IndicatorPublished 27 Sep 2025Updated 28 Sep 2025

type osint · ThreatFox IOCs for 2025-09-27

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 109

media-kg.gl.at.ply.ggXWorm botnet C2 domain (confidence level: 100%)
0m.jagc.ruClearFake payload delivery domain (confidence level: 100%)
eq.jagc.ruClearFake payload delivery domain (confidence level: 100%)
m8.i-215.ruClearFake payload delivery domain (confidence level: 100%)
u0.jagc.ruClearFake payload delivery domain (confidence level: 100%)
6v.jagc.ruClearFake payload delivery domain (confidence level: 100%)
8a.tiqk.ruClearFake payload delivery domain (confidence level: 100%)
q3n.i-215.ruClearFake payload delivery domain (confidence level: 100%)
clearate.cloudCobalt Strike botnet C2 domain (confidence level: 75%)
4f.tiqk.ruClearFake payload delivery domain (confidence level: 100%)

URLs 4

http://47.122.63.148:45981/a3zoCobalt Strike botnet C2 (confidence level: 75%)
http://91.92.240.18Stealc botnet C2 (confidence level: 100%)
http://a1164989.xsph.ru/46a6a560.phpDCRat botnet C2 (confidence level: 100%)
http://5.101.84.22/index.phpKoi Loader botnet C2 (confidence level: 100%)

IP addresses 143

62.164.177.249NetSupportManager RAT botnet C2 server (confidence level: 100%)
144.172.108.70Cobalt Strike botnet C2 server (confidence level: 100%)
62.192.173.249Cobalt Strike botnet C2 server (confidence level: 100%)
117.72.209.44Cobalt Strike botnet C2 server (confidence level: 100%)
91.92.242.96Latrodectus botnet C2 server (confidence level: 100%)
92.61.71.38Remcos botnet C2 server (confidence level: 100%)
186.169.33.26Remcos botnet C2 server (confidence level: 100%)
176.202.9.84AsyncRAT botnet C2 server (confidence level: 100%)
185.94.29.137Venom RAT botnet C2 server (confidence level: 100%)
16.171.55.6PoshC2 botnet C2 server (confidence level: 100%)

Description

ThreatFox IOCs for 2025-09-27

Impact

Given the lack of detailed technical information and absence of known exploits, the immediate impact on European organizations is likely limited. However, the presence of payload delivery and network activity tags suggests potential risks if these IOCs correspond to emerging malware campaigns or threat actor infrastructure. European organizations that rely heavily on OSINT tools or network monitoring may find value in integrating these IOCs into their detection systems to preemptively identify suspicious activity. The medium severity rating indicates a moderate level of concern, possibly due to the potential for these IOCs to be part of broader reconnaissance or initial infection stages. Without specific exploit details or affected products, the direct impact on confidentiality, integrity, or availability remains uncertain but is probably low to medium at this stage.

Defensive guidance

To mitigate potential risks associated with these IOCs, European organizations should: 1) Integrate the provided IOCs into existing security information and event management (SIEM) systems and threat intelligence platforms to enhance detection capabilities. 2) Maintain up-to-date network monitoring and anomaly detection to identify unusual payload delivery attempts or network activity. 3) Conduct regular OSINT and threat intelligence reviews to correlate these IOCs with other emerging threats and adjust defenses accordingly. 4) Educate security teams on the importance of early-stage indicators and encourage proactive hunting based on these IOCs. 5) Since no patches are available, focus on strengthening perimeter defenses, endpoint protection, and network segmentation to limit potential lateral movement if these IOCs are linked to active campaigns.

Community reviews

Loading reviews…