IndicatorPublished 11 Oct 2025Updated 12 Oct 2025

ThreatFox IOCs for 2025-10-11

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 296

fixprojectbest.spaceUnknown Stealer botnet C2 domain (confidence level: 100%)
entergo.suLumma Stealer botnet C2 domain (confidence level: 75%)
mikhail-bulgakov.suLumma Stealer botnet C2 domain (confidence level: 75%)
lost-heaven.suLumma Stealer botnet C2 domain (confidence level: 75%)
jack-sparrow.suLumma Stealer botnet C2 domain (confidence level: 75%)
tengmev.funLumma Stealer botnet C2 domain (confidence level: 75%)
natctqo.funLumma Stealer botnet C2 domain (confidence level: 75%)
p2n.fa6ic.ruClearFake payload delivery domain (confidence level: 100%)
n.wi7id.ruClearFake payload delivery domain (confidence level: 100%)
d4.wi7id.ruClearFake payload delivery domain (confidence level: 100%)

URLs 12

http://windowsedgeupdater.com/gjs7sdfvsde/login.phpAmadey botnet C2 (confidence level: 100%)
http://94.103.6.167:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://www.offshorereview.com/xmlrpc.phpGootLoader payload delivery URL (confidence level: 75%)
https://offshorereview.com/xmlrpc.phpGootLoader payload delivery URL (confidence level: 75%)
https://api.telegram.org/bot7898980116:aaehtnrnc9waqi6xc5zaxwvc98iiycod_zq/wAgentTea botnet C2 (confidence level: 50%)
https://pastebin.com/raw/bcjc8pkrDCRat botnet C2 (confidence level: 50%)
http://agroos.com/vndmm.exePony payload delivery URL (confidence level: 50%)
http://mutantchicken.co.uk/8ht5hv4f.exePony payload delivery URL (confidence level: 50%)
http://schnell-ordner.de/w9etp.exePony payload delivery URL (confidence level: 50%)
http://www.airtime-telecom.co.uk/qke0w2o.exePony payload delivery URL (confidence level: 50%)

IP addresses 161

91.214.78.9Stealc botnet C2 server (confidence level: 75%)
176.65.132.6Stealc botnet C2 server (confidence level: 75%)
88.214.50.165Stealc botnet C2 server (confidence level: 75%)
196.251.71.132Remcos botnet C2 server (confidence level: 100%)
196.251.71.125Remcos botnet C2 server (confidence level: 100%)
27.102.127.136Remcos botnet C2 server (confidence level: 100%)
5.8.18.18Remcos botnet C2 server (confidence level: 100%)
31.97.113.177Sliver botnet C2 server (confidence level: 100%)
20.118.226.163Sliver botnet C2 server (confidence level: 100%)
165.22.151.69Sliver botnet C2 server (confidence level: 100%)

Hashes 1

Unknown Stealer payload (confidence level: 100%)

e29a794874075f1c26cdc26c25040799bf5dc669cb463d24957ff096b0f1328b

Description

ThreatFox IOCs for 2025-10-11

Impact

For European organizations, the potential impact of this threat is currently limited due to the lack of detailed IOCs and evidence of active exploitation. However, the categorization under malware, network activity, and payload delivery suggests that if exploited, the threat could lead to unauthorized access, data exfiltration, or disruption of network services. Organizations with complex network environments or those operating critical infrastructure could face risks if the malware payloads target such systems. The absence of patches or fixes means that prevention relies heavily on detection and response capabilities. The medium severity indicates a moderate risk that could escalate if further details or active exploitation emerge. European entities involved in sectors such as finance, telecommunications, and government may be more sensitive to such threats due to the strategic value of their data and services. The lack of specific affected products or versions limits the ability to pinpoint exact impact scenarios, but the threat’s presence in OSINT feeds suggests it could be part of broader malware campaigns targeting multiple regions, including Europe.

Defensive guidance

1. Integrate ThreatFox and other OSINT feeds into existing Security Information and Event Management (SIEM) systems to enhance detection of emerging IOCs related to this threat. 2. Conduct continuous network traffic monitoring focusing on unusual payload delivery patterns or anomalous network activity that could indicate malware presence. 3. Employ endpoint detection and response (EDR) solutions with behavioral analytics to identify suspicious processes or payload execution attempts. 4. Maintain up-to-date threat intelligence sharing with European cybersecurity communities such as ENISA and national CERTs to receive timely updates on evolving indicators. 5. Implement strict network segmentation and access controls to limit lateral movement if malware is detected. 6. Conduct regular employee awareness training emphasizing phishing and social engineering risks, as these are common malware delivery vectors. 7. Prepare incident response plans that include procedures for malware containment, eradication, and recovery, tailored to the organization’s network architecture. 8. Since no patches are available, prioritize proactive detection and rapid response over reliance on vendor fixes. 9. Regularly review and update firewall and intrusion detection/prevention system (IDS/IPS) rulesets to block known malicious payload signatures once identified. 10. Collaborate with European cybersecurity agencies to share findings and receive guidance on emerging threats.

Community reviews

Loading reviews…