IndicatorPublished 26 Sep 2025Updated 27 Sep 2025

type osint · ThreatFox IOCs for 2025-09-26

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 86

hk.pymh.ruClearFake payload delivery domain (confidence level: 100%)
m3.3r7j7.ruClearFake payload delivery domain (confidence level: 100%)
v2.o-554.ruClearFake payload delivery domain (confidence level: 100%)
lq.pymh.ruClearFake payload delivery domain (confidence level: 100%)
qz9.o-554.ruClearFake payload delivery domain (confidence level: 100%)
m0.nybh.ruClearFake payload delivery domain (confidence level: 100%)
t1.o-554.ruClearFake payload delivery domain (confidence level: 100%)
cnc.feds.gayMirai botnet C2 domain (confidence level: 100%)
aaaxxx6.hopto.orgXWorm botnet C2 domain (confidence level: 100%)
nuz8o8.88933.vipAsyncRAT botnet C2 domain (confidence level: 100%)

URLs 24

https://nickbush24.com/regBroomstick botnet C2 (confidence level: 75%)
http://towerbingobongoboom.com:8080/updater?for=e0cd6a53d52a08539a9787e388ff1d3bUnknown malware botnet C2 (confidence level: 100%)
https://daestfestifalkrlon.com/work/Latrodectus botnet C2 (confidence level: 75%)
https://klonfcrtyseaflow.com/work/Latrodectus botnet C2 (confidence level: 75%)
https://ariokliasklfdnok.com/work/Latrodectus botnet C2 (confidence level: 75%)
https://dasrilkosdirosado.com/work/Latrodectus botnet C2 (confidence level: 75%)
https://dorevilokpadjghs.com/work/Latrodectus botnet C2 (confidence level: 75%)
https://sistoronykastadro.com/work/Latrodectus botnet C2 (confidence level: 75%)
https://d0.alexandraparasca.com/Vidar botnet C2 (confidence level: 100%)
https://sfr.konebras.com.br/Vidar botnet C2 (confidence level: 100%)

IP addresses 480

108.187.0.52PureLogs Stealer botnet C2 server (confidence level: 99%)
89.32.41.47Mirai botnet C2 server (confidence level: 100%)
45.156.87.152Mirai botnet C2 server (confidence level: 100%)
108.174.56.150Remcos botnet C2 server (confidence level: 100%)
45.156.87.82AsyncRAT botnet C2 server (confidence level: 100%)
164.68.120.30AsyncRAT botnet C2 server (confidence level: 100%)
201.210.76.254Quasar RAT botnet C2 server (confidence level: 100%)
20.169.181.39Havoc botnet C2 server (confidence level: 100%)
192.142.0.63Havoc botnet C2 server (confidence level: 100%)
196.251.71.141Venom RAT botnet C2 server (confidence level: 100%)

Hashes 188

1783c3314c859cc369ba0875375ee4f95a85291cAgent Tesla payload (confidence level: 95%)
57365350234375cd60d16cba2aefbff8d0dc048ae37669fc40bb9c42cab64037Agent Tesla payload (confidence level: 95%)
e1961dcbe3664231d9affd0ddc5cabd2Agent Tesla payload (confidence level: 95%)
d8830dd2fbcd257f2fc912d6ea22deaee012a003XWorm payload (confidence level: 95%)
e953fbb29aaf02c7f43fe27fede1cab32fddfc1ca1ac7d56e9e75417d72607faXWorm payload (confidence level: 95%)
ea79195fe9790fdeef5e3e8d33b2cdedXWorm payload (confidence level: 95%)
2bdbf301d7c474dc9c7a32d36b2570734781e68fXWorm payload (confidence level: 95%)
18726d40d598feb037efa36fd4419e3a06410a7c8339d8c2459c322acc17d0e9XWorm payload (confidence level: 95%)
eb3f16e236545da03c58202e6003d70bXWorm payload (confidence level: 95%)
9612ff0e6aea42f49cfed8af957d15c5f08e7fabSalatStealer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-09-26

Impact

For European organizations, the impact of this threat could manifest as increased exposure to malware infections facilitated by OSINT-driven reconnaissance and network activity. Such malware could lead to data breaches, operational disruptions, or unauthorized access if successfully delivered and executed. Given the lack of specific affected products or versions, the threat likely targets general network infrastructure or common endpoints, making it a broad risk rather than a targeted vulnerability. The medium severity suggests that while the threat is not immediately critical, it could be leveraged by threat actors to gain footholds in networks, especially if combined with other attack vectors. European organizations with significant online presence or those relying heavily on networked systems for operations could face risks of payload delivery leading to compromise. The absence of known exploits in the wild reduces immediate urgency but does not eliminate the potential for future exploitation or targeted campaigns. Additionally, the use of OSINT techniques indicates that attackers may be tailoring payload delivery based on publicly available information, increasing the sophistication and potential effectiveness of attacks.

Defensive guidance

To mitigate this threat, European organizations should implement enhanced network monitoring to detect unusual payload delivery patterns and network activity consistent with OSINT-driven reconnaissance. Deploying advanced endpoint protection solutions capable of identifying and blocking malware payloads is essential. Organizations should also conduct regular threat intelligence updates, integrating feeds like ThreatFox to stay informed about emerging indicators and tactics. Network segmentation and strict access controls can limit the spread and impact of malware if delivered. Employee training on recognizing phishing and social engineering attempts, which often accompany payload delivery, will reduce the risk of successful infection. Since no patches are available, focus should be on detection and prevention rather than remediation. Additionally, organizations should review and minimize the exposure of sensitive information in public domains to reduce the effectiveness of OSINT by attackers. Implementing robust incident response plans to quickly address detected infections will further reduce potential damage.

Community reviews

Loading reviews…