IndicatorPublished 24 Sep 2025Updated 25 Sep 2025

type osint · ThreatFox IOCs for 2025-09-24

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 144

ye.kokq.ruClearFake payload delivery domain (confidence level: 100%)
ad.kokq.ruClearFake payload delivery domain (confidence level: 100%)
aw.lalz.ruClearFake payload delivery domain (confidence level: 100%)
bi.lalz.ruClearFake payload delivery domain (confidence level: 100%)
ok.lalz.ruClearFake payload delivery domain (confidence level: 100%)
ya.nyfc.ruClearFake payload delivery domain (confidence level: 100%)
u1.r852o.ruClearFake payload delivery domain (confidence level: 100%)
yo.nyfc.ruClearFake payload delivery domain (confidence level: 100%)
hi.nyfc.ruClearFake payload delivery domain (confidence level: 100%)
ho.nyfc.ruClearFake payload delivery domain (confidence level: 100%)

URLs 36

https://trelev.live/gateway/202hphki.v8dkrRhadamanthys botnet C2 (confidence level: 100%)
https://treten.live/gateway/202hphki.v8dkrRhadamanthys botnet C2 (confidence level: 100%)
https://tretwe.live/gateway/202hphki.v8dkrRhadamanthys botnet C2 (confidence level: 100%)
http://176.46.152.21Stealc botnet C2 (confidence level: 100%)
http://43.162.114.107:4000/loginUnknown malware botnet C2 (confidence level: 50%)
https://3697cf66-1987-43ce-8d41-982981aafbbf.evilginx-azure.online/Unknown malware botnet C2 (confidence level: 50%)
http://77.91.69.107:9000/Hook botnet C2 (confidence level: 50%)
https://nickbush24.com/loginBroomstick botnet C2 (confidence level: 50%)
https://tls.psigestioncomercial.com.ar/Vidar botnet C2 (confidence level: 100%)
http://0752abff3fef14ff5cbbgtwzj6oyyyyyn.oast.site/vreVjw0rm botnet C2 (confidence level: 100%)

IP addresses 364

54.173.154.19Unknown malware payload delivery server (confidence level: 100%)
123.56.54.231Cobalt Strike botnet C2 server (confidence level: 100%)
202.95.21.240Cobalt Strike botnet C2 server (confidence level: 100%)
187.126.137.202DarkComet botnet C2 server (confidence level: 100%)
187.126.137.202DarkComet botnet C2 server (confidence level: 100%)
187.126.137.202DarkComet botnet C2 server (confidence level: 100%)
187.126.137.202DarkComet botnet C2 server (confidence level: 100%)
187.126.137.202DarkComet botnet C2 server (confidence level: 100%)
187.126.137.202DarkComet botnet C2 server (confidence level: 100%)
187.126.137.202DarkComet botnet C2 server (confidence level: 100%)

Hashes 230

89056341d8e738a2264226055b968072f779e52e82a71fec11a906407bf756f8Unknown Stealer payload (confidence level: 100%)
cf029e0d380a673efd50c0c42bbb54e7f786f35b00305f6a36902621453b4872Unknown Stealer payload (confidence level: 100%)
8fe6a8690bd0cb795379fd77e4507ef3da6a8da0Amadey payload (confidence level: 95%)
e26ac00156369e34148ec8b3c3fdb48a4d595d3c3818d810e286084cebe07082Amadey payload (confidence level: 95%)
8e764fb58db93d49527ddc4d9f8e6d11Amadey payload (confidence level: 95%)
17514c100df296aafe2c74888003414857fa1b86Arkei Stealer payload (confidence level: 95%)
f6f94d8c154c278e388ac87e56fbd995433c54bd4f25ef945b77111b2fe3be54Arkei Stealer payload (confidence level: 95%)
221f1e110b193f0c3b88bdd62e31218dArkei Stealer payload (confidence level: 95%)
34bff709b811a0b2c93b9264d86fc4686e51904dAmadey payload (confidence level: 95%)
031b9eb1e99f861093d0ba2c5636ffb5f2c0f6e3d041a0bab7ce77c44ce495e9Amadey payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-09-24

Impact

For European organizations, the impact of this threat is currently assessed as moderate due to the medium severity rating and the nature of the threat involving payload delivery via network activity. If exploited, such malware could lead to unauthorized access, data exfiltration, or disruption of services. However, the lack of known exploits in the wild and absence of detailed indicators reduce the immediacy of the risk. European entities relying heavily on OSINT tools or networked systems could be targeted for reconnaissance or initial infection vectors. The potential impact includes compromise of confidentiality through data leakage, integrity through unauthorized modifications, and availability if payloads disrupt services. Given the limited information, organizations should remain vigilant but not expect widespread or critical impact at this stage.

Defensive guidance

Given the limited specifics, mitigation should focus on enhancing network monitoring and OSINT tool security. Organizations should: 1) Implement advanced network traffic analysis to detect anomalous payload delivery patterns; 2) Harden OSINT platforms by applying strict access controls and regular security audits; 3) Maintain updated endpoint protection solutions capable of detecting unknown or emerging malware behaviors; 4) Employ threat intelligence sharing to stay informed of any emerging indicators related to this threat; 5) Conduct user awareness training focusing on recognizing suspicious network activity and payload delivery attempts; 6) Prepare incident response plans tailored to malware infections involving network-based payload delivery. These measures go beyond generic advice by emphasizing proactive monitoring and OSINT-specific security hardening.

Community reviews

Loading reviews…