IndicatorPublished 21 Oct 2025Updated 22 Oct 2025

ThreatFox IOCs for 2025-10-21

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 5,312

chamjs.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
www.siegelpigeons.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
osinfo.free.beeceptor.comUnknown malware botnet C2 domain (confidence level: 100%)
rds1.dmg-tech.comUnknown malware botnet C2 domain (confidence level: 100%)
p9t.9e466.onlineClearFake payload delivery domain (confidence level: 100%)
heavy40.5-juzeb-0-io.ruClearFake payload delivery domain (confidence level: 100%)
chest.xiqek-40-ye-8.ruClearFake payload delivery domain (confidence level: 100%)
broad.0-rohyp-5-yu.ruClearFake payload delivery domain (confidence level: 100%)
a5ide.1-mafus-044-e.ruClearFake payload delivery domain (confidence level: 100%)
x7.9e466.onlineClearFake payload delivery domain (confidence level: 100%)

URLs 30

https://chamjs.com/xss/buf.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://chamjs.com/xss/index.phpNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://chamjs.com/xss/bof.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://www.siegelpigeons.com/barracoksx.zipNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://nv.d.nadimgadget.shop/Vidar botnet C2 (confidence level: 100%)
https://nv.d.khabeir.com/Vidar botnet C2 (confidence level: 100%)
https://sd.e.airproservices.vu/Vidar botnet C2 (confidence level: 100%)
https://am.d.nadimgadget.shop/Vidar botnet C2 (confidence level: 100%)
https://am.d.khabeir.com/Vidar botnet C2 (confidence level: 100%)
http://217.119.139.117/AMOS botnet C2 (confidence level: 100%)

IP addresses 153

107.172.44.183Cobalt Strike botnet C2 server (confidence level: 100%)
119.29.244.248Cobalt Strike botnet C2 server (confidence level: 100%)
80.98.145.41Remcos botnet C2 server (confidence level: 100%)
23.132.164.57Remcos botnet C2 server (confidence level: 100%)
193.26.115.160Remcos botnet C2 server (confidence level: 100%)
172.245.246.77Remcos botnet C2 server (confidence level: 100%)
91.219.237.165AsyncRAT botnet C2 server (confidence level: 100%)
102.117.170.68Unknown malware botnet C2 server (confidence level: 100%)
161.248.178.196Quasar RAT botnet C2 server (confidence level: 100%)
77.110.106.27Havoc botnet C2 server (confidence level: 100%)

Hashes 188

c4d0fba5aaafa40aef6836ed1414ae3eadc390e1969fdcb3b73c60fe7fb37897Unknown malware payload (confidence level: 50%)
bce2a7165ceead4e3601e311c72743e0059ec2cd734ce7acf5cc9f7d8795ba0fUnknown malware payload (confidence level: 50%)
2e74f6bd9bf73131d3213399ed2f669ec5f75392de69edf8ce8196cd70eb6aeeUnknown malware payload (confidence level: 50%)
3b49904b68aedb6031318438ad2ff7be4bf9fd865339330495b177d5c4be69d1Unknown malware payload (confidence level: 50%)
e9c8f6a7dba6e84a7226af89e988ae5e4364e2ff2973c72e14277c0f1462109bUnknown malware payload (confidence level: 50%)
b60100729de2f468caf686638ad513fe28ce61590d2b0d8db85af9edc5da98f9Unknown malware payload (confidence level: 50%)
f2da013157c09aec9ceba1d4ac1472ed049833bc878a23bc82fe7eacbad399f4Unknown malware payload (confidence level: 50%)
87138f63974a8ccbbf5840c31165f1a4bf92a954bacccfbf1e7e5525d750aa48Unknown malware payload (confidence level: 50%)
09b662afdf5dd64b59ccbbffd3f4779ec31607cdFormbook payload (confidence level: 95%)
2fbff2faed784287ac85fac279c2c0348277552b46b0ffd1ca91d9a61ce8c91eFormbook payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-10-21

Impact

For European organizations, the impact of this threat is currently limited due to the lack of specific exploit details or active attacks. However, the categorization under payload delivery and network activity suggests that if leveraged, it could lead to malware infections, data exfiltration, or network disruptions. Organizations relying on threat intelligence feeds like ThreatFox can benefit from early warnings and prepare defenses accordingly. The medium severity rating indicates a moderate risk level, emphasizing the need for vigilance but not immediate crisis response. Potential impacts include compromised confidentiality and integrity if payloads are delivered successfully, but the absence of known exploits reduces the immediacy of the threat. Overall, the impact is more strategic and preparatory, enhancing situational awareness rather than indicating an imminent breach.

Defensive guidance

European organizations should integrate ThreatFox and similar OSINT feeds into their security monitoring platforms to maintain up-to-date situational awareness. Specific mitigations include enhancing network monitoring for unusual payload delivery patterns, employing advanced threat detection tools capable of analyzing network activity anomalies, and conducting regular threat hunting exercises focused on emerging malware indicators. Since no patches or direct fixes are available, emphasis should be placed on proactive detection and response capabilities. Organizations should also ensure robust endpoint protection and maintain updated incident response plans that incorporate OSINT-derived intelligence. Collaboration with national and European cybersecurity centers can improve contextual understanding and response coordination. Finally, training security teams to interpret and act on OSINT data effectively will maximize the value of such intelligence feeds.

Community reviews

Loading reviews…