IndicatorPublished 13 Oct 2025Updated 14 Oct 2025

ThreatFox IOCs for 2025-10-13

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 349

portykold.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
fe.vqod2.ruClearFake payload delivery domain (confidence level: 100%)
n8x.jcof9.ruClearFake payload delivery domain (confidence level: 100%)
hm.rk8y6.ruClearFake payload delivery domain (confidence level: 100%)
ajf.jcof9.ruClearFake payload delivery domain (confidence level: 100%)
s4.rk8y6.ruClearFake payload delivery domain (confidence level: 100%)
7zt.vqod2.ruClearFake payload delivery domain (confidence level: 100%)
mom.jcof9.ruClearFake payload delivery domain (confidence level: 100%)
k.pf6o2.ruClearFake payload delivery domain (confidence level: 100%)
lo.jcof9.ruClearFake payload delivery domain (confidence level: 100%)

URLs 101

http://87.121.84.101/frost.armv7Mirai payload delivery URL (confidence level: 100%)
http://87.121.84.101/frost.armv6Mirai payload delivery URL (confidence level: 100%)
http://87.121.84.101/frost.armv5Mirai payload delivery URL (confidence level: 100%)
http://87.121.84.101/frost.mipsMirai payload delivery URL (confidence level: 100%)
http://87.121.84.101/frost.mipselMirai payload delivery URL (confidence level: 100%)
http://87.121.84.101/frost.aarch64Mirai payload delivery URL (confidence level: 100%)
http://87.121.84.101/frost.x86Mirai payload delivery URL (confidence level: 100%)
http://87.121.84.101/frost.x86_64Mirai payload delivery URL (confidence level: 100%)
https://portykold.com/work/original.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://portykold.com/work/index.phpNetSupportManager RAT payload delivery URL (confidence level: 100%)

IP addresses 95

185.254.30.188Mirai botnet C2 server (confidence level: 100%)
185.163.45.16NetSupportManager RAT botnet C2 server (confidence level: 100%)
5.101.86.28Remcos botnet C2 server (confidence level: 100%)
196.251.70.171Remcos botnet C2 server (confidence level: 100%)
24.152.38.118Remcos botnet C2 server (confidence level: 100%)
185.174.20.234Remcos botnet C2 server (confidence level: 100%)
178.166.8.51AsyncRAT botnet C2 server (confidence level: 100%)
102.117.169.115Unknown malware botnet C2 server (confidence level: 100%)
87.120.126.21Venom RAT botnet C2 server (confidence level: 100%)
18.230.74.89NetSupportManager RAT botnet C2 server (confidence level: 100%)

Hashes 713

Unknown RAT payload (confidence level: 50%)

b21a2162c5bc9340671840618f236d2655d1107bdc2a203a2ad6f2a00df0081e
30b19c656844a188082a01f9545a59c1e074df6018fa36bfd7167723c7f3fe7c
e791d7007a58f7b8d336f9e2b1bd8fc8c7e120b610b857b6e7a7121c86c3909f
bc2fc09b00a25ff10b1ec85653d1b628e138a22b26cf69095a458434733900c2
9d2c1f2c9fe90a06fa9278d9f6656696df6177d8bf89cafcd94f7686069231f7
ac2c0b4a338622b4d3a16929d4071dba7ca229032b7d31f233cc97aef11910c0
82fbac89e82e00af9409cb231c1da284e5506cd7644b7ae9a05a96145f3105d8
9de3a9a8dfa4c04293b3544c90fc242a7f87931ce71e31405b59227bdea589dc
1796708dd67570c30d8dc9ea2a10a2bc8a7d8d2cea9c5c2103486e6f5b7ed7ad
2808e5c6d33d6d38bfa4f5c9d108bdf9e89d1c68e81f033311859b1d273c60c9

Description

ThreatFox IOCs for 2025-10-13

Impact

For European organizations, the impact of this threat is currently moderate due to the absence of confirmed active exploits or targeted vulnerabilities. Potential impacts include unauthorized payload delivery leading to malware infections, which could compromise confidentiality, integrity, or availability depending on the payload's nature. Network activity associated with this threat may indicate reconnaissance or lateral movement attempts, increasing risk to network infrastructure. Organizations relying heavily on OSINT tools or with extensive network exposure could face elevated risks. The lack of patches means mitigation relies on detection and prevention rather than remediation. If exploited, impacts could range from data breaches to service disruptions, but current intelligence does not confirm such outcomes. The medium severity suggests vigilance but not immediate alarm, emphasizing the importance of proactive threat intelligence and network monitoring to prevent escalation.

Defensive guidance

European organizations should integrate ThreatFox IOCs into their security information and event management (SIEM) and intrusion detection systems (IDS) to enhance detection of related network activity and payload delivery attempts. Regularly update and tune network monitoring tools to identify anomalous traffic patterns consistent with the reported threat. Employ network segmentation to limit potential lateral movement if payload delivery occurs. Conduct threat hunting exercises focusing on the indicators of compromise once available, even though none are currently provided. Maintain up-to-date endpoint protection and implement strict access controls to reduce the attack surface. Enhance employee awareness about phishing and social engineering, as payload delivery often leverages these vectors. Collaborate with national and European cybersecurity centers to share intelligence and receive timely updates. Since no patches exist, emphasize detection and containment strategies rather than remediation. Finally, review and update incident response plans to incorporate scenarios involving OSINT-related payload delivery threats.

Community reviews

Loading reviews…