IndicatorPublished 4 Oct 2025Updated 5 Oct 2025

type osint · ThreatFox IOCs for 2025-10-04

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 135

cdn-googlemanager.commagecart credit card skimming domain (confidence level: 100%)
nmn.ismagecart credit card skimming domain (confidence level: 100%)
anl.ismagecart credit card skimming domain (confidence level: 100%)
snf.ismagecart credit card skimming domain (confidence level: 100%)
kof.onemagecart credit card skimming domain (confidence level: 100%)
ko.nxno-7.ruClearFake payload delivery domain (confidence level: 100%)
qz9.c-01e.ruClearFake payload delivery domain (confidence level: 100%)
ku.nxno-7.ruClearFake payload delivery domain (confidence level: 100%)
t1.c-01e.ruClearFake payload delivery domain (confidence level: 100%)
ky.nxno-7.ruClearFake payload delivery domain (confidence level: 100%)

URLs 28

http://193.233.113.101:1111/loginUnknown malware botnet C2 (confidence level: 100%)
https://oriolep.pics/apiLumma Stealer botnet C2 (confidence level: 75%)
http://45.201.0.209:8443/kunkun/jquery-3.3.1.min.jsCobalt Strike botnet C2 (confidence level: 75%)
https://steamcommunity.com/profiles/76561198782513619Vidar botnet C2 (confidence level: 75%)
https://telegram.me/dobbl7Vidar botnet C2 (confidence level: 75%)
https://lorrieobrien.com/regBroomstick botnet C2 (confidence level: 50%)
http://bridgestoneideas.eu/Broomstick botnet C2 (confidence level: 50%)
https://pastebin.com/raw/bzg5zj8nAsyncRAT botnet C2 (confidence level: 50%)
http://lockbit5eevg7vec4vwwtzgkl4kulap6oxbic2ye4mnmlq6njnpc47qd.onionLockBit botnet C2 (confidence level: 50%)
http://lockbit74beza5z3e3so7qmjnvlgoemscp7wtp33xo7xv7f7xtlqbkqd.onionLockBit botnet C2 (confidence level: 50%)

IP addresses 105

193.233.113.101Unknown malware botnet C2 server (confidence level: 100%)
124.198.132.91Remcos botnet C2 server (confidence level: 100%)
107.172.132.45Remcos botnet C2 server (confidence level: 100%)
172.111.131.113Remcos botnet C2 server (confidence level: 100%)
209.74.72.239AsyncRAT botnet C2 server (confidence level: 100%)
54.93.126.183Hook botnet C2 server (confidence level: 100%)
88.175.164.206Quasar RAT botnet C2 server (confidence level: 100%)
45.133.180.154DCRat botnet C2 server (confidence level: 100%)
46.173.214.158DCRat botnet C2 server (confidence level: 100%)
45.192.99.218MooBot botnet C2 server (confidence level: 100%)

Hashes 189

b258d37fe91f0bf078abeaefbc584cd7a08b9f09Luca Stealer payload (confidence level: 95%)
ca10f8af17c49cb7a659badd06b529b816c59d7d6f4e1f9ec23c173fc56588ecLuca Stealer payload (confidence level: 95%)
86c1f5cbb41a3db91fb331bf6fee1e61Luca Stealer payload (confidence level: 95%)
06edc864b7c95188a07e8b9589eeaa24a9b8c0f6Luca Stealer payload (confidence level: 95%)
a32a4ef40c949b6247cf9a0a43546d8e4e5040195db8e8157fe9f884a79e4e9eLuca Stealer payload (confidence level: 95%)
972899fe1db55b0efeafdfa6abed3dcfLuca Stealer payload (confidence level: 95%)
c596ce51ebcadd3d9dab88c2d4ce49e83273350bXWorm payload (confidence level: 95%)
8697e36a4cb7810976c72d5890abeede56a664ab741fe24c755f3648fb5f9124XWorm payload (confidence level: 95%)
b6480c04dd858a0e1596ea34180c31a5XWorm payload (confidence level: 95%)
885ac21b684ab520b2615aef9c78b4c01844ce9fFormbook payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-10-04

Impact

For European organizations, the impact of these IOCs depends largely on their integration into security monitoring and incident response workflows. Since the data pertains to indicators rather than an active exploit or vulnerability, the immediate risk is low to medium. However, failure to incorporate such intelligence could result in delayed detection of malware infections or network intrusions that use the identified payload delivery methods. Organizations with mature security operations centers (SOCs) and threat hunting capabilities can leverage these IOCs to improve detection accuracy and reduce dwell time of threats. Conversely, entities lacking such capabilities may not benefit fully, potentially increasing exposure to malware campaigns that utilize similar tactics. The absence of known exploits in the wild suggests no immediate widespread threat, but the presence of network activity and payload delivery tags indicates a potential for future exploitation attempts. European organizations in critical infrastructure, finance, and government sectors should be particularly vigilant, as these sectors are frequent targets for malware campaigns leveraging OSINT-derived indicators.

Defensive guidance

To effectively mitigate risks associated with these IOCs, European organizations should: 1) Integrate the ThreatFox IOCs into existing Security Information and Event Management (SIEM) systems and Endpoint Detection and Response (EDR) tools to enable automated detection and alerting on related network activity and payload delivery attempts. 2) Conduct regular threat hunting exercises using these IOCs to proactively identify signs of compromise or suspicious behavior within the network. 3) Update firewall and intrusion detection/prevention system (IDS/IPS) signatures to recognize and block traffic patterns or payloads matching the indicators. 4) Enhance employee awareness and training on phishing and social engineering tactics that may be used to deliver payloads associated with these IOCs. 5) Maintain robust network segmentation and least privilege access controls to limit the lateral movement of malware if an infection occurs. 6) Collaborate with national and European cybersecurity information sharing organizations to stay updated on evolving threats and incorporate additional intelligence feeds. These steps go beyond generic advice by emphasizing the operationalization of threat intelligence and proactive defense measures tailored to the nature of the IOCs.

Community reviews

Loading reviews…