IndicatorPublished 23 Oct 2025Updated 24 Oct 2025

ThreatFox IOCs for 2025-10-23

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 246

d0mu.60e533569.onlineClearFake payload delivery domain (confidence level: 100%)
sp.authpoint.usa.kelvrion.comHavoc botnet C2 domain (confidence level: 100%)
web-login-cdn.kelvrion.comHavoc botnet C2 domain (confidence level: 100%)
pc.ahz-ya.ruClearFake payload delivery domain (confidence level: 100%)
x2.ahz-ya.ruClearFake payload delivery domain (confidence level: 100%)
q0h.uht-3-o.ruClearFake payload delivery domain (confidence level: 100%)
w6qc.60e533569.onlineClearFake payload delivery domain (confidence level: 100%)
bq.ahz-ya.ruClearFake payload delivery domain (confidence level: 100%)
r9.ahz-ya.ruClearFake payload delivery domain (confidence level: 100%)
t1.ahz-ya.ruClearFake payload delivery domain (confidence level: 100%)

URLs 87

http://126821cm.nyash.es/videotopythonpacketlongpolllinuxflowergeneratorwp.phpDCRat botnet C2 (confidence level: 100%)
http://196.251.118.109/Hook botnet C2 (confidence level: 50%)
http://196.251.73.119/Hook botnet C2 (confidence level: 50%)
http://196.251.73.222/Hook botnet C2 (confidence level: 50%)
https://154.31.221.204:8888/Unknown malware botnet C2 (confidence level: 50%)
https://server13.ninhaine.com/Glupteba botnet C2 (confidence level: 50%)
https://ww25.dfe03de9-5d5d-4ecc-9423-14b8f289583d.server1.ninhaine.com/Glupteba botnet C2 (confidence level: 50%)
https://api.telegram.org/bot8402070841:aahrl8fa0gxoflnkaww-sereimkpzxkh9xo/Agent Tesla botnet C2 (confidence level: 50%)
http://longcc4fqrfcqt5lzceutylaxir6h66fp6df3oin6mvwvz6pfdbxc6qd.onionLockBit botnet C2 (confidence level: 50%)
http://175.178.17.55:443/jquery-3.3.2.slim.min.jsCobalt Strike botnet C2 (confidence level: 75%)

IP addresses 176

118.89.81.201Cobalt Strike botnet C2 server (confidence level: 100%)
101.132.148.165Cobalt Strike botnet C2 server (confidence level: 100%)
195.3.223.146AsyncRAT botnet C2 server (confidence level: 100%)
34.29.67.102Quasar RAT botnet C2 server (confidence level: 100%)
188.120.242.143Empire Downloader botnet C2 server (confidence level: 100%)
216.250.252.224PureLogs Stealer botnet C2 server (confidence level: 100%)
18.138.241.62Cobalt Strike botnet C2 server (confidence level: 100%)
91.92.240.59Latrodectus botnet C2 server (confidence level: 100%)
91.92.240.57Latrodectus botnet C2 server (confidence level: 100%)
201.78.45.51DarkComet botnet C2 server (confidence level: 100%)

Hashes 138

9776a394028e0c85233d00386af0c4a5bdf94fcaRemcos payload (confidence level: 95%)
91c06f8aa57007ba8b3b468c669aa32f7e293a3bb325c46badf18236bd10712cRemcos payload (confidence level: 95%)
bbf09e775a622417e971ec74e93a16a7Remcos payload (confidence level: 95%)
7f84c57a9919abd677f650036644823e9bd4aa53AsyncRAT payload (confidence level: 95%)
f753315089528c4fc70af826ed354385117e7971129e1d011a749f9fc4bd7f1bAsyncRAT payload (confidence level: 95%)
1a15879f982ab66eb72f7baa50a36765AsyncRAT payload (confidence level: 95%)
009619b663db18a541061f1b49a918afed8fbebbStealerium payload (confidence level: 95%)
ea0e3e39e28d3fb00e77911d5dbc4abd0e12b23516175ab9a6c12f2c6a773d4eStealerium payload (confidence level: 95%)
d2711b3eec1915ab2a073c2dc9f0d8a9Stealerium payload (confidence level: 95%)
07d8d86fea35aa7511391b6690d0a9334dbec40bTyphon Stealer payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-10-23

Impact

For European organizations, the impact of this threat intelligence is primarily in enhancing situational awareness and improving detection capabilities rather than responding to an active exploit. Since no specific software vulnerabilities or exploits are identified, there is no direct risk of compromise from this data alone. However, failure to incorporate these IOCs into security monitoring could result in missed detection of malware payload delivery attempts or network-based attacks that align with the indicators. Organizations heavily reliant on OSINT for threat intelligence and those with critical infrastructure or sensitive data could benefit from early detection to prevent potential lateral movement or data exfiltration. The medium severity rating suggests that while the threat is not immediate or critical, it should not be ignored, especially in sectors such as finance, government, and telecommunications, which are frequent targets of sophisticated cyber threats. Overall, the impact is moderate and preventive in nature, emphasizing the importance of threat intelligence integration rather than emergency response.

Defensive guidance

1. Integrate the provided IOCs into existing security infrastructure, including SIEM, IDS/IPS, endpoint detection and response (EDR), and network monitoring tools to enable real-time detection of related malicious activity. 2. Conduct regular threat hunting exercises using these IOCs to identify any signs of payload delivery or suspicious network activity within the environment. 3. Maintain updated OSINT feeds and threat intelligence sharing with trusted partners and information sharing organizations to stay current on evolving threats. 4. Implement network segmentation and strict access controls to limit the potential impact of any detected payload delivery attempts. 5. Train security analysts to recognize patterns associated with the provided IOCs and to escalate findings promptly. 6. Review and update incident response plans to incorporate scenarios involving payload delivery and network-based threats indicated by these IOCs. 7. Continuously monitor for anomalous outbound network traffic that could indicate data exfiltration attempts linked to these indicators. 8. Since no patches are available, focus on detection and containment strategies rather than remediation of software vulnerabilities.

Community reviews

Loading reviews…