IndicatorPublished 27 Oct 2025Updated 28 Oct 2025

ThreatFox IOCs for 2025-10-27

Source ThreatFox MISP Feed

TLP:WHITE, disclosure is not limited

Indicators of compromise

Domains 223

open.ky-4-x.ruClearFake payload delivery domain (confidence level: 100%)
oe.wi-7e.ruClearFake payload delivery domain (confidence level: 100%)
ye.n4-ke.ruClearFake payload delivery domain (confidence level: 100%)
port.ky-4-x.ruClearFake payload delivery domain (confidence level: 100%)
1t.ky-4x.ruClearFake payload delivery domain (confidence level: 100%)
da.wi-7e.ruClearFake payload delivery domain (confidence level: 100%)
clay.tr-8-n.ruClearFake payload delivery domain (confidence level: 100%)
re.s2-ly.ruClearFake payload delivery domain (confidence level: 100%)
rift.tr-8-n.ruClearFake payload delivery domain (confidence level: 100%)
quit.ky-4-x.ruClearFake payload delivery domain (confidence level: 100%)

URLs 44

http://fatisabi.linkpc.net:7974Vjw0rm botnet C2 (confidence level: 100%)
https://176.46.141.3/gateapi/pbjrh9wj.9es9eRhadamanthys botnet C2 (confidence level: 100%)
http://178.16.54.175/fc98bed393364b52.phpStealc botnet C2 (confidence level: 100%)
https://185.244.48.191/c7f0d33720d0f381.phpStealc botnet C2 (confidence level: 50%)
https://77.91.78.118/u83mfds2/index.phpAmadey botnet C2 (confidence level: 50%)
http://157.250.195.21/Hook botnet C2 (confidence level: 50%)
https://pastebin.com/raw/zu1f9id5XWorm botnet C2 (confidence level: 50%)
https://steamcommunity.com/profiles/76561198776306228Vidar botnet C2 (confidence level: 100%)
https://telegram.me/sc0lersVidar botnet C2 (confidence level: 100%)
https://gz.technicalprorj.xyz/Vidar botnet C2 (confidence level: 100%)

IP addresses 120

107.182.225.107AsyncRAT botnet C2 server (confidence level: 100%)
195.3.223.146AsyncRAT botnet C2 server (confidence level: 100%)
185.177.239.252Unknown malware botnet C2 server (confidence level: 100%)
175.27.229.108Venom RAT botnet C2 server (confidence level: 100%)
46.173.214.104DCRat botnet C2 server (confidence level: 100%)
31.11.18.237Unknown malware botnet C2 server (confidence level: 100%)
101.34.205.46Unknown malware botnet C2 server (confidence level: 100%)
101.34.205.46Unknown malware botnet C2 server (confidence level: 100%)
202.181.24.117Kaiji botnet C2 server (confidence level: 100%)
195.248.230.153Unknown malware botnet C2 server (confidence level: 100%)

Hashes 143

150e895fbf2085222dd76c2ef6595a4b04be1761Quasar RAT payload (confidence level: 95%)
fa22249ff51657484072c83e53e154212f12d7659a44feb49e16982dd4ebf552Quasar RAT payload (confidence level: 95%)
f4cc54763cbf0494510742590b799d5cQuasar RAT payload (confidence level: 95%)
d6de247d11062f632cb6eacee930e3cd1620148ctroystealer payload (confidence level: 95%)
aca6be26ac815b0b15cf3c5d9351fb960659dd49cec6059773116eb8b0e6aac7troystealer payload (confidence level: 95%)
8c581b011a9d2301f239ff8234d44835troystealer payload (confidence level: 95%)
2a40ec0c40986aff7080ef66354d9029451e83101df44c63c0b526812c0a5598Coinminer payload (confidence level: 95%)
7fe370b603670211186cd199f5dfe524Coinminer payload (confidence level: 95%)
2f443bdb5597b6f203003364f656cfd875e97c39AsyncRAT payload (confidence level: 95%)
69f1da7651fca3c4a3f8f64ee887cf35a658e06feb6af3bac04b8bf1e6965876AsyncRAT payload (confidence level: 95%)

Description

ThreatFox IOCs for 2025-10-27

Impact

For European organizations, the potential impact of this threat lies primarily in the risk of malware delivery through network activity, which could lead to unauthorized access, data exfiltration, or disruption of services depending on the payload. Although no specific exploits or vulnerabilities are identified, the medium severity rating suggests a moderate risk that could affect confidentiality, integrity, or availability if the malware is successfully deployed. The lack of known exploits in the wild reduces the immediacy of the threat but does not eliminate the risk of future exploitation. Organizations relying heavily on OSINT tools or with extensive network infrastructures may face increased exposure. The threat could be leveraged for espionage, data theft, or as a foothold for further attacks. Given the absence of patches or specific affected versions, the impact is more related to detection and response capabilities than to patch management. European entities in sectors such as finance, government, and critical infrastructure, which are frequent targets of malware campaigns, should consider this threat in their risk assessments. The medium severity indicates that while the threat is not critical, it warrants proactive monitoring and preparedness to mitigate potential damage.

Defensive guidance

European organizations should enhance their network monitoring capabilities to detect unusual or suspicious network activity indicative of malware payload delivery. Integration of ThreatFox and other OSINT-based threat intelligence feeds into Security Information and Event Management (SIEM) systems can improve early detection of emerging threats. Regularly updating and tuning intrusion detection and prevention systems (IDS/IPS) to recognize new indicators is essential, even if specific IOCs are not yet available. Conducting threat hunting exercises focused on network traffic anomalies and payload delivery patterns can help identify early signs of compromise. Organizations should also ensure robust segmentation of networks to limit malware propagation and enforce strict access controls. Employee training on recognizing phishing or social engineering attempts remains important, as these are common malware delivery vectors. Since no patches are available, emphasis should be placed on detection and containment rather than remediation. Collaboration with national cybersecurity centers and participation in information sharing communities can provide timely updates and collective defense benefits. Finally, maintaining comprehensive incident response plans that include scenarios for malware delivery via network vectors will improve organizational resilience.

Community reviews

Loading reviews…