IndicatorPublished 14 Oct 2025Updated 15 Oct 2025

ThreatFox IOCs for 2025-10-14

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 302

cansupeker.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
tez-suite.render-app.comUnknown malware botnet C2 domain (confidence level: 75%)
typhondesktop.ioUnknown malware botnet C2 domain (confidence level: 75%)
ccleaner.org.uaUnknown malware botnet C2 domain (confidence level: 75%)
smplswpp.atUnknown malware botnet C2 domain (confidence level: 75%)
putty.org.ruUnknown malware botnet C2 domain (confidence level: 75%)
en-suite-faq.comUnknown malware botnet C2 domain (confidence level: 75%)
o4k.sxuj-7.ruClearFake payload delivery domain (confidence level: 100%)
xd5.rxir9.ruClearFake payload delivery domain (confidence level: 100%)
hwj.sxuj-7.ruClearFake payload delivery domain (confidence level: 100%)

URLs 22

https://cansupeker.com/d.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://t.me/cholarsVidar botnet C2 (confidence level: 100%)
https://steamcommunity.com/profiles/76561198780612393Vidar botnet C2 (confidence level: 100%)
https://pre.sofyartist.com/Vidar botnet C2 (confidence level: 100%)
https://stbl.shutupkissme.com/Vidar botnet C2 (confidence level: 100%)
https://pre.cozygardenkids.com/Vidar botnet C2 (confidence level: 100%)
https://stbl.bluewave-shipping.com/Vidar botnet C2 (confidence level: 100%)
http://45.45.218.216/Hook botnet C2 (confidence level: 50%)
https://193.23.201.110/gateway/mbghugp6.gril7Rhadamanthys botnet C2 (confidence level: 100%)
https://94.74.164.185/gateway/wdcturnb.s6vvbRhadamanthys botnet C2 (confidence level: 100%)

IP addresses 144

196.251.86.247Remcos botnet C2 server (confidence level: 100%)
176.100.36.108Sliver botnet C2 server (confidence level: 100%)
196.251.115.73Unknown malware botnet C2 server (confidence level: 100%)
45.45.218.216Hook botnet C2 server (confidence level: 100%)
41.141.66.113NetSupportManager RAT botnet C2 server (confidence level: 100%)
185.102.115.146Unknown malware botnet C2 server (confidence level: 100%)
158.160.68.120Stealc botnet C2 server (confidence level: 100%)
51.250.113.19Stealc botnet C2 server (confidence level: 100%)
128.0.118.73Bashlite botnet C2 server (confidence level: 100%)
137.184.3.126MimiKatz botnet C2 server (confidence level: 100%)

Hashes 956

aee8ea3ac4ace355d896806f1554c3621a840c5bXWorm payload (confidence level: 95%)
bc7d48593d1e5e0d3d78e66ae0e88cba54e4d52d0d95f1c8f69ba32986246413XWorm payload (confidence level: 95%)
7b1df2af40bd0e2b8add636191a3ac9cXWorm payload (confidence level: 95%)
8f305842c8de5cc72ef4a09f406584d5dced493eQuasar RAT payload (confidence level: 95%)
4ea9a321958b4d2c43cadbb62e2b037b958ed5f9984033aa3a9d10a5423fd006Quasar RAT payload (confidence level: 95%)
ed5d18529b7e0884a985a6ae23684daeQuasar RAT payload (confidence level: 95%)
92070e8948e89c93f759be7b4e50f2a11e5e0761NjRAT payload (confidence level: 95%)
dcfa2975d38f147f2d07eab065cee080a0b982c3a5bdab37678bd86335716f30NjRAT payload (confidence level: 95%)
ad5f1623f61f1eef58c4fbfb8b120b08NjRAT payload (confidence level: 95%)
e2e878595b5658efdfaa73d8b8b1bf825d615508SwaetRAT payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-10-14

Impact

For European organizations, the impact of these IOCs is primarily in the domain of threat detection and situational awareness. Since no specific exploit or vulnerability is identified, the direct risk of compromise is low to medium. However, failure to incorporate these IOCs into monitoring systems could result in missed detection opportunities for malware payload delivery or network-based reconnaissance activities. Organizations involved in critical infrastructure, government, finance, and technology sectors may face increased exposure due to their reliance on OSINT and extensive network communications. The lack of patches or active exploits means that the threat is not immediately disruptive but could serve as an early warning for more sophisticated attacks. If these IOCs correspond to emerging malware campaigns, European entities that do not update their threat intelligence feeds or lack robust network monitoring may experience delayed detection, increasing the risk of lateral movement or data exfiltration. Overall, the impact is moderate and manageable with proper threat intelligence integration and network hygiene.

Defensive guidance

1. Integrate the provided IOCs into existing Security Information and Event Management (SIEM) systems, Intrusion Detection/Prevention Systems (IDS/IPS), and endpoint detection tools to enable early detection of related malicious activity. 2. Enhance network traffic monitoring to identify unusual payload delivery attempts or reconnaissance behaviors associated with the IOCs. 3. Conduct regular threat hunting exercises using these IOCs to proactively identify potential compromises or suspicious activity within the network. 4. Maintain updated OSINT feeds and threat intelligence sharing with trusted partners to stay informed about evolving threats. 5. Implement network segmentation and strict access controls to limit the impact of any detected malware payload delivery. 6. Train security analysts to recognize patterns related to OSINT-based reconnaissance and payload delivery tactics. 7. Since no patches are available, focus on detection and response capabilities rather than remediation of vulnerabilities. 8. Collaborate with national cybersecurity centers and CERTs to validate and contextualize these IOCs within the local threat landscape.

Community reviews

Loading reviews…