IndicatorPublished 19 Oct 2025Updated 20 Oct 2025

ThreatFox IOCs for 2025-10-19

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 180

desktop.dmg-tech.comUnknown malware botnet C2 domain (confidence level: 100%)
assets.dmg-tech.comUnknown malware botnet C2 domain (confidence level: 100%)
42a5.i733643.ruClearFake payload delivery domain (confidence level: 100%)
719.o411213.ruClearFake payload delivery domain (confidence level: 100%)
4823.o411213.ruClearFake payload delivery domain (confidence level: 100%)
70018.o411213.ruClearFake payload delivery domain (confidence level: 100%)
260941.o411213.ruClearFake payload delivery domain (confidence level: 100%)
9912043.o411213.ruClearFake payload delivery domain (confidence level: 100%)
035.o411213.ruClearFake payload delivery domain (confidence level: 100%)
05c8.o411213.ruClearFake payload delivery domain (confidence level: 100%)

URLs 17

http://167.172.107.164:8888/supershell/login/Unknown malware botnet C2 (confidence level: 100%)
https://178.22.24.253:58888/gateway/18bv48hp.ve6upRhadamanthys botnet C2 (confidence level: 100%)
http://2979.my.to/obinna/king.phpLoki Password Stealer (PWS) botnet C2 (confidence level: 100%)
http://94.159.113.37/ssd.pngXWorm payload delivery URL (confidence level: 50%)
https://www.official-website.usdep-osha-portal.help-and-resources.osha-gov.status-drive.top/osha-portal/?id=gxypupq3su4jevwsXWorm payload delivery URL (confidence level: 50%)
https://107.173.152.144:8888/Unknown malware botnet C2 (confidence level: 50%)
https://server3.ninhaine.com/Glupteba botnet C2 (confidence level: 50%)
https://server10.rentalhousezz.net/Glupteba botnet C2 (confidence level: 50%)
https://server11.cdneurop.cloud/Glupteba botnet C2 (confidence level: 50%)
https://wrat.in/sa1at/https:/wrat.in/sa1at/https:/wrat.in/sa1at/https:/wrat.in/sa1at/dns.googlehtSalatStealer botnet C2 (confidence level: 50%)

IP addresses 92

91.134.240.139Loki Password Stealer (PWS) botnet C2 server (confidence level: 75%)
45.74.8.8AsyncRAT botnet C2 server (confidence level: 100%)
13.40.127.157NetSupportManager RAT botnet C2 server (confidence level: 100%)
81.68.194.58Meterpreter botnet C2 server (confidence level: 100%)
54.89.229.206Meterpreter botnet C2 server (confidence level: 100%)
76.72.162.53Revenge RAT botnet C2 server (confidence level: 100%)
196.251.73.187XWorm botnet C2 server (confidence level: 100%)
159.75.95.192Cobalt Strike botnet C2 server (confidence level: 75%)
175.178.225.121Cobalt Strike botnet C2 server (confidence level: 75%)
211.159.178.25Cobalt Strike botnet C2 server (confidence level: 75%)

Hashes 233

4ab4a37db01eba53ee47b31cba60c7a3771b759633717e2c7b9c75310f57f429Unknown Loader payload (confidence level: 50%)
9ae50e74303cb3392a5f5221815cd210af6f4ebf9632ed8c4007a12defdfa50dUnknown Loader payload (confidence level: 50%)
893ee952fa11f4bdc71aee3d828332f939f93722f2ec4ae6c1edc47bed598345Unknown Loader payload (confidence level: 50%)
b60ee1cd3a2c0ffadaad24a992c1699bcc29e2d2c73107f605264dbf5a10d9b6Unknown Loader payload (confidence level: 50%)
0df13fd42fb4a4374981474ea87895a3830eddcc7f3bd494e76acd604c4004f7Unknown Loader payload (confidence level: 50%)
6051384898e7c2e48a2ffb170d71dbf87e6410206614989a037dac7c11b8d346Unknown Loader payload (confidence level: 50%)
01222c6c2dbb021275688b0965e72183876b7adb5363342d7ac49df6c3e36ebeUnknown Loader payload (confidence level: 50%)
6f7c5bad09698592411560a236e87acae3195031646ff06a24f1cfada6774ba6Unknown Loader payload (confidence level: 50%)
6aa2989ebb38e77a247318b5a3410b5d4f72b283c7833a0b800ea7d1de84ccc6Unknown Loader payload (confidence level: 50%)
4c5d7e437f59b41f9f321be8c17ae1f128c04628107a36f83df21b33d12ff8dbUnknown Loader payload (confidence level: 50%)

Description

ThreatFox IOCs for 2025-10-19

Impact

For European organizations, the impact of this threat is primarily in the realm of threat detection and preparedness rather than direct compromise. Since the information pertains to OSINT and network activity related to malware payload delivery, organizations that integrate these IOCs into their security monitoring tools can improve their ability to identify and respond to emerging threats. The lack of known exploits and patches means there is no immediate risk of exploitation or system compromise. However, failure to incorporate such intelligence could result in delayed detection of malware campaigns or network intrusions. Sectors with high digital dependency, such as finance, telecommunications, and critical infrastructure, may benefit most from timely integration of these IOCs. The medium severity rating reflects the potential for malware delivery and network impact if these IOCs correspond to active campaigns in the future. Overall, the threat serves as an early warning rather than an active attack vector.

Defensive guidance

European organizations should focus on integrating the ThreatFox IOCs into their existing Security Information and Event Management (SIEM) systems, intrusion detection/prevention systems (IDS/IPS), and endpoint detection and response (EDR) tools to enhance detection capabilities. Regularly updating threat intelligence feeds and correlating these IOCs with internal logs can help identify suspicious network activity or payload delivery attempts early. Organizations should also conduct threat hunting exercises using these IOCs to proactively search for signs of compromise. Network segmentation and strict access controls can limit the potential spread of malware if detected. Since no patches are available, emphasis should be placed on detection and response rather than remediation. Training security analysts to interpret and act on OSINT feeds effectively will improve overall security posture. Collaboration with national cybersecurity centers and sharing findings can enhance collective defense against emerging threats.

Community reviews

Loading reviews…