IndicatorPublished 9 Oct 2025Updated 10 Oct 2025

ThreatFox IOCs for 2025-10-09

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 325

ay.bb3y5.ruClearFake payload delivery domain (confidence level: 100%)
miteamss.comUnknown RAT botnet C2 domain (confidence level: 75%)
tdbfvgwe456yt.comUnknown RAT botnet C2 domain (confidence level: 75%)
9gh.bb3y5.ruClearFake payload delivery domain (confidence level: 100%)
33.bb3y5.ruClearFake payload delivery domain (confidence level: 100%)
jk.bb3y5.ruClearFake payload delivery domain (confidence level: 100%)
ec.bb3y5.ruClearFake payload delivery domain (confidence level: 100%)
9iy.rm6a4.ruClearFake payload delivery domain (confidence level: 100%)
3j.rm6a4.ruClearFake payload delivery domain (confidence level: 100%)
pd.rm6a4.ruClearFake payload delivery domain (confidence level: 100%)

URLs 28

https://05q0h4x0-5500.euw.devtunnels.ms/1.pdbXWorm payload delivery URL (confidence level: 100%)
https://steamcommunity.com/id/tfy5d6gohu8tgy687r7Unknown RAT botnet C2 (confidence level: 50%)
https://topk.beatriceflorea.com/Vidar botnet C2 (confidence level: 100%)
https://fr.cdn.ahmadarief.com/Vidar botnet C2 (confidence level: 100%)
https://topk.morayscouts.online/Vidar botnet C2 (confidence level: 100%)
https://pastebin.com/raw/rcdgdhjjAsyncRAT botnet C2 (confidence level: 50%)
http://solarstorez.com/lambo/panel/shit.exePony payload delivery URL (confidence level: 50%)
https://fr.cdn.riannarusu.com/Vidar botnet C2 (confidence level: 100%)
http://31.58.169.29:1133/loginKillDisk (Lazarus) botnet C2 (confidence level: 50%)
http://ns3177629.ip-51-195-60.eu/loginUnknown malware botnet C2 (confidence level: 50%)

IP addresses 175

141.11.138.193Cobalt Strike botnet C2 server (confidence level: 100%)
178.16.54.171Latrodectus botnet C2 server (confidence level: 100%)
178.16.54.188Latrodectus botnet C2 server (confidence level: 100%)
216.9.224.215Remcos botnet C2 server (confidence level: 100%)
143.244.46.150Remcos botnet C2 server (confidence level: 100%)
107.172.135.42Remcos botnet C2 server (confidence level: 100%)
194.26.192.68Remcos botnet C2 server (confidence level: 100%)
158.94.208.222Remcos botnet C2 server (confidence level: 100%)
158.94.208.222Remcos botnet C2 server (confidence level: 100%)
34.217.94.131Sliver botnet C2 server (confidence level: 100%)

Hashes 24

Unknown Stealer payload (confidence level: 50%)

397ee604eb5e20905605c9418838aadccbbbfe6a15fc9146442333cfc1516273
7a8250904e6f079e1a952b87e55dc87e467cc560a2694a142f2d6547ac40d5e1
7765e5e0a7622ff69bd2cee0a75f2aae05643179b4dd333d0e75f98a42894065
d81cc9380673cb36a30f2a84ef155b0cbc7958daa6870096e455044fba5f9ee8
9c5920fa25239c0f116ce7818949ddce5fd2f31531786371541ccb4886c5aeb2
9090385242509a344efd734710e60a8f73719130176c726e58d32687b22067c8
8ed8880f40a114f58425e0a806b7d35d96aa18b2be83dede63eff0644fd7937d
7881a60ee0ad02130f447822d89e09352b084f596ec43ead78b51e331175450f
d375bb10adfd1057469682887ed0bc24b7414b7cec361031e0f8016049a143f9
039f82e92c592f8c39b9314eac1b2d4475209a240a7ad052b730f9ba0849a54a

Description

ThreatFox IOCs for 2025-10-09

Impact

For European organizations, the impact of this threat intelligence lies primarily in its utility for detection and prevention rather than direct compromise. By integrating these IOCs into security monitoring tools such as SIEMs, IDS/IPS, and endpoint detection platforms, organizations can improve their ability to identify and respond to malware-related activities. This can reduce dwell time of attackers and limit potential damage from payload delivery mechanisms. However, since no active exploits or vulnerabilities are reported, the immediate risk of breach or operational disruption is low. The intelligence supports proactive defense, especially for sectors with high exposure to cyber threats like finance, critical infrastructure, and government. Failure to incorporate such threat intelligence could result in delayed detection of malware campaigns, increasing the risk of data breaches or service interruptions. Overall, the impact is moderate and preventive in nature.

Defensive guidance

1. Integrate the provided ThreatFox IOCs into existing security monitoring and threat intelligence platforms to enhance detection capabilities. 2. Regularly update network and endpoint security tools with the latest threat intelligence feeds to identify and block malicious payload delivery attempts. 3. Conduct periodic threat hunting exercises using these IOCs to proactively identify potential compromises. 4. Strengthen network segmentation and monitoring to limit the spread of malware if detected. 5. Collaborate with national and European cybersecurity information sharing organizations to exchange intelligence and best practices. 6. Train security analysts to recognize patterns related to OSINT-based payload delivery and network activity indicators. 7. Maintain robust incident response plans that incorporate threat intelligence for timely containment and remediation. These steps go beyond generic advice by emphasizing active use of the specific IOCs and collaboration within the European cybersecurity community.

Community reviews

Loading reviews…