IndicatorPublished 20 Oct 2025Updated 21 Oct 2025

ThreatFox IOCs for 2025-10-20

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 193

rtx.kaizensamawati.comVidar botnet C2 domain (confidence level: 100%)
gap.kduk8.ruClearFake payload delivery domain (confidence level: 100%)
fix.rkuc9.ruClearFake payload delivery domain (confidence level: 100%)
sea.bkud4.ruClearFake payload delivery domain (confidence level: 100%)
use.cpak0.ruClearFake payload delivery domain (confidence level: 100%)
mud.wtes4.ruClearFake payload delivery domain (confidence level: 100%)
bay.kvus7.ruClearFake payload delivery domain (confidence level: 100%)
egg.kpyb0.ruClearFake payload delivery domain (confidence level: 100%)
tip.ngiz5.ruClearFake payload delivery domain (confidence level: 100%)
384.9e466.ruClearFake payload delivery domain (confidence level: 100%)

URLs 29

http://45.131.64.67/vst/dns.phpUnknown malware botnet C2 (confidence level: 100%)
http://45.131.64.67/vst/test.phpUnknown malware botnet C2 (confidence level: 100%)
https://rtx.kaizensamawati.comVidar botnet C2 (confidence level: 100%)
http://101.35.95.220:18062/sem8Cobalt Strike botnet C2 (confidence level: 75%)
https://steamcommunity.com/profiles/76561198777118079Vidar botnet C2 (confidence level: 100%)
https://telegram.me/sre22qeVidar botnet C2 (confidence level: 100%)
https://cdn.myolt.my.id/Vidar botnet C2 (confidence level: 100%)
https://cdn.italian-ips.com/Vidar botnet C2 (confidence level: 100%)
https://rtx.anditech.my.id/Vidar botnet C2 (confidence level: 100%)
http://62.60.177.9/Hook botnet C2 (confidence level: 50%)

IP addresses 183

49.13.36.231Vidar botnet C2 server (confidence level: 100%)
185.194.141.222Cobalt Strike botnet C2 server (confidence level: 100%)
102.117.166.215Unknown malware botnet C2 server (confidence level: 100%)
27.124.41.58Venom RAT botnet C2 server (confidence level: 100%)
3.209.248.230DeimosC2 botnet C2 server (confidence level: 100%)
114.67.65.99MimiKatz botnet C2 server (confidence level: 100%)
34.22.85.55AdaptixC2 botnet C2 server (confidence level: 100%)
206.189.107.207AdaptixC2 botnet C2 server (confidence level: 100%)
3.91.9.4Meterpreter botnet C2 server (confidence level: 100%)
81.71.35.186Cobalt Strike botnet C2 server (confidence level: 75%)

Hashes 207

e0746cb1f1b4347669b07acb7f4bd571095c19f5ValleyRAT payload (confidence level: 95%)
e36f5ffda8efe348ac7ea072b899f89f6bfd1015b9456fea26367bc9b56c230bValleyRAT payload (confidence level: 95%)
31738cef1afe17d47927ea246dbe7812ValleyRAT payload (confidence level: 95%)
8a98abc2bcbeee78fe4f3379e6c4b63bd18b09bdCobalt Strike payload (confidence level: 95%)
14c9acd6e198a8a9c74445b5b9b5827e05b80c62e4a780c72681e0f2593b974aCobalt Strike payload (confidence level: 95%)
205b36a95f7e70ee2644aed93c3c44dbCobalt Strike payload (confidence level: 95%)
a472bd4942c0a6114ec17947fc0e6401a41f8d54troystealer payload (confidence level: 95%)
84851491726ef3e8c500482f3e48da2dbaded4016aeec4116469d37acd7755e5troystealer payload (confidence level: 95%)
2e0a5ac1d077ba436ed116705873d45ftroystealer payload (confidence level: 95%)
a7bee5faca59f81791eb6bd3f7eb0dac7ba019ccXWorm payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-10-20

Impact

Given the lack of specific exploit details, affected products, or active campaigns, the immediate impact on European organizations is low. However, the presence of such OSINT-based threat intelligence updates can indicate emerging malware trends or reconnaissance activities that could precede targeted attacks. European organizations relying heavily on network infrastructure and OSINT tools may need to be vigilant for related suspicious network activity or payload delivery attempts. The medium severity rating suggests moderate risk, primarily from potential future exploitation rather than current active threats. Disruption to confidentiality, integrity, or availability is not directly evidenced but remains a theoretical concern if payload delivery mechanisms evolve into active malware infections. The absence of patches or known exploits reduces urgency but underscores the need for proactive monitoring. Overall, the impact is more strategic and preparatory than immediate operational compromise.

Defensive guidance

1. Integrate ThreatFox and other OSINT feeds into Security Information and Event Management (SIEM) systems to enhance detection capabilities. 2. Regularly update and tune network intrusion detection/prevention systems (IDS/IPS) to recognize emerging payload delivery patterns. 3. Conduct periodic threat hunting exercises focusing on network activity anomalies that could indicate early-stage malware delivery. 4. Maintain strict network segmentation and least privilege principles to limit potential payload spread. 5. Train security teams to contextualize OSINT updates and correlate them with internal telemetry before escalating. 6. Establish incident response playbooks that incorporate OSINT feed analysis to rapidly assess emerging threats. 7. Collaborate with European cybersecurity information sharing organizations to validate and enrich threat intelligence. 8. Ensure endpoint protection platforms are updated and capable of detecting unknown payload behaviors. These measures go beyond generic advice by emphasizing integration, contextual analysis, and proactive hunting aligned with OSINT updates.

Summary

The data describes a ThreatFox IOC update dated October 20, 2025, classified as malware-related with emphasis on OSINT (Open Source Intelligence), network activity, and payload delivery. ThreatFox is a MISP (Malware Information Sharing Platform) feed that aggregates threat intelligence indicators but this entry lacks specific indicators, affected software versions, or exploit details. The threat level is rated as 2 (on an unspecified scale), with moderate distribution (level 3) and minimal analysis (level 1), suggesting preliminary or low-confidence information. No patches or known exploits in the wild are associated with this entry, indicating it is not an active or confirmed exploit scenario. The absence of CWEs and technical specifics further limits actionable insights. The entry serves primarily as an intelligence update rather than a direct vulnerability or active malware campaign. It highlights the importance of OSINT in identifying potential network threats and payload delivery mechanisms but does not provide concrete attack vectors or payload signatures. Organizations should treat this as a situational awareness update rather than an immediate threat requiring urgent remediation.

Community reviews

Loading reviews…