IndicatorPublished 12 Oct 2025Updated 13 Oct 2025

ThreatFox IOCs for 2025-10-12

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 386

ladybugs.hairUnknown Stealer botnet C2 domain (confidence level: 75%)
natanisralninoklips.comLatrodectus botnet C2 domain (confidence level: 100%)
bubuklaysdertolitodas.comLatrodectus botnet C2 domain (confidence level: 100%)
asderaopafolasuys.comLatrodectus botnet C2 domain (confidence level: 100%)
hasadipocopshas.comLatrodectus botnet C2 domain (confidence level: 100%)
fifalolafasertikonex.comLatrodectus botnet C2 domain (confidence level: 100%)
vivaboklaysdera.comLatrodectus botnet C2 domain (confidence level: 100%)
mareditrixfiresa.comLatrodectus botnet C2 domain (confidence level: 100%)
fasecompasedfjjd.comLatrodectus botnet C2 domain (confidence level: 100%)
stasdirecthpsumsufgh.comLatrodectus botnet C2 domain (confidence level: 100%)

URLs 4

http://47.236.166.45:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
http://85.192.60.253/Hook botnet C2 (confidence level: 50%)
http://176.46.152.89/pen.shUnknown malware payload delivery URL (confidence level: 75%)
http://107.174.64.180:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)

IP addresses 388

38.60.203.137Cobalt Strike botnet C2 server (confidence level: 100%)
181.224.24.208Remcos botnet C2 server (confidence level: 100%)
91.193.7.162Remcos botnet C2 server (confidence level: 100%)
91.92.242.188Remcos botnet C2 server (confidence level: 100%)
196.251.84.142Remcos botnet C2 server (confidence level: 100%)
102.205.170.10Quasar RAT botnet C2 server (confidence level: 100%)
102.205.170.10Quasar RAT botnet C2 server (confidence level: 100%)
102.205.170.10Quasar RAT botnet C2 server (confidence level: 100%)
102.205.170.10Quasar RAT botnet C2 server (confidence level: 100%)
102.205.170.10Quasar RAT botnet C2 server (confidence level: 100%)

Hashes 289

58ed6a8879aaaee95ce482fe7df8fef4b93f701a8ef219f1483efb180aad9ed7Unknown Stealer payload (confidence level: 100%)
0313afefdaed386accb1dfeac4e2379ac1ed59abXWorm payload (confidence level: 95%)
2be6134c467bc71443e76ad1112c8ae3cd95e13c44e13a109de5f64916006f61XWorm payload (confidence level: 95%)
0432ba7a2f50b979166e1cc129a0537bXWorm payload (confidence level: 95%)
551d7bc6c269354518dd84012fd7e1906e7248b6Remcos payload (confidence level: 95%)
1154c3527815ca9abc389ad84cf036d778fe9870c56265d03729752ce6e9a03dRemcos payload (confidence level: 95%)
47c5e3f9269c9ed69fe92eeecf6d3c19Remcos payload (confidence level: 95%)
44c444da5efa2ebd0511a23d1ad9ee913d02d7fdNjRAT payload (confidence level: 95%)
17d96cff5771d920625315bf3f9a8703d2045092f463a5c971b076ff409f3d8aNjRAT payload (confidence level: 95%)
035a634d15db52aed258836c2dfe6467NjRAT payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-10-12

Impact

For European organizations, the impact of this threat is primarily related to potential malware infections resulting from payload delivery mechanisms. If these IOCs correspond to active campaigns, organizations could face risks including data exfiltration, system compromise, or disruption of services. The medium severity suggests that while the threat is not immediately critical, it could lead to moderate operational impacts if exploited. The lack of specific affected products or vulnerabilities means that the threat could be broad and opportunistic, targeting network infrastructure or endpoints indiscriminately. European entities with extensive networked environments, especially those in critical infrastructure, finance, and government sectors, may be at higher risk due to their attractiveness to threat actors. The absence of known exploits in the wild reduces immediate risk but does not eliminate the potential for future exploitation. The impact is also influenced by the effectiveness of existing security controls and threat intelligence integration within organizations.

Defensive guidance

1. Integrate the latest ThreatFox IOCs into security monitoring tools such as SIEM, IDS/IPS, and endpoint detection and response (EDR) systems to enhance detection capabilities. 2. Conduct network traffic analysis focusing on unusual payload delivery patterns and suspicious network activity that may align with the provided IOCs. 3. Strengthen email and web filtering to reduce the risk of malware payload delivery via common vectors. 4. Maintain up-to-date threat intelligence sharing with trusted communities and update detection signatures accordingly. 5. Implement strict network segmentation to limit lateral movement if a compromise occurs. 6. Conduct regular user awareness training emphasizing phishing and social engineering risks that often facilitate payload delivery. 7. Prepare and test incident response plans to quickly contain and remediate infections. 8. Since no patches are available, focus on detection and containment rather than remediation through software updates. 9. Employ behavioral analytics to detect anomalous activities that may not match known IOCs but indicate compromise. 10. Prioritize protection of critical assets and monitor them closely for signs of compromise.

Community reviews

Loading reviews…