IndicatorPublished 22 Oct 2025Updated 23 Oct 2025

ThreatFox IOCs for 2025-10-22

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 284

archive.orlandoluxuryproperties.comFAKEUPDATES botnet C2 domain (confidence level: 100%)
charityjs.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
bcfremote.dmg-tech.comUnknown malware botnet C2 domain (confidence level: 100%)
vpn.dmg-tech.comUnknown malware botnet C2 domain (confidence level: 100%)
owa.dmg-tech.comUnknown malware botnet C2 domain (confidence level: 100%)
hs-analytics.orgNetSupportManager RAT payload delivery domain (confidence level: 100%)
static-hotjar.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
mawp.usNetSupportManager RAT payload delivery domain (confidence level: 100%)
utahlvs.comNetSupportManager RAT payload delivery domain (confidence level: 100%)
hollywoodquarterly.comNetSupportManager RAT payload delivery domain (confidence level: 100%)

URLs 31

https://charityjs.com/xss/buf.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://charityjs.com/xss/index.phpNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://charityjs.com/xss/bof.jsNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://globaltechbilling.com/cmsjjNetSupportManager RAT payload delivery URL (confidence level: 100%)
https://70.36.99.253:15888/gateway/pdxuoitj.e3nx5Rhadamanthys botnet C2 (confidence level: 100%)
http://144.124.228.227/Hook botnet C2 (confidence level: 50%)
http://5.230.155.117/Hook botnet C2 (confidence level: 50%)
https://178.16.54.200/f8nus4b/login.phpAmadey botnet C2 (confidence level: 50%)
https://80806693.xyz/pages/login.phpUnknown malware botnet C2 (confidence level: 50%)
https://196.251.114.38/pages/login.phpUnknown malware botnet C2 (confidence level: 50%)

IP addresses 347

117.72.158.125Ghost RAT botnet C2 server (confidence level: 75%)
206.238.221.126Unknown malware botnet C2 server (confidence level: 100%)
77.3.9.252Unknown malware botnet C2 server (confidence level: 100%)
146.103.101.79Hook botnet C2 server (confidence level: 100%)
183.178.236.95Unknown malware botnet C2 server (confidence level: 100%)
185.132.53.230Unknown malware botnet C2 server (confidence level: 100%)
20.55.83.156Unknown malware botnet C2 server (confidence level: 100%)
185.195.236.92Unknown malware botnet C2 server (confidence level: 100%)
13.220.84.109Cobalt Strike botnet C2 server (confidence level: 50%)
2.241.67.253Unknown malware botnet C2 server (confidence level: 100%)

Hashes 16

bd6988826d26c986912a07837c69775359cdb05b4db9ad300052e81391d5678dCobalt Strike payload (confidence level: 50%)
1bd50c76cbe79111d3df12f812b4ac4a53a3f8fba3266a04721d964a5c125323Unknown malware payload (confidence level: 50%)
21442da01117afc571c25f3944c3f05796f73920af850027ac75a17e45942eb2Unknown malware payload (confidence level: 50%)
07b1f5d83b83f9fb38efbee596b508099bfe4b986f3701a6cf1e093b65a27eebUnknown malware payload (confidence level: 50%)
2b617962b5691f27bd6c48700496710b9a82326a89499308dfdb7b505a585e6fUnknown malware payload (confidence level: 50%)
b053e8694ab492b0051d4c18f56d9da7e4ce13b3cd2daa023a031e8e58b36a22DracuLoader payload (confidence level: 50%)
fe216710b8579c314008bbda96a5e302bd75e3543c57a2f4318cf490470858d6DracuLoader payload (confidence level: 50%)
b5b2cba6da79e608a7009bfa702d56eeba23b26d159646b250f5a32222b6395bDracuLoader payload (confidence level: 50%)
4a0a776fb69f90837eb03ad394273e187f0466fd8293268e5d4896bd2722e356DracuLoader payload (confidence level: 50%)
843f8aea7842126e906cadbad8d81fa456c184fb5372c6946978a4fe115edb1cDracuLoader payload (confidence level: 50%)

Description

ThreatFox IOCs for 2025-10-22

Impact

For European organizations, the impact of this threat is primarily related to potential malware infections through network-based payload delivery. Although no specific exploits or vulnerabilities are identified, the presence of malware IOCs indicates ongoing or emerging campaigns that could lead to unauthorized access, data exfiltration, or disruption of services if payloads are successfully delivered and executed. The medium severity rating suggests a moderate risk level, implying that while immediate widespread damage is unlikely, targeted or opportunistic attacks could affect confidentiality, integrity, or availability of systems. Organizations with extensive network exposure or insufficient monitoring may be more vulnerable. The lack of patch availability means mitigation relies on detection and prevention rather than remediation of a known flaw. European entities in critical infrastructure, finance, and government sectors could face increased risks due to the strategic value of their data and services. However, the general nature of the threat and absence of detailed indicators limit the scope of impact assessment. Overall, the threat underscores the need for robust network defenses and proactive threat intelligence integration to reduce malware infection risks.

Defensive guidance

European organizations should implement enhanced network monitoring to detect anomalous traffic patterns indicative of payload delivery attempts. Deploy advanced endpoint detection and response (EDR) solutions capable of identifying and blocking malware payloads based on behavioral analysis and threat intelligence feeds. Integrate the latest OSINT and ThreatFox IOCs into security information and event management (SIEM) systems to improve detection accuracy. Conduct regular network segmentation to limit lateral movement in case of infection. Employ strict email and web filtering to reduce exposure to common malware delivery vectors. Ensure timely threat hunting exercises focused on network activity and payload delivery indicators. Train security teams to recognize emerging malware behaviors and update incident response plans accordingly. Since no patches are available, emphasize prevention and detection rather than remediation. Collaborate with national cybersecurity centers and information sharing organizations to stay informed about evolving threats. Finally, review and update firewall and intrusion prevention system (IPS) rules to block known malicious network signatures related to payload delivery.

Community reviews

Loading reviews…