IndicatorPublished 6 Oct 2025Updated 7 Oct 2025

type osint · ThreatFox IOCs for 2025-10-06

Affects type osintSource ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 142

alfa.picsLumma Stealer botnet C2 domain (confidence level: 75%)
sonnet.suLumma Stealer botnet C2 domain (confidence level: 75%)
z1.t938q.ruClearFake payload delivery domain (confidence level: 100%)
pz8.m-05o.ruClearFake payload delivery domain (confidence level: 100%)
tq.t938q.ruClearFake payload delivery domain (confidence level: 100%)
h9m.t938q.ruClearFake payload delivery domain (confidence level: 100%)
h1.m-05o.ruClearFake payload delivery domain (confidence level: 100%)
x.t938q.ruClearFake payload delivery domain (confidence level: 100%)
aa.m-05o.ruClearFake payload delivery domain (confidence level: 100%)
p.n726z.ruClearFake payload delivery domain (confidence level: 100%)

URLs 28

http://49.113.76.93:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://185.0x8a.88.248/t1.tarLumma Stealer payload delivery URL (confidence level: 100%)
http://185.138.88.248/t1.tarLumma Stealer payload delivery URL (confidence level: 100%)
https://ma.gulfscholarships.com/Vidar botnet C2 (confidence level: 100%)
https://ma.andreicerbu.com/Vidar botnet C2 (confidence level: 100%)
https://49.13.34.69/Vidar botnet C2 (confidence level: 100%)
https://auth.supportive.fit/loginUnknown malware botnet C2 (confidence level: 50%)
https://dotfoods.supportive.fit/loginUnknown malware botnet C2 (confidence level: 50%)
https://o.supportive.fit/loginUnknown malware botnet C2 (confidence level: 50%)
https://advath.supportive.fit/loginUnknown malware botnet C2 (confidence level: 50%)

IP addresses 162

8.217.79.225GobRAT botnet C2 server (confidence level: 75%)
8.217.121.145GobRAT botnet C2 server (confidence level: 75%)
47.242.242.18GobRAT botnet C2 server (confidence level: 75%)
151.242.30.16Mirai botnet C2 server (confidence level: 100%)
162.252.198.81Stealc botnet C2 server (confidence level: 75%)
185.196.8.127Stealc botnet C2 server (confidence level: 75%)
2.58.56.58Stealc botnet C2 server (confidence level: 75%)
45.14.224.65Stealc botnet C2 server (confidence level: 75%)
196.251.114.120Cobalt Strike botnet C2 server (confidence level: 100%)
196.251.116.86Remcos botnet C2 server (confidence level: 100%)

Hashes 134

97f4fc1a163cd54ea497fbf36d719807662c232ad5c45048284c2b54b4cedc4eUnknown Stealer payload (confidence level: 100%)
30554a30e9f8be5c3d43b85579e3d872ad73a2a0521435b39230f9d2a167ceb7Formbook payload (confidence level: 95%)
58f159129fad61380660064d6d7bf8a9Formbook payload (confidence level: 95%)
20a738c7edc7d80fc124cba517a66050fd1c6d0cVidar payload (confidence level: 95%)
725324998184bb75e46e8ab9782d5888992487ad277878de10de51b0ff90887cVidar payload (confidence level: 95%)
f365bbc67fbd869ddbecefcadd517305Vidar payload (confidence level: 95%)
7c801521f6ec6c64a98547f567554a54a414e2b7Vidar payload (confidence level: 95%)
5f24a772b7d724e12679fd7506da5fff14d9e1996149901238a5dd4f4722446aVidar payload (confidence level: 95%)
6b21f6b86c891afa883611867d114241Vidar payload (confidence level: 95%)
4c90446f3302788d331fa046dff0b3371b19329cVidar payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-10-06

Impact

For European organizations, the impact of this threat is primarily in the realm of situational awareness and preparedness. The IOCs provided can help organizations identify malicious network activity or payload delivery attempts that may be linked to emerging malware campaigns. While no active exploits or vulnerabilities are reported, failure to incorporate these IOCs into detection systems could result in delayed identification of attacks, potentially leading to data breaches, service disruptions, or unauthorized access. Organizations heavily reliant on networked infrastructure and those with critical services could face operational risks if threat actors leverage these IOCs to craft targeted attacks. The medium severity rating reflects moderate potential impact, emphasizing the importance of proactive monitoring rather than reactive patching. The lack of patches or known exploits suggests that the threat is not currently causing widespread damage but could evolve. Hence, the impact is more strategic, affecting incident response readiness and threat hunting capabilities.

Defensive guidance

European organizations should integrate the ThreatFox IOCs into their Security Information and Event Management (SIEM) systems, Intrusion Detection/Prevention Systems (IDS/IPS), and endpoint detection tools to enhance visibility of potential malicious activities. Regularly updating threat intelligence feeds and correlating these IOCs with internal logs can improve early detection of suspicious network traffic or payload delivery attempts. Conducting threat hunting exercises using these IOCs can help identify latent compromises. Network segmentation and strict egress filtering can limit the impact of payload delivery mechanisms. Training security teams to interpret OSINT feeds and incorporate them into operational workflows will increase responsiveness. Since no patches are available, emphasis should be placed on detection and containment strategies. Additionally, sharing intelligence with industry peers and national cybersecurity centers can improve collective defense. Finally, maintaining robust backup and recovery processes will mitigate potential damage from malware payloads.

Community reviews

Loading reviews…