence level: 100%)
5.161.111.91ACR Stealer botnet C2 server (confidence level: 100%)
178.156.193.72ACR Stealer botnet C2 server (confidence level: 100%)
5.223.48.66ACR Stealer botnet C2 server (confidence level: 100%)
5.223.78.197ACR Stealer botnet C2 server (confidence level: 100%)
95.217.15.46ACR Stealer botnet C2 server (confidence level: 100%)
91.98.135.95ACR Stealer botnet C2 server (confidence level: 100%)
46.62.202.57ACR Stealer botnet C2 server (confidence level: 100%)
5.161.99.194ACR Stealer botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-09-20

Impact

For European organizations, the impact of this threat is currently moderate due to the lack of specific exploit details or active campaigns. However, the presence of payload delivery and network activity components suggests potential risks such as unauthorized access, data leakage, or disruption of network operations if the malware were to be deployed effectively. Organizations relying on OSINT tools or network infrastructures could be targeted for reconnaissance or as vectors for further attacks. The absence of patches and known exploits indicates that preventive measures must focus on detection and network monitoring rather than remediation of a known vulnerability. European entities with critical infrastructure, government networks, or industries with high exposure to cyber espionage could face increased risk if threat actors leverage these IOCs to craft targeted attacks. The medium severity rating implies that while immediate widespread damage is unlikely, vigilance is necessary to prevent escalation or exploitation in the future.

Defensive guidance

Given the limited technical details, European organizations should enhance their threat detection capabilities by integrating the latest ThreatFox IOCs into their security information and event management (SIEM) systems and intrusion detection/prevention systems (IDS/IPS). Network traffic should be monitored for unusual payload delivery patterns or anomalous network activity consistent with the indicators. Organizations should conduct regular threat hunting exercises focusing on OSINT-related malware behaviors and ensure that endpoint detection and response (EDR) solutions are updated to recognize emerging threats. Additionally, implementing strict network segmentation and least privilege access controls can limit the potential spread of malware if an infection occurs. Since no patches are available, emphasis should be placed on proactive monitoring, employee awareness training about phishing and social engineering (common payload delivery methods), and maintaining robust incident response plans tailored to malware incidents. Collaboration with national cybersecurity centers and sharing intelligence within European cybersecurity communities can also improve preparedness.

Community reviews

Loading reviews…