IndicatorPublished 3 Oct 2025Updated 4 Oct 2025

type osint · ThreatFox IOCs for 2025-10-03

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 323

pencilsprotocolcrypto.liveUnknown malware botnet C2 domain (confidence level: 100%)
od.pvzi1.ruClearFake payload delivery domain (confidence level: 100%)
o.qgf-5-e.ruClearFake payload delivery domain (confidence level: 100%)
w4.dvn-4-i.ruClearFake payload delivery domain (confidence level: 100%)
oe.pvzi1.ruClearFake payload delivery domain (confidence level: 100%)
pz8.dvn-4-i.ruClearFake payload delivery domain (confidence level: 100%)
aa.qgf-5-e.ruClearFake payload delivery domain (confidence level: 100%)
h1.dvn-4-i.ruClearFake payload delivery domain (confidence level: 100%)
oh.pvzi1.ruClearFake payload delivery domain (confidence level: 100%)
oi.rvni2.ruClearFake payload delivery domain (confidence level: 100%)

URLs 174

https://api.telegram.org/bot8284662503:aafdh0gosdb-2xyztosjhrxmajwjw4nckfuXWorm botnet C2 (confidence level: 50%)
https://dn.andreeamunteanu.com/Vidar botnet C2 (confidence level: 100%)
https://rp.andreeamunteanu.com/Vidar botnet C2 (confidence level: 100%)
https://dn.jullianacalhau.com.br/Vidar botnet C2 (confidence level: 100%)
https://battloeaxes.digital/tqyyLumma Stealer botnet C2 (confidence level: 100%)
https://api.telegram.org/bot8064492276:aafidmfkk4krfg3qeshksvr2jdn2niwryzo/sendmessageAsyncRAT botnet C2 (confidence level: 100%)
https://api.telegram.org/bot8470625522:aafwopgl4knm5nt8yft6_kz_-z56zzgwrb0/sendmessageAsyncRAT botnet C2 (confidence level: 100%)
http://89.105.201.58Stealc botnet C2 (confidence level: 100%)
http://csharpier.at/bja2t8b6mTrickMo botnet C2 (confidence level: 100%)
http://ping-network.digital/negxsh3dy1mdkqphucTrickMo botnet C2 (confidence level: 100%)

IP addresses 304

146.19.168.205XWorm botnet C2 server (confidence level: 100%)
81.70.255.195Cobalt Strike botnet C2 server (confidence level: 100%)
117.72.103.29Cobalt Strike botnet C2 server (confidence level: 100%)
103.176.197.22Ghost RAT botnet C2 server (confidence level: 100%)
185.196.11.138Remcos botnet C2 server (confidence level: 100%)
178.255.244.187Unknown malware botnet C2 server (confidence level: 100%)
192.109.138.67Unknown malware botnet C2 server (confidence level: 100%)
52.14.250.59Havoc botnet C2 server (confidence level: 100%)
54.65.57.175Brute Ratel C4 botnet C2 server (confidence level: 100%)
40.66.48.54Cobalt Strike botnet C2 server (confidence level: 50%)

Hashes 1

XWorm payload (confidence level: 100%)

3bfb8a3957b3fa1ed9164b37995d71b00ea1ea97c29cffe557e8747e0dfd49e7

Description

ThreatFox IOCs for 2025-10-03

Impact

Given the limited technical details and the absence of known exploits or affected software versions, the immediate impact on European organizations is likely low to medium. The threat involves network activity and payload delivery, which could potentially lead to malware infections if exploited. However, without specific malware signatures or attack vectors, organizations may face challenges in detecting or preventing infections proactively. European organizations with extensive network exposure or those relying on open-source intelligence feeds for threat detection might find value in these IOCs for enhancing their monitoring capabilities. The medium severity suggests some risk of compromise, but the lack of authentication requirements or user interaction details implies that exploitation might require specific conditions or targeted attacks. Consequently, the impact on confidentiality, integrity, and availability is uncertain but potentially moderate if the payload delivery leads to successful malware deployment.

Defensive guidance

1. Integrate the provided IOCs into existing Security Information and Event Management (SIEM) and Intrusion Detection/Prevention Systems (IDS/IPS) to enhance network monitoring and detection capabilities. 2. Conduct regular network traffic analysis focusing on unusual payload delivery patterns or communications matching the IOC profiles. 3. Maintain up-to-date endpoint protection solutions capable of detecting and blocking malware payloads, even if specific signatures are not yet available. 4. Employ network segmentation to limit the spread of potential malware infections originating from payload delivery mechanisms. 5. Enhance employee awareness and training regarding phishing and social engineering tactics that could be used to facilitate payload delivery. 6. Collaborate with threat intelligence sharing communities to receive timely updates and context on evolving IOCs related to this threat. 7. Since no patches are available, emphasize proactive detection and containment strategies rather than relying on vulnerability remediation. 8. Perform regular audits of network devices and firewall rules to ensure minimal exposure to external threats that could exploit payload delivery channels.

Community reviews

Loading reviews…