IndicatorPublished 2 Oct 2025Updated 3 Oct 2025

type osint · ThreatFox IOCs for 2025-10-02

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 164

silverquillstone.comBroomstick botnet C2 domain (confidence level: 50%)
sushi-swap.ccUnknown malware botnet C2 domain (confidence level: 100%)
tokenpockethd.comUnknown malware botnet C2 domain (confidence level: 75%)
zy.pgka-9.ruClearFake payload delivery domain (confidence level: 100%)
ac.pgka-9.ruClearFake payload delivery domain (confidence level: 100%)
af.pgka-9.ruClearFake payload delivery domain (confidence level: 100%)
b2.j8k2a.ruClearFake payload delivery domain (confidence level: 100%)
qz9.f-57e.ruClearFake payload delivery domain (confidence level: 100%)
aj.pgka-9.ruClearFake payload delivery domain (confidence level: 100%)
t1.f-57e.ruClearFake payload delivery domain (confidence level: 100%)

URLs 19

https://agentgrabber.com/apiLumma Stealer botnet C2 (confidence level: 75%)
https://zapgrande.com/apiLumma Stealer botnet C2 (confidence level: 75%)
https://expansiveuser.com/apiLumma Stealer botnet C2 (confidence level: 75%)
https://openai-pidor-with-ai.com:6343/gateway/waui3beq.rtn0sRhadamanthys botnet C2 (confidence level: 100%)
https://178.16.53.236:6343/gateway/waui3beq.rtn0sRhadamanthys botnet C2 (confidence level: 100%)
http://91.92.242.27/kawt2qxfppuenm/index.phpAmadey botnet C2 (confidence level: 100%)
http://47.93.252.78:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://101.132.180.178:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://162.252.198.81Stealc botnet C2 (confidence level: 100%)
http://montblancgroup.cfd/new/pws/fre.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)

IP addresses 207

213.209.143.62Mirai botnet C2 server (confidence level: 100%)
213.209.143.62Mirai botnet C2 server (confidence level: 100%)
185.196.9.196Cobalt Strike botnet C2 server (confidence level: 100%)
172.111.213.74Remcos botnet C2 server (confidence level: 100%)
176.57.184.244Remcos botnet C2 server (confidence level: 100%)
185.196.11.223AsyncRAT botnet C2 server (confidence level: 100%)
167.172.215.17SectopRAT botnet C2 server (confidence level: 100%)
34.128.175.224Unknown malware botnet C2 server (confidence level: 100%)
202.61.139.34Kaiji botnet C2 server (confidence level: 100%)
38.150.2.34Kaiji botnet C2 server (confidence level: 100%)

Hashes 208

2d83c4d620866f4ae647ed6a70113686bb7b80b1a7bbdcf544fd0ffec105c4a6Lumma Stealer payload (confidence level: 100%)
17fe8ba4f60509712909304c021a6c72d99a7490285793863436c527c25c35e3Lumma Stealer payload (confidence level: 100%)
dd6ef9a417213c5c1228cbeee396431049e5515fKrakenKeylogger payload (confidence level: 95%)
bd56409ae9a40192097a1b4604f95dbe2ba3c4bf3c1c89bef031c4866300f1f6KrakenKeylogger payload (confidence level: 95%)
6dcfbcf80687d68f1856e927d6042513KrakenKeylogger payload (confidence level: 95%)
9dcca190d193937893194a22c253c806be8fd8d4Formbook payload (confidence level: 95%)
0f5a1d94343f393dbe063e997238d20a5367f96465003bc181d8814bbcd7ba6cFormbook payload (confidence level: 95%)
892406288bba5aaebb2715bdc359c6abFormbook payload (confidence level: 95%)
89403739368b3f8d5526c6d3caec2e4b4e3fcb98Luca Stealer payload (confidence level: 95%)
c3d05ab9b173ea57cafa187bdaaf88be04fb8f13c87a21ff6baafb0bb8eeeb72Luca Stealer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-10-02

Impact

For European organizations, the impact of this threat is currently moderate due to the medium severity rating and the absence of known exploits or patches. The threat's association with payload delivery and network activity suggests potential risks of malware infection, data exfiltration, or disruption of network services if exploited. However, without specific indicators or affected software versions, it is difficult to assess the exact scope or scale of impact. European organizations with extensive network infrastructure and reliance on open-source intelligence tools may face increased exposure if threat actors leverage this malware for targeted attacks or widespread campaigns. The lack of known exploits in the wild reduces immediate risk but does not eliminate the possibility of future exploitation. Organizations should remain vigilant, especially those in critical sectors such as finance, energy, and government, where network-based malware could have significant operational and reputational consequences.

Defensive guidance

Given the limited technical details and absence of patches, European organizations should focus on proactive network security measures. These include implementing robust network segmentation to limit malware propagation, deploying advanced intrusion detection and prevention systems (IDS/IPS) capable of identifying anomalous network activity, and maintaining up-to-date threat intelligence feeds to detect emerging indicators. Regularly reviewing and hardening firewall rules to restrict unauthorized payload delivery channels is essential. Organizations should also conduct frequent security awareness training to reduce the risk of social engineering attacks that could facilitate payload delivery. Since no specific indicators are provided, organizations should enhance monitoring of outbound and inbound network traffic for unusual patterns and employ sandboxing technologies to analyze suspicious payloads. Additionally, maintaining comprehensive incident response plans and conducting tabletop exercises will prepare teams to respond effectively if this or related threats materialize.

Community reviews

Loading reviews…